Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
LB3.exe

Overview

General Information

Sample name:LB3.exe
Analysis ID:1484904
MD5:11c051782c327c662507801124f0b95b
SHA1:5dd92a1ab1cfc5b73b5dcdb3edd6ea6d498339df
SHA256:3c13ae9a53b29849fd3bb75d3259a23658cd687441f8bdd610487007c51d2eac
Tags:BlackMatterexe
Infos:

Detection

LockBit ransomware
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Yara detected LockBit ransomware
AI detected suspicious sample
Changes the wallpaper picture
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Deletes itself after installation
Found Tor onion address
Found potential ransomware demand text
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Tries to harvest and steal browser information (history, passwords, etc)
Writes many files with high entropy
Writes to foreign memory regions
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to clear windows event logs (to hide its activities)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Enables security privileges
PE file contains an invalid checksum
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

  • System is w10x64
  • LB3.exe (PID: 6544 cmdline: "C:\Users\user\Desktop\LB3.exe" MD5: 11C051782C327C662507801124F0B95B)
    • splwow64.exe (PID: 1360 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
    • D9D5.tmp (PID: 5892 cmdline: "C:\ProgramData\D9D5.tmp" MD5: 294E9F64CB1642DD89229FFF0592856B)
      • cmd.exe (PID: 2220 cmdline: "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D9D5.tmp >> NUL MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • ONENOTE.EXE (PID: 5260 cmdline: /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{B1C7A99F-124B-4D04-A522-91304C44F3D0}.xps" 133668342863650000 MD5: 0061760D72416BCF5F2D9FA6564F0BEA)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
LB3.exeJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
    LB3.exeWindows_Ransomware_Lockbit_369e1e94unknownunknown
    • 0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
    • 0x4d4:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
    SourceRuleDescriptionAuthorStrings
    00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
      00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
        00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
          00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
            00000000.00000003.2046545307.00000000010F5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
              Click to see the 61 entries
              SourceRuleDescriptionAuthorStrings
              0.0.LB3.exe.330000.0.unpackJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
                0.0.LB3.exe.330000.0.unpackWindows_Ransomware_Lockbit_369e1e94unknownunknown
                • 0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
                • 0x4d4:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
                0.2.LB3.exe.330000.0.unpackJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
                  0.2.LB3.exe.330000.0.unpackWindows_Ransomware_Lockbit_369e1e94unknownunknown
                  • 0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
                  • 0x4d4:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...

                  System Summary

                  barindex
                  Source: Registry Key setAuthor: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ): Data: Details: C:\ProgramData\d093fD6aI.bmp, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LB3.exe, ProcessId: 6544, TargetObject: HKEY_CURRENT_USER\Control Panel\Desktop\WallPaper
                  No Snort rule has matched
                  Timestamp:2024-07-30T19:31:56.748581+0200
                  SID:2022930
                  Source Port:443
                  Destination Port:49719
                  Protocol:TCP
                  Classtype:A Network Trojan was detected
                  Timestamp:2024-07-30T19:31:17.543406+0200
                  SID:2022930
                  Source Port:443
                  Destination Port:49704
                  Protocol:TCP
                  Classtype:A Network Trojan was detected

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Source: LB3.exeAvira: detected
                  Source: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionAvira URL Cloud: Label: malware
                  Source: http://lockbitsupp.uzAvira URL Cloud: Label: malware
                  Source: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionAvira URL Cloud: Label: malware
                  Source: C:\ProgramData\D9D5.tmpAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                  Source: C:\ProgramData\D9D5.tmpReversingLabs: Detection: 91%
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.6% probability
                  Source: C:\ProgramData\D9D5.tmpJoe Sandbox ML: detected
                  Source: LB3.exeJoe Sandbox ML: detected
                  Source: LB3.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Videos\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Searches\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Saved Games\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Recent\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Pictures\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Pictures\Saved Pictures\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Pictures\Camera Roll\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\OneDrive\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Music\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Links\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Favorites\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Favorites\Links\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Downloads\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\ZIPXYXWIOY\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\PALRGUCVEH\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\GIGIYTFFYT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\EWZCVGNOWT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\CZQKSDDMWR\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\BJZFPPWAPT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\ZIPXYXWIOY\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\PALRGUCVEH\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\GRXZDKKVDB\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\GIGIYTFFYT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\EWZCVGNOWT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\CZQKSDDMWR\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Contacts\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Headlights\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\dd432c4a-ba38-4070-9985-ed1b3bea85dc\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\VirtualStore\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_761252224\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_1791500899\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_2640_817343797\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Low\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_995017740\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_778675694\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_736602331\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_649288342\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_339006160\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_27162369\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1988346647\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1959985254\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1807723660\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1693012001\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1635976352\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1619438387\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1485273224\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1421574262\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1318414972\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1289371347\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1234978473\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1191663050\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1090636871\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrocef_low\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\PeerDistRepub\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{99fff775-938d-4e2c-9c06-5d56107a5383}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2737c7bb-35fb-4b44-baf9-033ca587595d}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4e763a36-90d3-4d6c-9949-dd01f7e5d23f}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91a05a-d98f-4429-81a9-272df0335447}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{de0f148a-c476-467a-b7a3-14b0bb463140}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c982025a-def7-4db3-b4ed-6b518d9c59e6}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: LB3.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: LB3.exe, 00000000.00000003.2130435258.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136035753.00000000010E1000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129139784.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2119903214.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136372476.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2130270257.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131457280.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129317008.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2130089902.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2144130407.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2120760500.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129490804.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131900597.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131292768.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131098088.00000000010D6000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.d093fD6aI source: LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2094973937.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2087183487.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092403598.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2091597225.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090592274.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090806714.000000000112A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: LB3.exe, 00000000.00000003.2108854474.0000000001116000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\d093fD6aI.README.txt source: LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2085589273.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2094973937.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2087183487.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092403598.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2091597225.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090592274.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090806714.000000000112A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.d093fD6aI source: LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2094973937.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2087183487.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092403598.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2091597225.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090592274.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090806714.000000000112A000.00000004.00000020.00020000.00000000.sdmp
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00335C34 FindFirstFileW,FindClose,FindNextFileW,FindClose,0_2_00335C34
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033A064 FindFirstFileExW,FindClose,0_2_0033A064
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033748C FindFirstFileExW,FindNextFileW,0_2_0033748C
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00337560 FindFirstFileExW,FindClose,0_2_00337560
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033763C FindFirstFileExW,GetFileAttributesW,FindNextFileW,0_2_0033763C
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033F264 GetFileAttributesW,SetThreadPriority,FindFirstFileExW,FindNextFileW,FindClose,0_2_0033F264
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_0040227C FindFirstFileExW,10_2_0040227C
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,10_2_0040152C
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00337438 GetLogicalDriveStringsW,GetDriveTypeW,0_2_00337438
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Jump to behavior

                  Networking

                  barindex
                  Source: LB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
                  Source: LB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
                  Source: LB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionl
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionug
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionn
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onioned*
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion9
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionL
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionlS
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionu
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionic
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion]
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionc
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion7
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionZ
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onioni
                  Source: LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
                  Source: LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
                  Source: LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
                  Source: SPL93F1.tmp.0.drString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
                  Source: SPL93F1.tmp.0.drString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
                  Source: SPL93F1.tmp.0.drString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmp, SPL93F1.tmp.0.drString found in binary or memory: http://lockbitapt.uz
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
                  Source: SPL93F1.tmp.0.drString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionL
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onioned
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionl
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionlS
                  Source: LB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion7
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion9
                  Source: SPL93F1.tmp.0.drString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionc
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onioni
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionic
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionn
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionu
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
                  Source: SPL93F1.tmp.0.drString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionZ
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionug
                  Source: LB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupp.uz
                  Source: SPL93F1.tmp.0.drString found in binary or memory: http://lockbitsupp.uzFFFFFFFFFFFFFFFFFFFFF
                  Source: LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2085589273.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2047950020.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126925110.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2134232080.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2077273451.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2135881398.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076696808.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124531922.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131744862.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126388021.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2123819055.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2049589005.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136330514.0000000001213000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://coinatmradar.com.
                  Source: LB3.exe, 00000000.00000003.2250699741.0000000001261000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
                  Source: LB3.exe, 00000000.00000003.2250820361.00000000011C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/b66761fb-96b7-4a6b-
                  Source: LB3.exe, 00000000.00000003.2251462047.0000000001266000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/newtab/1/3365803a-9025-4882-a8d3-91a98
                  Source: App1722360706993325100_1BCA18EB-AE8C-4135-9A5E-1F919E09D643.log.9.drString found in binary or memory: https://login.windows.net
                  Source: LB3.exe, 00000000.00000003.2058530230.000000000119F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                  Source: LB3.exe, 00000000.00000003.2058530230.000000000119F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefox
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2097368882.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2085589273.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2047950020.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126925110.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2134232080.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2097688935.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2077273451.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2135881398.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076696808.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124531922.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131744862.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126388021.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2123819055.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2049589005.00000000010F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tox.chat/download.html.
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/
                  Source: LB3.exe, 00000000.00000003.2130435258.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136035753.00000000010E1000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129139784.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2119903214.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136372476.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2130270257.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131457280.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2046379671.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2059958593.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129317008.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2130089902.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2144130407.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2120760500.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129490804.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131900597.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131292768.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131098088.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.moonpay.co
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2085589273.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2047950020.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126925110.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2134232080.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2077273451.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2135881398.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076696808.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124531922.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131744862.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126388021.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2123819055.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2049589005.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136330514.0000000001213000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.moonpay.com/buy.
                  Source: LB3.exe, 00000000.00000003.2058530230.000000000119F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/
                  Source: LB3.exe, 00000000.00000003.2058530230.000000000119F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/
                  Source: LB3.exe, 00000000.00000003.2058530230.000000000119F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
                  Source: LB3.exe, 00000000.00000003.2058530230.000000000119F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                  Source: LB3.exe, 00000000.00000003.2250778128.00000000011DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/css/protocol-mozilla.69f153651644.css
                  Source: LB3.exe, 00000000.00000003.2250820361.00000000011CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/protocol/img/logos/firefox/browser/logo.eb1324e44442.svg
                  Source: LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/

                  Spam, unwanted Advertisements and Ransom Demands

                  barindex
                  Source: C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtDropped file: ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~>>>> Your data are stolen and encryptedThe data will be published on TOR website if you do not pay the ransom BTC amount 0.01 = up to 12hrBTC amount 0.02 = up to 24hrBTC amount 0.1 = up 48 hrBTC amount 0 , deleted all files from you PC, and post all infirmation to public.where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST.Time just 12 hr, after everythink will be removedYou can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. You have 12 hours for the transfer, 24 hours for the amount of 0.02, and of course, you can always wait 48 hours and pay 0.1. After that, send a request with confirmation to TOX , faster way!You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, tox. Tox ID LockBitSupp: B90F5C1EC3C13400F6D0B22B772C5FAB086F8C41A0C87B92A8B3C7F2ECBBCE191A455140273EJump to dropped file
                  Source: Yara matchFile source: LB3.exe, type: SAMPLE
                  Source: Yara matchFile source: 0.0.LB3.exe.330000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.LB3.exe.330000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2046545307.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2047950020.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2126925110.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2077273451.000000000112A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2076696808.000000000112A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2134232080.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2135881398.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2124531922.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2131744862.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2123819055.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2126388021.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2049589005.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2136330514.0000000001213000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2047950020.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2131851074.0000000001213000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2134155794.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2134917238.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2077365585.000000000112A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000000.2036214305.0000000000331000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2128505179.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2077557162.000000000112A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2052572656.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2051284799.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2122293689.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2132955386.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2123057214.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2121612974.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2123606251.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2133500746.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2135502951.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2132819771.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2135126379.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2133362008.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2051284799.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2135711982.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2076225685.000000000112A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2134445994.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2135629721.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2134402493.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2077653905.000000000112A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2124340239.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2135022255.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2049589005.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2134492300.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2108854474.0000000001116000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2144130407.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2124104518.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2123910235.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2120680181.0000000001215000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2075730284.000000000112A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2125747303.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2076922515.000000000112A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2125217864.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2127233262.000000000120F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: LB3.exe PID: 6544, type: MEMORYSTR
                  Source: C:\Users\user\Desktop\LB3.exeKey value created or modified: HKEY_CURRENT_USER\Control Panel\Desktop WallPaper C:\ProgramData\d093fD6aI.bmpJump to behavior
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedQE
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedeE
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypteds
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedn;a
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptede
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedsyD
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedwD
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : All your important files are stolen and encrypted!
                  Source: LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2130435258.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2047950020.00000000010FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2126925110.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2134232080.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2077273451.000000000112A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2136035753.00000000010E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2129139784.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2135881398.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2076696808.000000000112A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2124531922.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2131744862.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2126388021.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2119903214.00000000010E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2123819055.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2049589005.00000000010F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2136330514.0000000001213000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2136372476.00000000010E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2047950020.00000000010F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2132683112.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2131851074.0000000001213000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2134155794.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2132069927.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2134917238.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2128505179.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2077365585.000000000112A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2130270257.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2052572656.00000000010FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2132283633.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2051284799.00000000010F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2131457280.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2122293689.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2132955386.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2046379671.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2123057214.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2119838624.000000000111A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2121612974.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2123606251.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2132819771.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2059958593.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2133500746.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2129317008.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2135502951.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2120680181.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2130089902.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2133362008.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2051284799.00000000010FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2134445994.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2076225685.000000000112A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2144130407.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2144130407.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2144130407.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2120760500.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2132552226.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2129490804.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2131900597.00000000010E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2049589005.00000000010FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2108854474.0000000001116000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2120680181.0000000001215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2125747303.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2131292768.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2125217864.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2075730284.000000000112A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2131098088.00000000010D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : ta are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2127233262.000000000120F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: LB3.exe, 00000000.00000003.2144013329.0000000001200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt408.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt490.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt269.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt261.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt426.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt91.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt31.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt348.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt144.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt295.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt68.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt449.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt512.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt505.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt224.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt499.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt200.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt329.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt255.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt485.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt268.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt102.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt241.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt73.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt69.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt221.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt82.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt227.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt39.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt196.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt528.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt416.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt13.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt347.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt51.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt520.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt542.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt470.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt297.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt546.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt66.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt419.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt186.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt76.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt225.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt292.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt81.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt422.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt206.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt375.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt421.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt100.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt157.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt517.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt434.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt216.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt107.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt363.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt381.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt243.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt412.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt530.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt494.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt558.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt154.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt244.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt389.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt519.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt98.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: SPL93F1.tmp.0.drString found in binary or memory : Your data are stolen and encryptedFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
                  Source: d093fD6aI.README.txt179.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt489.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt424.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt464.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt209.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt106.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt86.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt461.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt258.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt500.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt0.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt452.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt111.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt487.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt521.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt238.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt125.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt356.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt248.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt42.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt393.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt543.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt326.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt359.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt306.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt147.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt188.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt557.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt457.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt94.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt203.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt314.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt109.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt35.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt446.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt545.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt24.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt23.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt431.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt130.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt79.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt301.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt388.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt260.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt321.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt266.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt360.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt128.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt432.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt80.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt281.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt67.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt112.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt386.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt382.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt308.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt482.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt405.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt425.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt289.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt390.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt141.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt156.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt361.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt233.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt532.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt131.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt407.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt237.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt516.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt165.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt25.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt391.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt246.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt312.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt89.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt342.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt267.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt436.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt369.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt229.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt9.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt284.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt325.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt376.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt30.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt443.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt420.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt477.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt554.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt40.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt49.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt249.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt277.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt198.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt370.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt133.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt171.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt533.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt213.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt317.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt397.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt406.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt20.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt515.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt323.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt105.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt230.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt469.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt234.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt251.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt445.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt401.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt561.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt484.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt191.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt257.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt504.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt84.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt15.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt194.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt45.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt41.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt5.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt387.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt383.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt441.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt450.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt448.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt435.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt430.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt55.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt459.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt479.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt228.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt181.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt447.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt396.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt539.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt236.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt44.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt563.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt126.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt59.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt36.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt116.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt440.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt355.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt291.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt231.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt219.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt53.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt305.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt399.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt455.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt556.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt404.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt129.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt63.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt310.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt351.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt465.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt214.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt506.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt8.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt182.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt327.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt50.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt492.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt169.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt83.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt150.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt384.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt488.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt265.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt99.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt414.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt64.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt211.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt114.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt218.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt175.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt74.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt180.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt119.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt400.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt113.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt222.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt254.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt518.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt54.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt510.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt14.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt309.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt564.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt307.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt341.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt345.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt153.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt411.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt318.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt478.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt32.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt402.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt139.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt371.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt513.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt453.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt12.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt272.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt333.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt176.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt3.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt331.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt298.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt263.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt538.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt103.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt385.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt276.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt259.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt332.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt208.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt178.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt90.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt496.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt38.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt451.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt189.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt403.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt529.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt497.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt392.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt177.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt160.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt547.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt271.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt253.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt346.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt88.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt183.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt202.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt379.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt509.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt362.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt245.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt28.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt17.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt135.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt61.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt58.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt123.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt507.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt536.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt364.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt493.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt541.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt167.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt410.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt27.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt373.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt344.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt423.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt104.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt240.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt235.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt349.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt550.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt78.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt287.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt366.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt173.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt93.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt136.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt7.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt207.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt290.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt372.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt549.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt232.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt415.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt439.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt164.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt18.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt294.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt525.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt343.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt280.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt185.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt146.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt357.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt300.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt535.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt560.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt503.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt212.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt274.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt378.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt140.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt526.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt72.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt19.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt418.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt377.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt282.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt335.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt252.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt166.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt438.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt197.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt158.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt62.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt174.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt460.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt286.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt134.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt524.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt522.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt283.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt296.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt350.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt320.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt184.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt555.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt120.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt474.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: d093fD6aI.README.txt352.0.drString found in binary or memory : >>>> Your data are stolen and encrypted
                  Source: C:\Users\user\Desktop\LB3.exeFile moved: C:\Users\user\Desktop\PALRGUCVEH\QCOILOQIKC.mp3Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile moved: C:\Users\user\Desktop\PALRGUCVEH\EOWRVPQCCS.xlsxJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile moved: C:\Users\user\Desktop\PALRGUCVEH.docxJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile moved: C:\Users\user\Desktop\PALRGUCVEH\PALRGUCVEH.docxJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile moved: C:\Users\user\Desktop\EOWRVPQCCS.xlsxJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel.d093fD6aI entropy: 7.99564307441Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Shell_RunDialog.d093fD6aI entropy: 7.99440713914Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_RemoteDesktop.d093fD6aI entropy: 7.99466844405Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Photos_8wekyb3d8bbwe!App.d093fD6aI entropy: 7.99460870329Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_MediaPlayer32.d093fD6aI entropy: 7.99543788868Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer.d093fD6aI entropy: 7.99527253921Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msconfig_exe.d093fD6aI entropy: 7.99483136803Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_magnify_exe.d093fD6aI entropy: 7.99526687657Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe.d093fD6aI entropy: 7.99514737549Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_iscsicpl_exe.d093fD6aI entropy: 7.99487151689Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_dfrgui_exe.d093fD6aI entropy: 7.99476761299Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.d093fD6aI entropy: 7.99490487725Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cmd_exe.d093fD6aI entropy: 7.99528261372Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe.d093fD6aI entropy: 7.99527361953Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe.d093fD6aI entropy: 7.995786555Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge.d093fD6aI entropy: 7.9950082486Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_services_msc.d093fD6aI entropy: 7.99430592721Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_RecoveryDrive_exe.d093fD6aI entropy: 7.99457582812Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe.d093fD6aI entropy: 7.99519633266Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_psr_exe.d093fD6aI entropy: 7.99587505941Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_printmanagement_msc.d093fD6aI entropy: 7.99495673009Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe.d093fD6aI entropy: 7.99513750428Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_odbcad32_exe.d093fD6aI entropy: 7.99523139362Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_notepad_exe.d093fD6aI entropy: 7.99540218528Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_narrator_exe.d093fD6aI entropy: 7.99512401441Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_mspaint_exe.d093fD6aI entropy: 7.99547011989Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msinfo32_exe.d093fD6aI entropy: 7.99501277995Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_exe.d093fD6aI entropy: 7.99518118288Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Windows NT_Accessories_wordpad_exe.d093fD6aI entropy: 7.99506797639Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Common Files_Microsoft Shared_Ink_mip_exe.d093fD6aI entropy: 7.99608370197Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Adobe_Acrobat DC_Acrobat_Acrobat_exe.d093fD6aI entropy: 7.99537982961Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7zFM_exe.d093fD6aI entropy: 7.9946656912Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7-zip_chm.d093fD6aI entropy: 7.99533878563Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.d093fD6aI entropy: 7.99595252954Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_powershell_exe.d093fD6aI entropy: 7.99466770748Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WF_msc.d093fD6aI entropy: 7.9946448965Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WFS_exe.d093fD6aI entropy: 7.99554024124Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe.d093fD6aI entropy: 7.99509164905Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_SciTE_SciTE_exe.d093fD6aI entropy: 7.99454345587Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Extras.d093fD6aI entropy: 7.99536224232Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Examples.d093fD6aI entropy: 7.99496982449Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt_chm.d093fD6aI entropy: 7.99561941413Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoItX_AutoItX_chm.d093fD6aI entropy: 7.99522270652Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_x64_exe.d093fD6aI entropy: 7.99491020913Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_exe.d093fD6aI entropy: 7.99541602987Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt v3 Website_url.d093fD6aI entropy: 7.99519360226Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_x64_exe.d093fD6aI entropy: 7.99545079139Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_exe.d093fD6aI entropy: 7.9954251666Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_x64_exe.d093fD6aI entropy: 7.99436236535Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs.d093fD6aI entropy: 7.99962103784Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log.d093fD6aI entropy: 7.99966741069Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{F38BF404-1D43-42F2-9305-67DE0B28FC23}_regedit_exe.d093fD6aI entropy: 7.99503428413Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.d093fD6aI entropy: 7.99505214888Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_powershell_exe.d093fD6aI entropy: 7.99431001788Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe.d093fD6aI entropy: 7.99520407843Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Java_jre-1_8_bin_javacpl_exe.d093fD6aI entropy: 7.99419871471Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.d093fD6aI entropy: 7.99962700872Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs.d093fD6aI entropy: 7.99967081947Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.d093fD6aI entropy: 7.99488002384Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.d093fD6aI entropy: 7.99030471412Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\index.d093fD6aI entropy: 7.99921789672Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.d093fD6aI entropy: 7.9906866718Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.d093fD6aI entropy: 7.99926982219Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\index.d093fD6aI entropy: 7.99925080306Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-shm.d093fD6aI entropy: 7.99367143602Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm.d093fD6aI entropy: 7.99058701999Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.d093fD6aI entropy: 7.99818393467Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.d093fD6aI entropy: 7.99739220432Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.d093fD6aI entropy: 7.99920449861Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\7ef6ad84fc7140c69227e15f7ba62786_1.d093fD6aI entropy: 7.99504404137Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\7c5437483f564236a662f32c11bc3c36_1.d093fD6aI entropy: 7.99576915214Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.d093fD6aI entropy: 7.99925488005Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.d093fD6aI entropy: 7.99906891969Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl.d093fD6aI entropy: 7.99743104841Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl.d093fD6aI entropy: 7.99757347142Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages.d093fD6aI entropy: 7.99707715685Jump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\notificationsDB.d093fD6aI entropy: 7.9917706683Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\LB3.exe entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\AAAAAAA (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\BBBBBBB (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\CCCCCCC (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\DDDDDDD (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\EEEEEEE (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\FFFFFFF (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\GGGGGGG (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\HHHHHHH (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\IIIIIII (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\JJJJJJJ (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\KKKKKKK (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\LLLLLLL (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\MMMMMMM (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\NNNNNNN (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\OOOOOOO (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\PPPPPPP (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\QQQQQQQ (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\RRRRRRR (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\SSSSSSS (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\TTTTTTT (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\UUUUUUU (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\VVVVVVV (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\WWWWWWW (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\XXXXXXX (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\YYYYYYY (copy) entropy: 7.99703768169Jump to dropped file
                  Source: C:\ProgramData\D9D5.tmpFile created: C:\Users\user\Desktop\ZZZZZZZ (copy) entropy: 7.99703768169Jump to dropped file

                  System Summary

                  barindex
                  Source: LB3.exe, type: SAMPLEMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
                  Source: 0.0.LB3.exe.330000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
                  Source: 0.2.LB3.exe.330000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
                  Source: 00000000.00000000.2036214305.0000000000331000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
                  Source: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00340410 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,CreateNamedPipeW,ResumeThread,ConnectNamedPipe,0_2_00340410
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00336C60 NtQueryInformationToken,0_2_00336C60
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00339850 NtClose,0_2_00339850
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033E144 CreateThread,NtClose,0_2_0033E144
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033C1E8 CreateFileW,WriteFile,WriteFile,WriteFile,WriteFile,NtClose,0_2_0033C1E8
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033B5D0 NtQueryInformationToken,0_2_0033B5D0
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033DDD4 SetThreadPriority,ReadFile,WriteFile,WriteFile,NtClose,0_2_0033DDD4
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00337E28 NtQuerySystemInformation,Sleep,0_2_00337E28
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00336654 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW,0_2_00336654
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033B690 NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,0_2_0033B690
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00338F38 RtlAdjustPrivilege,NtSetInformationThread,0_2_00338F38
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033C354 CreateFileW,WriteFile,RegCreateKeyExW,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,SHChangeNotify,NtClose,0_2_0033C354
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033E3B8 SetFileAttributesW,CreateFileW,SetFilePointerEx,ReadFile,NtClose,0_2_0033E3B8
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033DBBC NtTerminateProcess,0_2_0033DBBC
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003397A8 NtQuerySystemInformation,0_2_003397A8
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033B390 NtSetInformationThread,NtClose,0_2_0033B390
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00346F90 CreateThread,CreateThread,CreateThread,CreateThread,NtTerminateThread,CreateThread,CreateThread,0_2_00346F90
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00337E73 NtQuerySystemInformation,Sleep,0_2_00337E73
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00337E5A NtQuerySystemInformation,Sleep,0_2_00337E5A
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00338F36 RtlAdjustPrivilege,NtSetInformationThread,0_2_00338F36
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003397FA NtQuerySystemInformation,0_2_003397FA
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003397E1 NtQuerySystemInformation,0_2_003397E1
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_00402760 CreateFileW,ReadFile,NtClose,10_2_00402760
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_0040286C NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,10_2_0040286C
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_00402F18 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW,10_2_00402F18
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_00401DC2 NtProtectVirtualMemory,10_2_00401DC2
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_00401D94 NtSetInformationThread,10_2_00401D94
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_004016B4 NtAllocateVirtualMemory,NtAllocateVirtualMemory,10_2_004016B4
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033A65C: GetVolumeNameForVolumeMountPointW,FindFirstVolumeW,GetVolumePathNamesForVolumeNameW,GetDriveTypeW,CreateFileW,DeviceIoControl,0_2_0033A65C
                  Source: C:\Windows\splwow64.exeFile created: C:\Windows\system32\spool\PRINTERS\00002.SPL
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003320BC0_2_003320BC
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003380880_2_00338088
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00334D130_2_00334D13
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00334D180_2_00334D18
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003352280_2_00335228
                  Source: Joe Sandbox ViewDropped File: C:\ProgramData\D9D5.tmp 917E115CC403E29B4388E0D175CBFAC3E7E40CA1742299FBDB353847DB2DE7C2
                  Source: C:\Users\user\Desktop\LB3.exeProcess token adjusted: Security
                  Source: LB3.exe, 00000000.00000003.2259974337.000000000120F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesvchost.exe.muij% vs LB3.exe
                  Source: LB3.exe, 00000000.00000003.2262582207.0000000001210000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesvchost.exe.muij% vs LB3.exe
                  Source: LB3.exe, 00000000.00000003.2259884758.000000000120C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesvchost.exe.muij% vs LB3.exe
                  Source: LB3.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                  Source: LB3.exe, type: SAMPLEMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
                  Source: 0.0.LB3.exe.330000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
                  Source: 0.2.LB3.exe.330000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
                  Source: 00000000.00000000.2036214305.0000000000331000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
                  Source: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
                  Source: D9D5.tmp.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: classification engineClassification label: mal100.rans.phis.spyw.evad.winEXE@9/1689@0/0
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\d093fD6aI.README.txtJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:384:120:WilError_03
                  Source: C:\ProgramData\D9D5.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\{649F4E29-16CB-DD42-8922-9FFF0592856B}
                  Source: C:\Users\user\Desktop\LB3.exeMutant created: \Sessions\1\BaseNamedObjects\Global\98c4870973008d3dedb754efa0eede6f
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: unknownProcess created: C:\Users\user\Desktop\LB3.exe "C:\Users\user\Desktop\LB3.exe"
                  Source: C:\Users\user\Desktop\LB3.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
                  Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{B1C7A99F-124B-4D04-A522-91304C44F3D0}.xps" 133668342863650000
                  Source: C:\Users\user\Desktop\LB3.exeProcess created: C:\ProgramData\D9D5.tmp "C:\ProgramData\D9D5.tmp"
                  Source: C:\ProgramData\D9D5.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D9D5.tmp >> NUL
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\LB3.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeProcess created: C:\ProgramData\D9D5.tmp "C:\ProgramData\D9D5.tmp"Jump to behavior
                  Source: C:\ProgramData\D9D5.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D9D5.tmp >> NUL
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: wtsapi32.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: rstrtmgr.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: samcli.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: logoncli.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: activeds.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: adsldpc.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: wsock32.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: gpedit.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: dssec.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: dsuiext.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: framedynos.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: dsrole.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: ntdsapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: authz.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: adsldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: mscms.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: coloradapterclient.dllJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\ProgramData\D9D5.tmpSection loaded: apphelp.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: rstrtmgr.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: ncrypt.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: ntasn1.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: windows.storage.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: wldp.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: kernel.appcore.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: uxtheme.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: propsys.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: profapi.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: edputil.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: urlmon.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: iertutil.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: srvcli.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: netutils.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: windows.staterepositoryps.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: sspicli.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: wintypes.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: appresolver.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: bcp47langs.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: slc.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: userenv.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: sppc.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: onecorecommonproxystub.dll
                  Source: C:\ProgramData\D9D5.tmpSection loaded: onecoreuapcommonproxystub.dll
                  Source: C:\Users\user\Desktop\LB3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.iniJump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
                  Source: LB3.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                  Source: LB3.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: LB3.exe, 00000000.00000003.2130435258.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136035753.00000000010E1000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129139784.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2119903214.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136372476.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2130270257.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131457280.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129317008.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2130089902.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2144130407.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2120760500.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129490804.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131900597.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131292768.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131098088.00000000010D6000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.d093fD6aI source: LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2094973937.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2087183487.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092403598.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2091597225.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090592274.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090806714.000000000112A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: LB3.exe, 00000000.00000003.2108854474.0000000001116000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\d093fD6aI.README.txt source: LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2085589273.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2094973937.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2087183487.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092403598.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2091597225.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090592274.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090806714.000000000112A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.d093fD6aI source: LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2094973937.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2087183487.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092403598.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2091597225.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090592274.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2090806714.000000000112A000.00000004.00000020.00020000.00000000.sdmp
                  Source: D9D5.tmp.0.drStatic PE information: real checksum: 0x8fd0 should be: 0x4f26
                  Source: LB3.exeStatic PE information: real checksum: 0x2fa40 should be: 0x2dd26
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033357B push 0000006Ah; retf 0_2_00333654
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033619D pushfd ; iretd 0_2_0033619E
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003335E3 push 0000006Ah; retf 0_2_00333654
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003335E5 push 0000006Ah; retf 0_2_00333654
                  Source: D9D5.tmp.0.drStatic PE information: section name: .text entropy: 7.985216639497568
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\ProgramData\D9D5.tmpJump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\ProgramData\D9D5.tmpJump to dropped file
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Videos\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Searches\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Saved Games\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Recent\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Pictures\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Pictures\Saved Pictures\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Pictures\Camera Roll\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\OneDrive\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Music\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Links\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Favorites\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Favorites\Links\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Downloads\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\ZIPXYXWIOY\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\PALRGUCVEH\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\GIGIYTFFYT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\EWZCVGNOWT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\CZQKSDDMWR\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Documents\BJZFPPWAPT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\ZIPXYXWIOY\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\PALRGUCVEH\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\GRXZDKKVDB\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\GIGIYTFFYT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\EWZCVGNOWT\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Desktop\CZQKSDDMWR\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\Contacts\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Headlights\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\dd432c4a-ba38-4070-9985-ed1b3bea85dc\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\VirtualStore\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_761252224\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_1791500899\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_2640_817343797\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Low\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_995017740\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_778675694\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_736602331\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_649288342\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_339006160\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_27162369\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1988346647\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1959985254\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1807723660\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1693012001\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1635976352\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1619438387\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1485273224\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1421574262\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1318414972\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1289371347\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1234978473\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1191663050\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1090636871\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrocef_low\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\PeerDistRepub\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{99fff775-938d-4e2c-9c06-5d56107a5383}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2737c7bb-35fb-4b44-baf9-033ca587595d}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4e763a36-90d3-4d6c-9949-dd01f7e5d23f}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91a05a-d98f-4429-81a9-272df0335447}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{de0f148a-c476-467a-b7a3-14b0bb463140}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c982025a-def7-4db3-b4ed-6b518d9c59e6}\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\Temp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState\d093fD6aI.README.txtJump to behavior

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Source: C:\ProgramData\D9D5.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D9D5.tmp >> NUL
                  Source: C:\ProgramData\D9D5.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D9D5.tmp >> NUL
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00339198 RegCreateKeyExW,RegEnumKeyW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,OpenEventLogW,ClearEventLogW,RegCreateKeyExW,RegEnumKeyW,OpenEventLogW,ClearEventLogW,0_2_00339198
                  Source: C:\Users\user\Desktop\LB3.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
                  Source: C:\ProgramData\D9D5.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX

                  Malware Analysis System Evasion

                  barindex
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003310D4 0_2_003310D4
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_00401E28 10_2_00401E28
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003310D4 rdtsc 0_2_003310D4
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00335C34 FindFirstFileW,FindClose,FindNextFileW,FindClose,0_2_00335C34
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033A064 FindFirstFileExW,FindClose,0_2_0033A064
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033748C FindFirstFileExW,FindNextFileW,0_2_0033748C
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00337560 FindFirstFileExW,FindClose,0_2_00337560
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033763C FindFirstFileExW,GetFileAttributesW,FindNextFileW,0_2_0033763C
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_0033F264 GetFileAttributesW,SetThreadPriority,FindFirstFileExW,FindNextFileW,FindClose,0_2_0033F264
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_0040227C FindFirstFileExW,10_2_0040227C
                  Source: C:\ProgramData\D9D5.tmpCode function: 10_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,10_2_0040152C
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00337438 GetLogicalDriveStringsW,GetDriveTypeW,0_2_00337438
                  Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Jump to behavior
                  Source: LB3.exe, 00000000.00000003.2083756732.00000000012BF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 10/04/2023 15:50:56.369OFFICECL (0xe04)0x250Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 551, "Time": "2023-10-04T13:50:46Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "LFm9Ltrk4S277wbAA8Obddw+Rm4=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
                  Source: LB3.exe, 00000000.00000003.2297647168.0000000001208000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Users\user\Desktop\LB3.exeProcess information queried: ProcessInformation

                  Anti Debugging

                  barindex
                  Source: C:\ProgramData\D9D5.tmpThread information set: HideFromDebugger
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003310D4 rdtsc 0_2_003310D4
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00335A30 LdrLoadDll,0_2_00335A30
                  Source: C:\Users\user\Desktop\LB3.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Desktop\LB3.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Desktop\LB3.exeProcess token adjusted: Debug

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Source: C:\Users\user\Desktop\LB3.exeMemory written: C:\ProgramData\D9D5.tmp base: 401000
                  Source: C:\Users\user\Desktop\LB3.exeProcess created: C:\ProgramData\D9D5.tmp "C:\ProgramData\D9D5.tmp"Jump to behavior
                  Source: C:\ProgramData\D9D5.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D9D5.tmp >> NUL
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_003310D4 cpuid 0_2_003310D4
                  Source: C:\Users\user\Desktop\LB3.exeCode function: EntryPoint,ExitProcess,GetFileAttributesW,GetLastError,FreeLibrary,GetCommandLineA,GetModuleHandleA,GetLocaleInfoW,GetCommandLineW,GetProcAddress,GetLastError,GetLastError,FreeLibrary,CreateDialogParamW,LoadImageW,CreateWindowExW,LoadImageW,LoadMenuW,DefWindowProcW,LoadMenuW,IsDlgButtonChecked,GetDlgItem,LoadImageW,CreateDIBitmap,GetDeviceCaps,SelectObject,CreateFontW,GetPixel,GetDeviceCaps,SetPixel,BitBlt,SelectPalette,GetTextColor,GetTextColor,CreateFontW,CreateSolidBrush,0_2_0034946F
                  Source: C:\ProgramData\D9D5.tmpCode function: EntryPoint,ExitProcess,GetModuleHandleW,GetCommandLineW,GetModuleHandleA,GetCommandLineW,GetLocaleInfoW,GetLastError,FreeLibrary,FreeLibrary,GetProcAddress,CreateWindowExW,DefWindowProcW,GetWindowTextW,LoadMenuW,LoadMenuW,DefWindowProcW,SetTextColor,GetTextCharset,TextOutW,SetTextColor,GetTextColor,CreateFontW,GetTextColor,CreateDIBitmap,SelectObject,GetTextColor,CreateFontW,10_2_00403983
                  Source: C:\Users\user\Desktop\LB3.exeCode function: 0_2_00340410 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,CreateNamedPipeW,ResumeThread,ConnectNamedPipe,0_2_00340410

                  Lowering of HIPS / PFW / Operating System Security Settings

                  barindex
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\d093fD6aI.README.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\d093fD6aI.README.txtJump to behavior

                  Stealing of Sensitive Information

                  barindex
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.dbJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\eventsJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.jsJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.iniJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143dbJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4Jump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-updateJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.dbJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.jsonJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.d093fD6aIJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txtJump to behavior
                  Source: C:\Users\user\Desktop\LB3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmJump to behavior
                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
                  DLL Side-Loading
                  112
                  Process Injection
                  11
                  Masquerading
                  1
                  OS Credential Dumping
                  311
                  Security Software Discovery
                  Remote Services1
                  Archive Collected Data
                  1
                  Encrypted Channel
                  Exfiltration Over Other Network Medium1
                  Data Encrypted for Impact
                  CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                  DLL Side-Loading
                  11
                  Virtualization/Sandbox Evasion
                  LSASS Memory1
                  Process Discovery
                  Remote Desktop Protocol1
                  Browser Session Hijacking
                  1
                  Proxy
                  Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)112
                  Process Injection
                  Security Account Manager11
                  Virtualization/Sandbox Evasion
                  SMB/Windows Admin Shares1
                  Data from Local System
                  SteganographyAutomated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
                  Obfuscated Files or Information
                  NTDS5
                  File and Directory Discovery
                  Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                  Software Packing
                  LSA Secrets122
                  System Information Discovery
                  SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                  Indicator Removal
                  Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  DLL Side-Loading
                  DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                  File Deletion
                  Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 signatures2 2 Behavior Graph ID: 1484904 Sample: LB3.exe Startdate: 30/07/2024 Architecture: WINDOWS Score: 100 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for URL or domain 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 6 other signatures 2->46 8 LB3.exe 37 1002 2->8         started        12 ONENOTE.EXE 2->12         started        process3 file4 24 C:\Users\user\...\QCOILOQIKC.mp3.d093fD6aI, 370 8->24 dropped 26 daa176337b9e448d9a...4da5f77_1.d093fD6aI, DOS 8->26 dropped 28 C:\Users\user\AppData\...\store.jfm.d093fD6aI, COM 8->28 dropped 30 98 other malicious files 8->30 dropped 48 Found potential ransomware demand text 8->48 50 Found Tor onion address 8->50 52 Contains functionality to detect hardware virtualization (CPUID execution measurement) 8->52 54 6 other signatures 8->54 14 D9D5.tmp 8->14         started        18 splwow64.exe 8->18         started        signatures5 process6 file7 32 C:\Users\user\Desktop\ZZZZZZZ (copy), PGP 14->32 dropped 34 C:\Users\user\Desktop\YYYYYYY (copy), PGP 14->34 dropped 36 C:\Users\user\Desktop\XXXXXXX (copy), PGP 14->36 dropped 38 24 other malicious files 14->38 dropped 56 Antivirus detection for dropped file 14->56 58 Multi AV Scanner detection for dropped file 14->58 60 Machine Learning detection for dropped file 14->60 62 4 other signatures 14->62 20 cmd.exe 14->20         started        signatures8 process9 process10 22 conhost.exe 20->22         started       

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand
                  SourceDetectionScannerLabelLink
                  LB3.exe100%AviraBDS/ZeroAccess.Gen7
                  LB3.exe100%Joe Sandbox ML
                  SourceDetectionScannerLabelLink
                  C:\ProgramData\D9D5.tmp100%AviraTR/Crypt.ZPACK.Gen
                  C:\ProgramData\D9D5.tmp100%Joe Sandbox ML
                  C:\ProgramData\D9D5.tmp92%ReversingLabsWin32.Trojan.Malgent
                  No Antivirus matches
                  No Antivirus matches
                  SourceDetectionScannerLabelLink
                  https://www.ebay.co.uk/0%URL Reputationsafe
                  https://login.windows.net0%URL Reputationsafe
                  https://www.amazon.com/0%URL Reputationsafe
                  https://www.ctrip.com/0%URL Reputationsafe
                  https://twitter.com/0%URL Reputationsafe
                  https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br0%URL Reputationsafe
                  https://www.youtube.com/0%URL Reputationsafe
                  https://support.mozilla.org/products/firefox0%URL Reputationsafe
                  https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg0%URL Reputationsafe
                  https://bugzilla.mo0%URL Reputationsafe
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf0%Avira URL Cloudsafe
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0%Avira URL Cloudsafe
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onioni0%Avira URL Cloudsafe
                  https://www.moonpay.co0%Avira URL Cloudsafe
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion100%Avira URL Cloudmalware
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionc0%Avira URL Cloudsafe
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionic0%Avira URL Cloudsafe
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onioned0%Avira URL Cloudsafe
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0%Avira URL Cloudsafe
                  http://lockbitapt.uz0%Avira URL Cloudsafe
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionL0%Avira URL Cloudsafe
                  http://lockbitsupp.uz100%Avira URL Cloudmalware
                  https://www.moonpay.com/buy.0%Avira URL Cloudsafe
                  http://lockbitsupp.uzFFFFFFFFFFFFFFFFFFFFF0%Avira URL Cloudsafe
                  https://tox.chat/download.html.0%Avira URL Cloudsafe
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion0%Avira URL Cloudsafe
                  https://www.google.com/complete/0%Avira URL Cloudsafe
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion90%Avira URL Cloudsafe
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionlS0%Avira URL Cloudsafe
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion70%Avira URL Cloudsafe
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionu0%Avira URL Cloudsafe
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionug0%Avira URL Cloudsafe
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionZ0%Avira URL Cloudsafe
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionn0%Avira URL Cloudsafe
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0%Avira URL Cloudsafe
                  https://coinatmradar.com.0%Avira URL Cloudsafe
                  https://www.google.com/0%Avira URL Cloudsafe
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion100%Avira URL Cloudmalware
                  https://www.baidu.com/0%Avira URL Cloudsafe
                  No contacted domains info
                  NameSourceMaliciousAntivirus DetectionReputation
                  https://www.ebay.co.uk/LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  unknown
                  https://login.windows.netApp1722360706993325100_1BCA18EB-AE8C-4135-9A5E-1F919E09D643.log.9.drfalse
                  • URL Reputation: safe
                  unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onioniLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionfLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFSPL93F1.tmp.0.drtrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: malware
                  unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onioncLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  https://www.moonpay.coLB3.exe, 00000000.00000003.2130435258.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136035753.00000000010E1000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129139784.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2119903214.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136372476.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2130270257.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131457280.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2046379671.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2059958593.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129317008.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2130089902.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2144130407.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2120760500.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2129490804.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131900597.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131292768.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131098088.00000000010D6000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionedLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  https://www.amazon.com/LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  unknown
                  https://www.ctrip.com/LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionicLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFSPL93F1.tmp.0.drtrue
                  • Avira URL Cloud: safe
                  unknown
                  https://twitter.com/LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  unknown
                  https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brLB3.exe, 00000000.00000003.2058530230.000000000119F000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  unknown
                  https://www.youtube.com/LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  unknown
                  https://support.mozilla.org/products/firefoxLB3.exe, 00000000.00000003.2058530230.000000000119F000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  unknown
                  http://lockbitapt.uzLB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmp, SPL93F1.tmp.0.drfalse
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionLLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupp.uzLB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: malware
                  unknown
                  https://tox.chat/download.html.LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2097368882.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2085589273.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2047950020.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126925110.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2134232080.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2097688935.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2077273451.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2135881398.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076696808.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124531922.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131744862.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126388021.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2123819055.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2049589005.00000000010F5000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  https://www.moonpay.com/buy.LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2085589273.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2047950020.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126925110.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2134232080.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2077273451.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2135881398.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076696808.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124531922.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131744862.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126388021.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2123819055.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2049589005.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136330514.0000000001213000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpgLB3.exe, 00000000.00000003.2250699741.0000000001261000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  unknown
                  https://bugzilla.moLB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  unknown
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  https://www.google.com/complete/LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion9LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupp.uzFFFFFFFFFFFFFFFFFFFFFSPL93F1.tmp.0.drfalse
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionlSLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion7LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionuLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionZLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionugLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  https://www.google.com/LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionLB3.exe, 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: malware
                  unknown
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFSPL93F1.tmp.0.drtrue
                  • Avira URL Cloud: safe
                  unknown
                  https://coinatmradar.com.LB3.exe, 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2093702194.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2085589273.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2092152757.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2047950020.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126925110.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2134232080.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2077273451.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2135881398.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2076696808.000000000112A000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2124531922.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2131744862.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2126388021.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2123819055.000000000120F000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2049589005.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2136330514.0000000001213000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  unknown
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionlLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                    unknown
                    http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionnLB3.exe, 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmptrue
                    • Avira URL Cloud: safe
                    unknown
                    https://www.baidu.com/LB3.exe, 00000000.00000003.2061999142.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061696780.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2061230930.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060994771.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, LB3.exe, 00000000.00000003.2060174363.00000000012E6000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    unknown
                    No contacted IP infos
                    Joe Sandbox version:40.0.0 Tourmaline
                    Analysis ID:1484904
                    Start date and time:2024-07-30 19:30:07 +02:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 7m 18s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:18
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:LB3.exe
                    Detection:MAL
                    Classification:mal100.rans.phis.spyw.evad.winEXE@9/1689@0/0
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 100%
                    • Number of executed functions: 80
                    • Number of non-executed functions: 6
                    Cookbook Comments:
                    • Found application associated with file extension: .exe
                    • Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, printfilterpipelinesvc.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                    • Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.113.194.132, 52.109.76.243, 20.190.159.0, 40.126.31.71, 20.190.159.75, 20.190.159.64, 20.190.159.68, 20.190.159.2, 20.190.159.23, 20.190.159.4, 184.28.90.27, 51.105.71.137
                    • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, weu-azsc-config.officeapps.live.com, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, neu-azsc-000.roaming.officeapps.live.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, onedscolprduks03.uksouth.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, ecs.office.trafficmanager.net, europe.con
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • Report size getting too big, too many NtCreateFile calls found.
                    • Report size getting too big, too many NtCreateKey calls found.
                    • Report size getting too big, too many NtDeviceIoControlFile calls found.
                    • Report size getting too big, too many NtEnumerateKey calls found.
                    • Report size getting too big, too many NtOpenFile calls found.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                    • Report size getting too big, too many NtReadFile calls found.
                    • Report size getting too big, too many NtSetInformationFile calls found.
                    • Report size getting too big, too many NtWriteFile calls found.
                    • VT rate limit hit for: LB3.exe
                    TimeTypeDescription
                    13:31:25API Interceptor155x Sleep call for process: splwow64.exe modified
                    No context
                    No context
                    No context
                    No context
                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    C:\ProgramData\D9D5.tmpLBB.exeGet hashmaliciousLockBit ransomwareBrowse
                      ggjLV4w8Ya.exeGet hashmaliciousLockBit ransomwareBrowse
                        yEB1xvr2rZ.exeGet hashmaliciousLockBit ransomwareBrowse
                          71p2xmx6rP.exeGet hashmaliciousLockBit ransomwareBrowse
                            98ST13Qdiy.exeGet hashmaliciousLockBit ransomwareBrowse
                              c8JakemodH.exeGet hashmaliciousLockBit ransomwareBrowse
                                Document.doc.scr.exeGet hashmaliciousLockBit ransomware, TrojanRansomBrowse
                                  Rcqcps3y45.exeGet hashmaliciousLockBit ransomwareBrowse
                                    LBB.exeGet hashmaliciousLockBit ransomwareBrowse
                                      lockbit_unpacked.exeGet hashmaliciousLockBit ransomwareBrowse
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Reputation:low
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Reputation:low
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Reputation:low
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Reputation:low
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Reputation:low
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Reputation:low
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Reputation:low
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.493747507344461
                                        Encrypted:false
                                        SSDEEP:3:VmvjZCRDisaRXuFeklRZ07HEnFgBPYExH93vn:V7Jis2XuFlRZIEFgBVH5v
                                        MD5:B321E335C0C307AC34C7F583EBCA6BDA
                                        SHA1:1D36770840A4F9B4490AA03760E7F8CE95BDC5B5
                                        SHA-256:F5CAE83EAAFFD5CEE090C4319011B9931B845C12C72C37DDC3D6BB0907B9841F
                                        SHA-512:9BE14E94BB39F7AF01DD5BF23ABDF71A9D53E02ED3DB7D6F233C40567C58B82AA440A3932186E1CF1B4B5B031A5D1849325260B874A9B178C93DFA0823172F0B
                                        Malicious:false
                                        Preview:.....ao....Z3...e.\{#.m..~v=...V..|B...[.....?K...|..d.`p!.F..f...1G.R..fk..sD8N$U.!...[*8?......`B..J...ldD9{....<+.YF...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.4586364607322055
                                        Encrypted:false
                                        SSDEEP:3:LbKZeBuh0rPsbYZuFX94H6856SZuSRn:LbKiuho2YZuMHv6SQin
                                        MD5:5848F03F055205C72221A1345C32A2D3
                                        SHA1:BB5DB8722482F83AF9E5A7869F6DF5585D9390FE
                                        SHA-256:30EF83B753E67AF04CE00547E0C02154B1AE24021BE8F992B37E606AE05A3F1A
                                        SHA-512:D7CBFAB2B964AB68C6CFA4E708E7A23753A6FFF07306CE6A527307A8F3C4CFB3297B9141008B70A5FA836B7357DCBF774E40FCE362FD8FE43C58F0844FB5828D
                                        Malicious:false
                                        Preview:.Q.....+...1|..f[.".X5....A....4..........9.fI:9o>.=.z."..a.Dz...<K=!...c3....2K.l.7K.ia.<..]..S.v.*..e.pX..c.w<...=aw.*N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.716653612012389
                                        Encrypted:false
                                        SSDEEP:3:6A2Hlh1p2hffn9d68REE4/QZWZDehWU73wvmlaACRpyG:OPKPvHEj/r9e0U73wvAaACRpyG
                                        MD5:77DF18341443F8A5A2D9B80220707D50
                                        SHA1:D184F9F7962036166C754CBEA592CFD7F0F2451B
                                        SHA-256:6D29EC20C30005AB9349D2EFB46BA2CA497385FB71BB1B321C3EF0809FE114C9
                                        SHA-512:ABABC415E79CABF7717980146593B372F1F7EDD541CB6BD4D9ACDF84F2E02126812A88DF991FF450F18B4361602020D33EFADDE68285830029C0CEB8C9910370
                                        Malicious:false
                                        Preview:f..:yZ>.g.0...e.`.?...D..:.....).. MOb...8.<_!.G..5...Yv.x...!.oAEv<.&zS}]n....\.^.jI.Z..3U.}D..4 .M....g|i$..2.Ud....Hu;$."..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):129
                                        Entropy (8bit):6.59642279802536
                                        Encrypted:false
                                        SSDEEP:3:AVxaM7rhKWj01aWz5UijMvci1k0NN1X6lmw1pj0FwJe2:AVxB7r05xq1kKKj1t0F8e2
                                        MD5:775468F0AC0E4D367BC74D69EA26AB2F
                                        SHA1:486DAD5EF1F0E5DF3B6D9D720F71097804AD86FE
                                        SHA-256:53A08C8DD2924993C83767A0A732AD0651786FCA840568B736C122A644ECB29E
                                        SHA-512:2B7CDFF029D246AD257FAFEB353733E01A0C6FF96ED4FD0D620463CAB4C6750AFDFA4375067E7A761095757BC112A9CCD2B9AA42BD1E61E65F9ABAAAC6129073
                                        Malicious:false
                                        Preview:u0sw..D.\.;...D...R.<.wc.+8<.Q.-....M.Mv....5.Y..E.wt..i(X$OG...a....Kp..l.2./.........K1...}3.....<..`S.ZE.c... ..;..@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):14336
                                        Entropy (8bit):7.4998500975364095
                                        Encrypted:false
                                        SSDEEP:384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
                                        MD5:294E9F64CB1642DD89229FFF0592856B
                                        SHA1:97B148C27F3DA29BA7B18D6AEE8A0DB9102F47C9
                                        SHA-256:917E115CC403E29B4388E0D175CBFAC3E7E40CA1742299FBDB353847DB2DE7C2
                                        SHA-512:B87D531890BF1577B9B4AF41DDDB2CDBBFA164CF197BD5987DF3A3075983645A3ACBA443E289B7BFD338422978A104F55298FBFE346872DE0895BDE44ADC89CF
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: Avira, Detection: 100%
                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                        • Antivirus: ReversingLabs, Detection: 92%
                                        Joe Sandbox View:
                                        • Filename: LBB.exe, Detection: malicious, Browse
                                        • Filename: ggjLV4w8Ya.exe, Detection: malicious, Browse
                                        • Filename: yEB1xvr2rZ.exe, Detection: malicious, Browse
                                        • Filename: 71p2xmx6rP.exe, Detection: malicious, Browse
                                        • Filename: 98ST13Qdiy.exe, Detection: malicious, Browse
                                        • Filename: c8JakemodH.exe, Detection: malicious, Browse
                                        • Filename: Document.doc.scr.exe, Detection: malicious, Browse
                                        • Filename: Rcqcps3y45.exe, Detection: malicious, Browse
                                        • Filename: LBB.exe, Detection: malicious, Browse
                                        • Filename: lockbit_unpacked.exe, Detection: malicious, Browse
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....YPb.................,...........9.......@....@..........................p.......................@......................A..P....`...............................@......................`@.......................@..`............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...`....P.......4..............@....rsrc........`.......6..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:PC bitmap, Windows 3.x format, 1280 x 1024 x 16, image size 2621440, cbSize 2621494, bits offset 54
                                        Category:dropped
                                        Size (bytes):2621494
                                        Entropy (8bit):0.20293771672322952
                                        Encrypted:false
                                        SSDEEP:12:GKm71jTv37T1BNrdVRd3fF3bdJf7vhpnzBxD1fJ/tBfJvTLtFFdF9tlFNtnvDdFh:2
                                        MD5:625EF8BA6B9DD04718589D71F1EFCCCF
                                        SHA1:6FBA89ABB5E78320D0C0F5B08FB30AF8185F06AF
                                        SHA-256:F7A0E503C7FB6C834FB2D4A3660B091C4107915E8A83A055541892A1085429C1
                                        SHA-512:36986B03CA7F07EEA6B2F06ACC54C9D1C5A0092E2216D931393527864625004AC034DF19A17A4F51035D208B68D1F9F03A94F1EEC7AE200DDFAC5ED5F7247F6D
                                        Malicious:true
                                        Preview:BM6.(.....6...(.....................(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                        Category:dropped
                                        Size (bytes):15086
                                        Entropy (8bit):4.262047636092361
                                        Encrypted:false
                                        SSDEEP:192:jpBaAlHSa2vU9G/8MMBD7O1lXFMB8VMJP7:jpjmkMYD7IFMRx7
                                        MD5:88D9337C4C9CFE2D9AFF8A2C718EC76B
                                        SHA1:CE9F87183A1148816A1F777BA60A08EF5CA0D203
                                        SHA-256:95E059EF72686460884B9AEA5C292C22917F75D56FE737D43BE440F82034F438
                                        SHA-512:ABAFEA8CA4E85F47BEFB5AA3EFEE9EEE699EA87786FAFF39EE712AE498438D19A06BB31289643B620CB8203555EA4E2B546EF2F10D3F0087733BC0CEACCBEAFD
                                        Malicious:false
                                        Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):239
                                        Entropy (8bit):7.176772037997665
                                        Encrypted:false
                                        SSDEEP:6:DEq/RbfqEWAWS0hT7HbEyihje952lItGIUCKcpqKsM:3j5WA+DbVX220IAuTsM
                                        MD5:53167245C6F36D939FF0C63CB5F39BDC
                                        SHA1:73EFE922E58F67580EF82F5A69D499A6DC23170F
                                        SHA-256:943ED3D30D3BA145E4BAD549D20E336943AF1BAB7F767537A327EA20CE701C2B
                                        SHA-512:983634D14D0638BEC9BCC26EA3D5F1C1B811FD788B572403C48ECAD5C2D349855613C25F61FAFE4CA96C2DDC942AFF5E51DCD31F24C7EB500C857916779D4B57
                                        Malicious:false
                                        Preview:.Q.....t.u.G.v8.....5sPEH..C},.>.3x...>.~......../u.9.c......3....9.z.BS..;9.............uc^.&.U..P.r..a.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):248
                                        Entropy (8bit):7.181664152971788
                                        Encrypted:false
                                        SSDEEP:6:PRoMQbHrIZJp4W9Thje952lItGIUCKcpqKsM:JoMQjrcp4WKX220IAuTsM
                                        MD5:20E3D58C72E2D807F9BC573CFF7A25A8
                                        SHA1:F0B72E987106122B0A579D960C1C7A30218371B3
                                        SHA-256:AC44AD0465936CE3091EC486413A8F71311160920E9FA0F03E3A54CDE9D1B024
                                        SHA-512:0610927E8937957D6C92D22BB8CE903F3964A5BF40E6DBEA3EC41656A308312BA981E90C108B87A079B1E3F06C0C131E385BC20806FE834529694EAE59732305
                                        Malicious:false
                                        Preview:.P9.A..vH.X..|.u.G.XO.L...NsPJX.../,.>.0{...=.~..SrA...Ew.?..-...H..r^...H.KsG.o.{l.d..].R&...&t..`..!.'.5.QU..b.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):45286
                                        Entropy (8bit):7.9959468549154105
                                        Encrypted:true
                                        SSDEEP:768:YH4c82JOn9U6gY4uyabFNB45wYumXF6vzfx94xhzj8b73UyvnWgXqvlV:YTs9qYpbFN9YJIbfx94xJ8b73UJgXW/
                                        MD5:39AAB525FAAD92B26721338BA3557234
                                        SHA1:F0A376F220522B94830E7BCB9D03113684C6CFFD
                                        SHA-256:56066C3DE77F878F605A0CE11327BA7564C29860240DB976B1229A68E7D40AED
                                        SHA-512:12F68E499F284F12754E65FF843B7814A12C631202B1D1B5AA86490FD2D81272A8F1FD2393D36D585CAD59E48FE3B5AB23624F0B6023E4B65859817DB48D62C2
                                        Malicious:false
                                        Preview:"..<1.}*R)...dK.>..1I...s.R..^..-~. e.V.~F_......wE..w.^.E.;.b.C?H..E..=.O...../.-..w..b#...)@^1v.Q"...h.h..l...UO...:..8.....n...6c........-YV.R.q*.z.yPI..LMR..<E....P-v..m....O...]k.m...z..........F.....:...........U...T.t.7....A.8.Ht.......1f......0....<n...b=.YU.......N.6....o.H.m...:.....5A.aT..6W.%...!.]....7...<.....Y.!{.K..F.v.F....e:G.v...{1.I...[..0.......S....8..0l2...:..3u.....Q_=..../.{,q...Db.I.........5,JY..?.."p.^.Ux.(.w...P...4.e..:.Et-. ..(...z......xUY....E...]k...4....]}...!.*....LU.Ux}C.7U......nPC...;.`..!........A.].3...f.. *tqW...hv;..[.....9....7.."..._r............v3..>......J...........p......_..I...jD-._N...I%.m.#.u...@......-y5.L_... ..3J....@;.....IU......x...v..6.~^....L..~..Okx..;F......Y'.f.p`.kU2.w.Y....hP.9...........G'.....u...b..Ts..z..+....S.A.C.l<...1v6...b.&g..W_.X.DW..rI.k.z..a..=...JtFaV.....f.c.................."K......T5.y..].;g.6.j........U..rj....U.C.....\......j8H=..&.F{..a...W.T..#9Z
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):270566
                                        Entropy (8bit):7.99936298458169
                                        Encrypted:true
                                        SSDEEP:6144:aCE92c5gh5xQN5JTP2yBJAYbQpEf8/CkWTNO34Up:Q92hHpYbJf8Ckg9Up
                                        MD5:193A69D4A77D7E084FEB54352B38F388
                                        SHA1:547E46B1C3007C5FA9C721500FE2CF37F056045C
                                        SHA-256:92C4843D6813F3A205C314D4F3F17B83E69A9B027E19DA2D92214B82D054D10C
                                        SHA-512:DC63DE9020E21D342E5FAB3163114652EAD015D434134F50D86C89CFFFA3542E572365C7772D17DE6B56F0B3C327BD1664AA3628770F6DEA546B56940F618BD8
                                        Malicious:false
                                        Preview:....+.W%.e....f...f.|.O6.p.g..7...AT.5...............9.]u....CF,.PQm.>lAh...j.....MB..s.m#wp..h...2...."rd.*..^...mZ. .{..V...4..-Z.3.*.v..`.Bj.....y...>..3.;.wr.<........CP...Y(..4.QSh3:..0.j..&".N+.g..A..c.6x.W.M.z..K...A.uv/f...[.!H..7.pU...OnQQg.#.N.mj.4..*....^FwE...u.......nw....Bf.$.....o..A.O`'O9#.ny(.n<H.._)W.....)p..v\.GgC.w5.....O......yM6............oi.<..)5........P%....y..k...:..6..[.S..pBa..+..=.....VwX#...p.}...............\..?..1..xG.....%q.u.7..X......V......@.".~.c3*....2.....7.'t.D...#."DX..$s..W.....g..L...&.....H......>3+.%...'k..{JU..8...b..)..s.~.X..#......<.......... .6...W..f....p>.hs..X....BR.....y.@m*.f.....F:..P.g.....,...m..c. .".].8...IXVE.B..WL.....1.4cpR...C.>,?...Iy..F..e.p8d.y.m....;P.....]......P../..0..i.b[.N...~=U.#2.Y..p..0]w......D..P..............eS\.8..A.F..._d.1.eZ.wYV6....)..d.>,qB....N.....?.;...H .].[..Y<.Y......NQ....!Q.2.>..[j0.aX...iB.\_...z.SNd.?m*...V....!~.'.......j.l<Ib`;..d0v.n`..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:SYMMETRY i386 executable (invalid @ 0)
                                        Category:dropped
                                        Size (bytes):1056998
                                        Entropy (8bit):4.951312377039089
                                        Encrypted:false
                                        SSDEEP:12288:lwYy5c/Yz9JfMhv/uz6DJkaUwTx1KrDZ+Ol5CcKs:lw1+CnfMhvL1kjwTbK5J/vx
                                        MD5:2A8AFC366BEC5832D2D5F2437D057EAE
                                        SHA1:2CAE79177156449F9A4300D110B2699CED24966D
                                        SHA-256:129204817FCD3ABD173EE869584C9B07B44A131D3022971ED38AC9E04611928A
                                        SHA-512:7B82BC5771B20223AA2B8F46F1D5022B66238B31FCA8E23952846037357B918680F809BE646CED483F2B1B72500B7D31FB322421BE57AB3F0CBD6ED53D583D09
                                        Malicious:true
                                        Preview:.2...q...F..Mv.?..E.^..4.Y7.t...y........qL.."..c..)..".[.A...cR.....%/...9.&.s..0_X8.w.m.....'.L|.e(p..|.t....)..H..R]xc...q.I=`.WN....!J....U.'$....a.l....4.o`.6.u.....s..Q.<....h24..!Zmp.HI.._..|..{i88.3.P!...+.&^.O3JY.?'$.. ......tg{.r.~......h.......=B.|..F......._.BJ;a05...@..g....}...24...%D.t..~kU....2.6B.Y.a..>g..<..y..2y...|.$..-C..|..j..R.r.....,gp......o.lX..K..9.4.i...4..c......a..ev:...Y.dx.G)+LD...6....6~.G..cU....O|.......z.%..:R.*...%".sf)...].0u...iD....D.........B...4..~..4....8...G...H|.(..a.v_.!EW...qv...fg......K.*....%L........Y.G...8.2..T.Y...I..1.....u^......5.:X...v.K._x.N...XR..'..b.9$=...|........$P.......:.[!...(D/u.....p..._v?pg[..#.8._.....&.z};.#T...|..)..}Y.O.p...$.XI...A~...S..a.Y..W.h2r....-.....d.h...h.<G...3..m....I.u^....f(.Yu..2.ad(..{B2....'...1.....i&..F..4VJc.S...d...*.Y...<.S.....q......=]Rs.}.Og=D..D?3..d......H-]F1....."f.."...q..o..e:.x...F1....6{V...x.*x.....JY..L...4........h.;..1(4.;.~....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4202726
                                        Entropy (8bit):1.5352228190667596
                                        Encrypted:false
                                        SSDEEP:12288:QVTd+1Z13CME5QP1oSBondLUqpiRwPhLoZxx+:QC1z31EQPuyondLU4iec+
                                        MD5:5006DADBB1D91C63353AB6320D440E3D
                                        SHA1:EBA7F1D6C0B6EAA276DAA200849A847CE97C92BA
                                        SHA-256:B369480F20AD3D22A35A0762CBE19E9B9D48C25276B7ADC7C999F5F8FF971708
                                        SHA-512:6DCFE8C5DC70DBAA56BC5A016CE2E3032A51B7552BB4F9F9FBA3008C1569BA5EE2E3FAA03906E7DCC1EA5325953D602E1DAD0504BD2927ED3FA208C390090B36
                                        Malicious:false
                                        Preview:..,.....l...O...@.pu....i...Iv.6~.g.8.0Z$w.....j.G.N.....)6...N.E.......=.Z.i..N5.x...A.~}.......9.;.W5x.....Dq.<1.l...[)G...u...l..C&.C.wz..dr`...).....!..3...:.I.Hu...,......wF..E.G.....-...t..B.%........"...u..yj....In....> ...S.....a.ZInN..z.4.L..T>V.J'. ..+..>.@..../_X.G.8nx+..0.s)x..8$L(......h .......,.B..?.u.b...qg=..$....}../..\.........@.b.+....9p..f...o^.N......+......YRA;PQFwix..d...,W.......Zx~qe.<.5.(..P\.8..b..f.X.4..z..v.J..|,.....?....@....Y...{#.Dq.}..8......._..u...[..k....t/..g....l.S.a_.cx....J....kIWG..s."6......PR.....O.tE.>i|..HT..+.X..mt........K..-..8....9$.1...]f.w.|..D..........t......z.....1......iE.GO...'..%.7...Vb...V...y..M..W6?9..v...&....W......c.'.....;..P.l...K4.HuJ..l.R...w+...B...>q.+.=.>`*..ef,...B.;..w....z..;.HF....[.]..|.,.:.m..........\'...VJa.i...*.C`%.G..<.#..*...d(.p.b..~.7..<.`kT..SMiS...5x.}.N.N<]..$..4......;...4 ....8.k.9...3..V. 9...}..f...J.;...X...(.@.T..`M..H......G.....Y.T\'Xt%
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):524885
                                        Entropy (8bit):7.9996055491139675
                                        Encrypted:true
                                        SSDEEP:12288:43c7STVtot+KkEZZ5XvoU6gv5bEbPRvYerouIOD3x0JXhCG/3N/iuD:ccGBtosKki5XwUNBemkIOtwh1/3NzD
                                        MD5:7653C9C9AB75931C5CF415A3567F7D5C
                                        SHA1:7D9021F25C548A4D664A7868F7FB65C02BFE7EC7
                                        SHA-256:4BF7261FC0413FD88412A3375EBB0286308D5F166CB82292D95FBBED246C42B0
                                        SHA-512:D94738FF4CD1BFF8C491F73F1681E1C16A0772B01049E1AE81C01FD8CC8402930FB75F1A168DAEB3F870A7235FFBDF4C1FBB0512AAE272FF86315357CABDCE3F
                                        Malicious:false
                                        Preview:E.C.......$?..k..qA.s..(....4..{.j.(#...{..e.....<.G....t..a.$..J..:04.P.h...r..um[....'........5.n.ARja.pj.b.!K.).W.......L..w\.x..i.Vo.....I..^....;.<sDP....`.'O...b[..n6.gjj.?px...v....=...p../.3........%p.Z.F=..m.q...-.......=_.......o.....5..<...}_.@r..P8QNeH......Y......... ...\V|gw..y...+.!.GPo..........:.{.....^?...D.h.....y........."C..D.6...I......7:"...|..1...W...1..?.q..?....}........(d....e..@4+..-..s5... [.X..($........^...iDM......M.K.f..T..%.c...iC......+........u.t.....e..N..t....#..Q.b....2n).aF.uk.00.C...p-.b;...h..O.5.-...g..u.9..=....Ao..kYL..c.="E....p9.Fv3..g_..~..%..........k{G.,..b.=...9..U.Q.4......o ..C...8..15..M.O|I<....k..g.z.e..B.C.c.;,..5..F.GU..0.....>.D.}..RW.a.*.JC-..>..1..8{...h.C.<Iu/.~......%E3.r%.3.....K(....d....A...%qP+.!...zZ.x.@.0.m.....{.E.&.[..B.ns.e.QHL.6*../.......q..._21.s\...y%....t.....9..G.$.N.E.5Z..9...a.x.....q+..)>...........$u.l...+%'......^.$.*....4Y.cT.....!.L=.w;..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):458
                                        Entropy (8bit):7.527803135468842
                                        Encrypted:false
                                        SSDEEP:12:ZGw63PVBtCN072jN1XhPf87CFsLj/t0X220IAuTsM:ZGfNCNfjXdfWFL50X2oT7
                                        MD5:45F5BB740857600234FC634543C88B17
                                        SHA1:9BA50DD68F3677B4D7182CB766AAE4966B2066AE
                                        SHA-256:D1EAA9EC47C1D74F4E57FC6FBCBF4D7CB49AFA0D47D1082593C6A0FFF594C3D6
                                        SHA-512:922A8A9D8277939F09801F9DFA93A51DF5B535F2E4BBE10B63357232987ED97CA11A98F5495836DE25FE0FB8AE77BBBCB68C34C90165796B4C29CCF410FDCBE4
                                        Malicious:false
                                        Preview:...../ ..m..E.Bg........]U>.........8.Fc.o,...^.......5.}....XU..Sz...*.8.ux.|....U..,M..D...`...N!.\...q.4~...p...=..$..[0.....6.....(:.^.&....09.b............h..}.....%.`.....T..z.,.].H.....y.61q.u.G.v~.{.-BXu2.-d.....6...G<.~...O..MQ.h$Yx_ R*.N....mf..9...N.*P%w.q..o:s....<.sy..e5./..B.AQG.5d.3.@(F.|...ws.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):466
                                        Entropy (8bit):7.5665757788389545
                                        Encrypted:false
                                        SSDEEP:6:T7Pb9m2/EbKwfwQVeSvxULFSEFqKjVOr9SN86rU61V8YjBdM/hje952lItGIUCKw:TgwMtrVeSNwxAeRYedMgX220IAuTsM
                                        MD5:19291CFD852B901907167B15E26BAF9F
                                        SHA1:FF8B9086B75627E9553EB00CC37B2E322AC3873A
                                        SHA-256:DF0ED0EC2C616D8954D62728CC4C11C9672AA789CB96FFF1C77419724AE9A803
                                        SHA-512:BCF4E4DA54FC71F47305CDB7653D8DC13EC45D1AF3458F1213734A503D6FD1D083F9F4AFD2DC1FE58E83B34A87B3A045EA1314AD2EA47E3550BCB61E2080B905
                                        Malicious:false
                                        Preview:.=..B...>&T..N.a..20l..2..=.BI........Y.S.'nD..>P..e.....r!y.(D"...ID.U.........n!e-.L/L...y.${.M.. ......7q+....q.UB........a....h.L.....SJ{.................E%v....s.&^.'..+....3.r.../.k.....R......=......u.G.v..Gr..4mh[y.#{..NG.<... .~......NQ.k'Yx\s!t........lq1..nu.h.[`...F4....Bn.R.....t.\e..p.^#..60..b8>+O.p.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):420
                                        Entropy (8bit):7.488688547536603
                                        Encrypted:false
                                        SSDEEP:12:wMcYpogrzfQ5TrqzJesarDlb5NAX220IAuTsM:RTuy4Tq0lb5NAX2oT7
                                        MD5:FD2186C7676ACC2FA0B5C37FD6114BB1
                                        SHA1:2141219B5D9C9839C4F86B21417FA7294ACDDA22
                                        SHA-256:4F93E85BFC84626CB66694987A1F79076CDB941ECA549D2227EED80C82B76284
                                        SHA-512:673C5B6C7C6E61C9E496891FE9955253EB90A5DD9BE7C925EAEFF9A360132D5E2C6E909AB42403CBD594FA46FFE72AF1E63CDDC5B6CDA1F6CC22F02ACC7DD6B3
                                        Malicious:false
                                        Preview:..&..+&.....K.j.E..5..[...*|6.......a..poW...;.W.-.2X.t.gI.e#<.!..%6R.=.co..........q....:..3.G..8j.Gb.N.@..?.EI...MN.x#3NR...H..j0..&(.P.5.~...:.P....z....T0. ].u.G.v|.. ..6tc.L..#hs.<.0b...l.~......NQ.k.<.;.c...5.P..c.....=.:.(.X.y)P..... ..%.3...c.UC...j.3....l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):498
                                        Entropy (8bit):7.566890506577996
                                        Encrypted:false
                                        SSDEEP:12:/eoOkPR4As0rbYp6QY8c4xB8+lKUagX220IAuTsM:26q6QzTagX2oT7
                                        MD5:9B3AFD0936BA522799A622D2AF47492B
                                        SHA1:8E5677B46E02FEFA7066BE02C252E61842FDB311
                                        SHA-256:B447D6120AB8C3F8E5884B1EEE7F2B588D3737435E472E6C148BBC30EDCAC12A
                                        SHA-512:474C2C9A268E77A3367E4429857F345003DE47C0F10ADE3E60C3A44D4E36FE21D31F510FF13AFABA399CE537840F4DA8E350D0B00D56C9950A52E9F6994DF610
                                        Malicious:false
                                        Preview:!OH.\..&....X.~ .O...(.u.....?7&.y.pWN..-.$..+B#.5.v\O...}N...H.gh....]^...>...2.O.[......U.......L.e....u@/.i.#..E..:....lz:..$.......l.Fu.CAV...4f ..O..~....{%NG.w...g.i'..HO.....;.Y.;."REqLW..7......w.g.....k.........?.8......7H..:..u.i.D6L%..Y.Yx...)....).'.P...^.......MQ.k$Y{\ R..5=.eD.r.1..{e.9...... .@.1(.k.....)9~...z.!H.t..dlgi..m...4Y..r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):445
                                        Entropy (8bit):7.6156861551745605
                                        Encrypted:false
                                        SSDEEP:12:5Utt3zUcscBzBSotepDEthA3a8X220IAuTsM:5Uv5sOzBSoaf3a8X2oT7
                                        MD5:BA25193712B6B9793D74E2E1ED3E5C64
                                        SHA1:88E1ED5DA94423E16E6EEA4C7C1B54ABDC4BD85F
                                        SHA-256:E3B445DB6C086BE4E76C9A6D24EB1FE6ACE50896C57D82420024F9468D6E8684
                                        SHA-512:9865F4FDC89E325BD72AAA43F895D46C69C3026E23F8601484D5E5E050F51506DFAA6DDAC0C5396978F513614DBADA08C1B679FC11E5CAB3A0708723522CB1BD
                                        Malicious:false
                                        Preview:y%.M3CF.cb..W.........;.k..i._.(..t.2...K.64..5.,...7!@?..Sx.D.%....4>.pM....{O.;k9ve.!d".v.I.JyB.E/..Qr..N.e.......j.prb.I....;{..ex"Ybq:x....lb........i.....p/r2T....f}Hu.%.F....0..H.g..9c.:.[.u.G.v{.'.~{a.ANz..w...; ou...>.~......MR.k$Zx\ .3..[.........*..sV.`...;f"...Q..[O...>....Xn....P..._...B9Y.q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):442
                                        Entropy (8bit):7.550486666839198
                                        Encrypted:false
                                        SSDEEP:12:6Di0qjWyBZeJB1RngR1Sx5y7Nt0RFlgX220IAuTsM:6DiTlQB1RngAw2RMX2oT7
                                        MD5:CB20352BA9E16EE8E94FBD0756057D44
                                        SHA1:D00ED731880F6F5F996025648BFE568BFB5957D4
                                        SHA-256:D174F083F7FF716029EE61CE3675903710A868FA6FE0BFD81FDF13794E69934A
                                        SHA-512:195ADF382FC76CA8FDA42FE8B7656F82DE64454D3C18B79ED4163AA80C32FE5CA75A511E981AFE491B76EEFB2A5850D60B6FA73845003D90AEA07B41BFA2547B
                                        Malicious:false
                                        Preview:.qJ.0....q.q..t.5Y..}..g..`...q...r....."...Jnv........!.=./......?..#~.ft..H.c$[R+)...<..k..7.8`.qX.W`K.u.1.0."~..{...A.'A..b..x.l..NU.....s.....7..........;....S......L..}...sp..U.O.{.u.FW..GzA".m.f.].. X(..G.e... .~......NQ.k'Yx\..:@Vk.,4.......Q....,T.h./h0".C.f.W..aT...n)..`.+..<].#....up.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):461
                                        Entropy (8bit):7.52449167811674
                                        Encrypted:false
                                        SSDEEP:12:1hoU2sMPl/aHj1e4J3BRUAeNw4QX220IAuTsM:1hoxhdWjbxqQX2oT7
                                        MD5:3AF2AECCC3B226C41C8241DEFB6EFF28
                                        SHA1:83D2E303195B8B9AAB4CFF8300FD8AFC1833D51F
                                        SHA-256:EB444146A9E0A185BD07DE8F458F453BAC782CFB9816C5D6431BD531BD9C0ABD
                                        SHA-512:7766958DB740902B1202CD6B109A1F3201BACE01D9A7C064EDF213D474B936BE9E77049191C9B95F1FF7F8E142E70DD97A153DC780C61769FDDC2C506CA01860
                                        Malicious:false
                                        Preview:.g..t..`7.?..,@.P.s.2j.m....<.hY3...;../j.....X...T.\..7.........y.....?......8.J.nPJ..J..&.Qo.S..T....5dDm6,.........\V....D...=.>.Eoxw..B@..e1c."ed.lbAc..(j.F......!........VQ...I..q0i#...6.5.gK...+.5.u.G.v...W..lm4S~..BoN./}.'...>.~......MR.k$Zx\ ...\=...M....P.z.&.*..;..hl.*.o..h.+.6G...)Z...&..........d...q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):467
                                        Entropy (8bit):7.522949660833364
                                        Encrypted:false
                                        SSDEEP:6:HGe462u4SiW+T62IUF8mw7SdEuaI9g6+HNMC58ubN13eobexx8Nwvi9vf/hje95v:c3SDCLIUiXANm+ChfeX0bKX220IAuTsM
                                        MD5:029A933E01E73C4EB295A86843EF9390
                                        SHA1:B0257D3004855435136C65F25A94C059B6778BA9
                                        SHA-256:BFB5CA9E3C81D09BA843FE1CE9605BA7E0E8031FBD9EC758B0C84BE840294EC4
                                        SHA-512:84BE0952192D21F0E92D37D6E8505BD12814DB49424A389C50CAA5AD572C5E05FF2F02F4A45B44160B7C66C036FF4413D2BB154616FF4360D2F33028205EACE2
                                        Malicious:false
                                        Preview:<9g.b..N..+...]I.y\....71.._........8]Z .......O.....ile%.<*@..l..O..#.v....q..l.H.........B.......@.V.3Q.'.y'8...t&Ok...3......\..R.<2....%%Q..>.pr........'.4....-..ge.G.4..l.".^.uV.._....v`}5.k.h..........)J1.u.G.v/.w.|DXBY|p..wMN.N{]'...>.~......MR.k$Zx\ .A.\...............[.j.....TY.L.U..0..P.....L...4.....&.F.q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):461
                                        Entropy (8bit):7.516796552583497
                                        Encrypted:false
                                        SSDEEP:12:Gm6h0acy7TQHqj2Uiq0BMN7gX220IAuTsM:Gm6h0aF/eq0W9gX2oT7
                                        MD5:6DDD282FB1F99B2D44E162892D92F82E
                                        SHA1:E5FEA15BAEDB0D9A5C7C80730801E4F04EDCAFB7
                                        SHA-256:79FA8A92078F2EB2B7FECCFC5E6EA213C5584B230BAB4EDABE15CB46FA98CF66
                                        SHA-512:C080A19B60C9ADE368CC3BCD83EDE221DA87F1AE4114244A202C6207F368364AE00CFBA563645B1AFD833061473DC3C0BD2C4DD48C0EC7194E8D1B1DF5EFF0A0
                                        Malicious:false
                                        Preview:..t.......8$.N..J...n..&y...#..5".........L\.d\.D$....Q.._h.$.o...4.IM...>/2....g.8..E.!]..=.w....h.....b.mP..Gz......?.........I..`.M.~c...Qw{eh........ ....T...P.pj.>"-..$.).n...m:I5./..>..r.R6.._J.J..u.G.vr.r.,U@.^{F..#l....SN.!...^.......MQ.k$Y{\ R..n.3G...MA.r..<.....I..Iq..=-....#...w...I...R.k.........$y..r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):469
                                        Entropy (8bit):7.554545439991879
                                        Encrypted:false
                                        SSDEEP:12:1z1472kW/4dioV+0DxlFhNY+zDSr8dzPmgX220IAuTsM:z477DdiozFhNlDSrqOgX2oT7
                                        MD5:E9E00C9B9997CBB0E94D1B4637F4C4DA
                                        SHA1:F5F71F64832EF9A93B148AA47224EB3E32508BE2
                                        SHA-256:7008ED54AB34803C834B11E1BBD9C5C002076B57C83965C388B74244385800C2
                                        SHA-512:175BD079CC0427747B3531C89CAA44135B7553EA30A643252A50092E14AA22C45924870A30BF70E7001F06C5476F8D58865F12A262A9D9EEF640155E97DE2EFE
                                        Malicious:false
                                        Preview:..<..r.C.z........U..._..y....B./.....@j..^`.QGg....*......uPd7.4...W.W^..).@;.f.e..(...jV..../..!..5.>.K...%.r.)...]E.7z..y.T..A.u*I....8&.6<.j..TVE...2$..ho.......@q.H....9!D.z.=....-v6n...../R.Rc..bc.$K.....u.G.v|.!...`.U+Q..s.JD..o.....^.......MQ.k$Y{\ R..Am.=.0.......9+...{Z.+xQ.,.w..........Q.....x._Oa.t...Hr.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):460
                                        Entropy (8bit):7.512667321746572
                                        Encrypted:false
                                        SSDEEP:12:Bav4wQz7X/eW3rGIekEzfvpCZsJfCHil6emjX3X220IAuTsM:EQNnX/eW3iIizfBCZofWn3X2oT7
                                        MD5:17408C24A11C83128D35CBE946A9A606
                                        SHA1:98ED32B11EA745353B467F5B1B308CA6FA49975C
                                        SHA-256:53AC49424731450FFA0F6F7080ECFA09F59ACA27F1C7BF29EAB3B08A4734A7E4
                                        SHA-512:F3ACF5EDC1BA85A06EB824617E6E3AA3EBAD90443985712F83CF411A3A2192B82A09824925F34B4FA3FC7A574C515723C04D53310A78113459427B0B3D9D48A0
                                        Malicious:false
                                        Preview:.t.7._...&..,.@V.....H......r~..C......I...B..&...2a@`.fz.)......(.~.@.....:..I.....!.u.y..[..x..2a.....K4.%..a...N..7..i8K.l...u.@..k.{(r.0.\...........y......U.....4....fh.KC #}..B.R.z..[x..r~.#.(*.u..i7.u.G.v+.Gej..QcDy..)K..;G.Hr..>.~......MR.k$Zx\ ....lL.o..bG.*...c..5..E..tks..()...O.....=...I...y.Ne..N.2..q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):432
                                        Entropy (8bit):7.39675091424318
                                        Encrypted:false
                                        SSDEEP:6:6rtIEaKZznGYz8sky+0ZPTyqXVnE8yNu1jtv7/hje952lItGIUCKcpqKsM:6JI8Rrl++LDE3UjkX220IAuTsM
                                        MD5:F38853D062626341AF7F111FA9F62995
                                        SHA1:D851161F1D21C2F2ABDD2CFA1710FAF3F1D4F1B6
                                        SHA-256:56A27EA335DC3E1ADB85F74296BFBC87A193A08A63CBD21084715C7731505E96
                                        SHA-512:16669C4EEB03A7838CE30CE79286A77CA3FE3BC5B3C2C5F01574BEEEE8FE06A4951FDCB3E92506563A05DE8A467A0F93AA1D95F2F9A77A0EB550C14B686F73C4
                                        Malicious:false
                                        Preview:........n...Vg......0[P+.....x...c...?..x...&G.bR.p..+y~.x.w.tc)........sA...........I....9..D.=v..N...vnG.).4...1"...e.....n.[7.}..q...)../..uUi.9..=q..go_+&}"h...8...Sk.r.R..:.u.G.w.^t[|.dH....et.N(7.%'w$.<7~...O..MQ.h$Yx_ R*|,.:7wj@...txe_..%.bjs.+.St..._..\J.%^...i.0.1v9\...=b..s..s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):487
                                        Entropy (8bit):7.608373015582988
                                        Encrypted:false
                                        SSDEEP:12:grMP74k59HNbl/vI5pXnvDewieumOqdKX220IAuTsM:/P746xNbG5hx1OKKX2oT7
                                        MD5:A2F937000DD8451F8A4ACBA8998BD5E9
                                        SHA1:50BA9165881FFF1FAAC47F92D1F5222A9E0D6AD2
                                        SHA-256:17564D966D0484F640F8822BFE9769B3D68F1911B7060E0F83A923E91E18561E
                                        SHA-512:FD50F0BC5DECE3098AD7C14FB0B440800F0701AC3B06BDBB9D123049E6118244D79F574B80E158781DB42A97D5D903E754CFCBFB4394E62104CBEB8F309150CE
                                        Malicious:false
                                        Preview:.Kx..3..........u.d..v=.r ....=.:..KU....j....y.....v..${.p"2<.(...L....*.G......P$...3..k..zs.4...!..;.AH...v..B......ES...j......\..~....C.`.[.l....g.$.V.9.{...am..S.h....A..k....}.wW..g...\a!..2y..kF.VY....".%.>.3.s..$..vxr..u.FW.zKuV/.PILsT.pdN...-'.t.>.~......MR.k$Zx\ C.|.f......1.V.7...'kH.<... ^..g..~.K....R.}T....Z2..y.T0_.q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):469
                                        Entropy (8bit):7.531890803809317
                                        Encrypted:false
                                        SSDEEP:12:tjoLsDWLuJyyvvCWFJH0WBGcgRa7jgJgX220IAuTsM:XOuJyyvvtFJH0WBcRwjSgX2oT7
                                        MD5:4390EC1223E2DA4FE84F0C6B0CF4724F
                                        SHA1:0DE1B12342EE36CA7608657C8423EB563D5708D7
                                        SHA-256:72E44A0E3598E2D1CF6ABD14B86D563822E51CC81DB61AA15A641669DF2B8510
                                        SHA-512:20C88A316218051F3CC79892A6E682ECEE1499765DE49B53DF11650542CFCDAE6BA1832C62B8DF639F99BA84397E5AC9E8DCB61E652159B8570323599F768FCF
                                        Malicious:false
                                        Preview:.;.5.Hr...;.3P1r.@F+@..nxW Ua.O0..g.._..@.$..:..^.K4OG.C2...#...e..5.1.U.j.D.g%.u<O.....wjV.7UM......p.. .%.5..5l...~p.A4h........$.<.....L..Yd.i...b.x...Q....8...5V....F>..v.}.n..x(.4-...e.%.[.F.A.lh.S..hk\..u.G.vs.'."U\.^}F..sd..9.M...<.^.......MQ.k$Y{\ Rk.|.$..8...}.\........,a].@.....\...+....wb...\.....5B......r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):479
                                        Entropy (8bit):7.46233129884531
                                        Encrypted:false
                                        SSDEEP:12:wWFUT907mkLEwjPSUUvLeayjS4qKX220IAuTsM:wWiKFrjPSjvqay/qKX2oT7
                                        MD5:671AA0A21D761DB76B2F0A407B435FD4
                                        SHA1:BCA31AA71E7C8EBCF4E750FCF55762480270D9FE
                                        SHA-256:9C9F6906E1134558123BDC3CC05DD1C8635747857ABC9FD3C6166F734A575E7E
                                        SHA-512:1E0747934B0A536AE0B2332B047DE3E1C18AC1F2E1FBA794474A72AEBF16EBA609D9193A85C35B7ACDB93C32E7BCFE0626763D7F0BEB3357F72C6EC0E5F07535
                                        Malicious:false
                                        Preview:q3..9u..^.'.C...w~.e...t...9.....%......1..mr)..l..Z......k..E.P.1..y...$../...j.\7.k..M.....]2`o........I....-. 3.S.^"U.H6..<..&/.>.km....$.A...............J...(..3u.."..Z].......q..g..../.P...a.}....R...~..2.0..+.....u.G.vr.@n..Q.c.}..."".%.0x...>.~......MR.k$.."+....".F..h..z..~.G.:q....X..#..A..X...B.GgQ]_$..\....m.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):431
                                        Entropy (8bit):7.533832242558931
                                        Encrypted:false
                                        SSDEEP:6:PrSOiwibpyP/bex9f4u/JkN6FotGsCR1azuyXQjr+r9hje952lItGIUCKcpqKsM:bgltn4u/JkouER8iyXQjnX220IAuTsM
                                        MD5:2398ACF430D7281DFDC4914CD68A2025
                                        SHA1:C5D13F342F9C20497C20A6DD96E596CF73280500
                                        SHA-256:226472E7D61BF6929EF8FF0BE8FDC906C87CC2E8CDE58503A44780D2ECCAE54D
                                        SHA-512:E0185600BF3C4888FD481252E50DF193F0215FF9ADF1F21184F83D2BCD1FE14173D747D68FDA439CEFE23FEA36B8532D08E26502B695C2EF6E84E2E522CC5BCD
                                        Malicious:false
                                        Preview:"..|..,Uq'.....cK.J.cU.?e.$...,T.o..Zi.@2].l.Vy.G/BiK..I.... ...#.....=.UH|.G...Nr`C....M..........W.>o.0..0CAx.2.O...ylT....S.B3.j.9....4.m-.W..z.....K.].....X'*.x...@}VZ~.u.G.v/.{...`mgVy....%.\h...y\.........MQ.k'Yx\#R*B.9....8)y...=.......?.e..p.6.@\....N..M....s......``..S...7.{..t.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):462
                                        Entropy (8bit):7.608133870539045
                                        Encrypted:false
                                        SSDEEP:12:q8EnSkDYGWbLXh22usebqx8JUR3X220IAuTsM:qtSkEDvXdut+3X2oT7
                                        MD5:5D62D7C7E61CDB2DBD330C152120AA21
                                        SHA1:B16FBBAB338A59A7F16B249423145D92686318BD
                                        SHA-256:A5F75E68B53F09F0FF88CA455C053A81B5DCB45ACC036683EB6688B5262B23C3
                                        SHA-512:20286FB82EE757D29C2AA502671380CF186FB9EA2D2604E95D2D9ADEDA0F1CF4AC1BC9C03245A9EFE1DDDDA4518DC00694BCEB5196264D6528812EF0F9A6ADEC
                                        Malicious:false
                                        Preview:...q......Y.....Jn..}...Ah|....F+z......&f... w..SP..m.vl.C..3.._..J...>...|..eM....m.n."O....r..X.......[.j%W,.=..........>o.qO.....H%...............Q....W..Gz7l.O.M..S.N...QJ?.s.Oa.~q......1.5.K.7>v?.;...u.G.vy.O%..YIE}.....4..G.Hr..>.~......MR.k$Zx\ ...]J..VA$.......6./K.$Y...,l.V.R]......W,*.=DU.oth...G.n..^.(.q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):438
                                        Entropy (8bit):7.594594009282144
                                        Encrypted:false
                                        SSDEEP:12:OHMKhofiJAko8TW8IMZehSdYeV1NviX220IAuTsM:yMU1J79HIMuSCeXYX2oT7
                                        MD5:C5BB4291E6C93207E8AC9E3C2B810914
                                        SHA1:A70945CA62B045FD6358BD03364F920A90F456F8
                                        SHA-256:71795002B3DEC7589A2A3845DC5F3BF8B6F3BFE51D475667A89969A484AEDC2F
                                        SHA-512:BD5CAC5E19E923FDE6219604AD483BA6D98B78E5840622B86E76299026A60C9F72611A82BD90707F67DD2592F58CBE88354A41D671A91602FACBC947EA3A9AD2
                                        Malicious:false
                                        Preview:0.8A@...z.q..5....l...o...(..).....2..y$.D...".......[w..QLi...p51...i...Bi.bw...D..E</...`-[|....q............p+..w..FFL@..or..A.25R.D.r..~..f.o...N.T.H.i.nl#..U.V....qnE..h{..640.n..L.u.G.v/.{.y{m.2..|.9M:.X|9'...>.~......MR.k$Zx\ ..u.}..;.@:...c..)Dv ..B....{Q....%.*..~.:..F=..,....*a.Z....q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):497
                                        Entropy (8bit):7.5475047864199745
                                        Encrypted:false
                                        SSDEEP:12:y02XBWo6JAPIlIJmK3RMgqok2LNunaz+UuIX220IAuTsM:z1obGgMgPZFzuIX2oT7
                                        MD5:D6E9AC9840EBE4C65924ADC1C3E7E0FC
                                        SHA1:B2521D42C06BFBCC9E28E14B37314F3014E6A3E9
                                        SHA-256:637389D90F56C36DD8A0942AD0DCC9B03C08F300FB6A82BC2D0D990DDB896E69
                                        SHA-512:29BCBDB683AC738782E8D1D11DA54056BCE5906353EC9C07588EC54031E27535F3DDA0FE7AFE0E352C0FBDAE1FA01596144FF47D7D0FFCCB5710980E1619E571
                                        Malicious:false
                                        Preview:....U.k..b...n.....7.^.\p..NSt.f<..........z..`.z(.l]Q.Y.Y.X.Lcm.g.c...9....+.9..{'.........m..A...s....gF......c...r{..4.c=I....7.....0h.;..v.D)..B!Q..O1..i.(l..B.[..e.j..ahX."...R(b2g...TX .D).....J.....Q...20.....iI..I.n.....y..o5.N$.u.G.v~.K#..[@^rB....5..z.'5$.^.~...O..MQ.h$Yx_ R*..I.G...L.rT.@+..f........G......2..t[..G1... ./.A.I..s@.s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):465
                                        Entropy (8bit):7.546908836260962
                                        Encrypted:false
                                        SSDEEP:12:UktTqwKPv/LcW37dIsk4n8cZB3VX220IAuTsM:FtGwKPbdLdIsP8cZbX2oT7
                                        MD5:5883FED3B5D76B7E9126EE23499E0B51
                                        SHA1:18ED448EC81FB4049620A68AB35DF5EEE37F8545
                                        SHA-256:AE8E1FF0BCEDB4BEAA9BD1E1281D17AFE9A42BDD4DCF618667E8D4C282B8D82F
                                        SHA-512:57322A877CEFF3FA39230361E0FC63C99982E298129B42819C8632F81D43682CB1FC7F56761C83E8464CEBB52F8E9106E86B11A5331C3F3BB7843599ACC32C56
                                        Malicious:false
                                        Preview:T.~...{g0.w...._...H..g.d..'..C;I..G.g...V....Fq.G-.M%.K^c.%+.-.*......{f....$...#...z%?.....#H...*...7r!5.[.%..#.,..........[N.*..L..T....H..f..F../....m.S..A..-51.Bl/.;V...R.m...R.g.u..Zg.8...P$...;...@~cIc../.u.G.OCBw.+Zl|SX-..rXst..2....>.,......MQ.k$Y.........N.%.1.F......J.(,N. .`u........3.%.u.$6..?..:....z..n.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):462
                                        Entropy (8bit):7.534903439801036
                                        Encrypted:false
                                        SSDEEP:12:eKHcj23kSApaKzWnQwHjrAvodgX220IAuTsM:eLyUvk/lchX2oT7
                                        MD5:E9D75DC19A0079E9BF14569AE2F63C6B
                                        SHA1:2271C22505E5A63299FD62B32A5CE5E8250D3F06
                                        SHA-256:AB642A3716936BCF1A5C48CA52F0A1A6C1DB9F155FDD2F997C36331192703DF8
                                        SHA-512:4E11B36B8E7F2E8FC73D72587CE33278617C8E9A755913128DAC4AD3CB9BF6A2A3BC298AA2FED556F910881ADA51CD44BA46A3AC4B0F30B56D3F312969BE65CB
                                        Malicious:false
                                        Preview:7.!.B..4....z...=-.|I...-..+%...FM.5...$J.....=.)R...-(a.^H$.....v...+..b.]u..u<.c.Z.PP3.ZX .J..'..8.&.b.....7".z.lR.....sJ,N.$...2p../.Ig....X<.......L... .I.cc..b.L,.....)..` ..4.......&.b.*..........q.=...D..u.G.w.aG#......p..3..k#G,H... .~......NQ.k'Yx\...!ODU.m9.b..M.o2^...qAj/N.B."..rSP.*....d..A....;...|.xup.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):477
                                        Entropy (8bit):7.556006378464964
                                        Encrypted:false
                                        SSDEEP:12:gnuDUg3MmbDNopZ3Z7q2Dek4KHHdX220IAuTsM:cZyMUDNGZ39F94YX2oT7
                                        MD5:3619E236C7A1D2AD35FF4A01469B36F6
                                        SHA1:1129E03AA1B573A69A1CDBF33FED47EC2666FA1C
                                        SHA-256:0828CB574D8B570DEC19A9EC9C9224DC570EB1D710C71340D1DFEB1DC0E1808A
                                        SHA-512:5C75444428B658F9AB63656DCA5F65D933DC0A798524CA6C3A9565AE30DDBB828F1E99D766AC77B2FEC80BA894E0BDCAFCA50DD2C3A7CA8875C21E9668661D46
                                        Malicious:false
                                        Preview:.|....re.a...f...8^.U%Y7Y .rl.!.........H.ml..e0.4....<."X.J...'...3....bJ.nW..8.8Y..+..u#..7.-.L....lm....$[.Um$s`...A.p.....,(*3...+.7...".....m...6E..b2N.<.....k...I.......>Oi...$..P...........R$.9ij...s.W.......[X...u.G.vz.'.xz.BYx]..(K..78]'...>.~......MR.k$Zx\ ?v6.P...sM.?.b.....I..+............a.H..h...5vM.,.l.h;.!...q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):462
                                        Entropy (8bit):7.504816568524217
                                        Encrypted:false
                                        SSDEEP:12:yBJSslNnHDWJhSwGj3nCdVpCUD+E8dgX220IAuTsM:ul1qmfjXqVpCUapdgX2oT7
                                        MD5:C008368CE2A88D8E90553FA635754779
                                        SHA1:3676F9395BD6DC91D303A436E0070354C9CED586
                                        SHA-256:54294DBCB7AD0250DEF59094DCC54C8B2681BD71651D358524AA098393406BAA
                                        SHA-512:C2C1A3703D79C4E157D5F962A64153391F4DF785666E15D69D50B12AFB7C5A9D7750C2864E85EB1018FEB246EEA6C7C6F7590B9426D95C199857850E89BBF87C
                                        Malicious:false
                                        Preview:....4Vg...UB{...$9]..G.......kT.H..5..?7e...Jx.M'\.i.HW..|.nd.)...;=".H...W.v.S;*Bb...f.xOL.T...sF3..4v...0.".u#.t`#....&c....TiO...j..'../.qV.!.c~.`...x.U...i..g......3...2i....Y....:X..#........9.{|A...*..u.G.v~. ./WDH]{..K.E!.7..'.$5<.^.......MQ.k$Y{\ R../c..^.n....>.j.8..f.c.@]....(.p.<..2.|..K[...e..7....`.$r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):456
                                        Entropy (8bit):7.46121160576384
                                        Encrypted:false
                                        SSDEEP:12:FWmWtcq2siW1ZbzVfDueklT7Zx+N+R2ZgX220IAuTsM:Fwcq2sVfV7ueAT7Zx+N+cZgX2oT7
                                        MD5:855B6CAADE851D3F723B035E11CC9DF2
                                        SHA1:6F49DF6078E2766B3E8D6BC11F103CFB751980F0
                                        SHA-256:FB6A89A6DAAA4E40E115A479FFE2F42C6D03A757E18E134674C929725CCD4FF5
                                        SHA-512:CBEE88679600A96018FBD43EC1DA8F4ACEFD1E97B18A474A684A30CD2245D9B41C3567FF125FBDB4551F2612F20B3277DED3E85DD0383608B7F86AF39B64B357
                                        Malicious:false
                                        Preview:.....W...3.?.....`.XV<}..x.F...:u...../4..g..,=..}o.b.7rz.@.]...T.f.....`lU..s....>...].Q.*M...u-E..{.$...WA.0....^.=.'...C.../..e=..^R......j(.o.{..jSo}....?.'v......._nNO.B....3.g..=QMB..,.MK....7..7.u.G.v}.Gt..[D\,U.e .).2(-'/..>.^.......MQ.k$Y{\ R....H.i..{+ .'.......f..e~jM.!...A........B.p....a.>..L.CN.e..r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):463
                                        Entropy (8bit):7.575292933154535
                                        Encrypted:false
                                        SSDEEP:12:fu+xkVw3WURwHbnM492FvIRb1l/ysgX220IAuTsM:f5xUwGRoPAbPhgX2oT7
                                        MD5:91A4EADB4EC9BD27AB1CBA001FEBA9AE
                                        SHA1:F604CB5B73D969FC6A27260464A047D52D4D20D5
                                        SHA-256:2783357AECD4756602821397D2C37C3E50E4DF6B422C8DDE79952B28A2203EA5
                                        SHA-512:50AF0905C6630B3368F378518FDB02C7A67E598EBBEC1AEDBD2A6A5B330E2A6D0837D335B8AB265BE861A88BE9ADAB143D2ECDEC02D25077AD0FA8BAA2070084
                                        Malicious:false
                                        Preview:.0.6.....=.wl.;.C.'.q:V.]..gx.!.!=......B%ft!.+g..W*...B4..>.....B.....Z."mFn...m....*.;.....^{.g...1P.^_.TQT;o..P.....+........."F...#.%.....$i..0.X..S..p.H.,b.gA.n.Y..J.tX.;..r.Uph[..k.o...lSk..XK^. c..u.G.w.^&[*.fx3.|d.XK....~.=.<.^.......MQ.k$Y{\ R9.%......o..4.J.-.m.......1Y..d._'[..G..K..4.I....i.^+(1....=...r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):455
                                        Entropy (8bit):7.4714626892584155
                                        Encrypted:false
                                        SSDEEP:12:f/wQ8VjsN2O5Yl3tvgNuzgI8ZzZM6iX220IAuTsM:wHVjrdYknGzZziX2oT7
                                        MD5:D5085880C9568FD757258567553CD286
                                        SHA1:B25944EFC31FE2223AA4702D20E634AA85E0C6CA
                                        SHA-256:CE8D77BE384A78225C51595ED2E762CE637C88CAC166BC2D3407148C9DE6B1D9
                                        SHA-512:70C183C509224FCB37C4A6B25661082C745F0834D0B9FA98C18C57923FC8E28F91B716DF57D101793803CD1FD2139B73C88698B7CA7CEB48FFCCA2FCA75539E3
                                        Malicious:false
                                        Preview:.....gN.x...6...../NT.....o.....Q.o..C=....V....e.#|.+....A.]....x6."P?.w.ab4...;:.w..!.t.dy=.qo...Y.&.k6...].s.....hT#._...\.1D/..G.e...Y-.MC.2;\..Zo..'....+..}.....u*..a.....x?.......a=....d.....u.G.vz.!.){`.2.A...l ..y..wKo+.~...O..MQ.h$Yx_ R*_....>..Y..#.....Y....).T.A..-f.s..1.R.6....)k..D..6.-.9.>..P.s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):461
                                        Entropy (8bit):7.46566431265304
                                        Encrypted:false
                                        SSDEEP:12:8l8oq7pa8Veb2itCqgzRYiQFr37gX220IAuTsM:818wSbzRYL9sX2oT7
                                        MD5:E77C9BF5DA978F5A6699A9899BD957C1
                                        SHA1:6880829E935E1EF081909AA793BA3CEFC8AC7E2B
                                        SHA-256:B1FD0D0A27C660AD8AE15226200CEDCD33BA8B39FE593838F9890FBDD7F8D416
                                        SHA-512:0DA291589025575EA200B8EFB94821930EB0C1EDFF6C6177D3A624AA24DD362E9D939A113C3BC2254649CFCDC2D8C34D147A1CCBE6001507D885DEF9A3D62F57
                                        Malicious:false
                                        Preview:z..m..G....q-...M./I..vI.C]....Q..D..x.-..@.C.....x...|...U.0!....9I.Od..jW.9.....k.n....hv....\...i.q-.k..O.&z.A.Q...Wu...vZ...R@.B..+N...Lt.,Y.$ ....w.=N......@AT.].H..u...M.p.....:.x...Y.|.8..rz..f^B&.P.u.G.v/. ...YDU....&+*.NG@H,.. .~......NQ.k'Yx\...,....._........[0/&.!Al..F..z..z6......N..)..0U.#..A.-2....+p.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):478
                                        Entropy (8bit):7.513603787270845
                                        Encrypted:false
                                        SSDEEP:12:9guo4UF3AnWwZ5hVo/+arTb9ePJMRHXa7qxbi3gX220IAuTsM:9guoHHwBVo2arfYGR3a7qc3gX2oT7
                                        MD5:7895BF8DD957D12A67FE68497904A24B
                                        SHA1:9B1355432DAAADE66E563038194C7FAEF768A6BE
                                        SHA-256:8BDF223C1BC93AD149A0675B632401A9AAE73D192576095956BD752D445AD3DE
                                        SHA-512:33149B498DE1105EFAA1DF50151FC9258B3809F1E595EF1D485F2CED1B63A09230CB02ED9067E06C714A14EBBA7F7BF9AC920E108EDC07E68F759B35E934E6DB
                                        Malicious:false
                                        Preview:.K.j.%.j..l.....o...r.8..,8U....'b.,....y.~...2.[..V.\..n..[.rE..N.i.e.c]...>.......Ql...O.:........l.m.............aQ9}..*Sb.H.g44.....Yl..>/..H...,...=w{..m._m.@. .M...M..!...zM&.....au...quQe.Y..........,PC*^...:.u.G.vs.$./V@GI.D..vIO...o......^.......MQ.k$Y{\ R..='.*...>.;.,....=/./{...`o|?...4...2...w.3.^IB.B*....=...Sr.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):465
                                        Entropy (8bit):7.531016941659361
                                        Encrypted:false
                                        SSDEEP:12:9M+3dSgQ4s8C9rIbt6CuUH3I7LP2JpmgX220IAuTsM:W+3G4s8C5I5HuUH479gX2oT7
                                        MD5:AE8BB6F0AD829F00A2E83D0813DC78BC
                                        SHA1:B71FEFFE8EB51E50C5326893F3082353FED2C170
                                        SHA-256:44F49E6C3DB9EF25C71720ABEB6AD3184ADFD5BE6777F5EA090B7FAD84010B8B
                                        SHA-512:BC5DE9C90B67A93B290D6B2C870F467D23E3AA50DAB22A7116289A7115608BA25F0D2D0269FFC9245AE73CB9497E96E7516523F18C9F0BC4E821E3198A52DFE1
                                        Malicious:false
                                        Preview:.y.o.s..q(..-T`.Y....D...<....q...E].oI.G.%.|.........4`../......X...s.\..U.}H.u...........^t.....2.C..w..U56.`./;.)..=..........%....0...'.. ".v....O$s.6.v.c"...V[.I........73.:.q....Oc...x...}...+.:.d.u.G.v,.Gt..[@]xi>.&T..N|@'.$.<.^.......MQ.k$Y{\ RH.......ng.....T.] .`F.nz...K.y..+...y.-RY.....q.<.*k....g...9.r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Secret Key
                                        Category:dropped
                                        Size (bytes):468
                                        Entropy (8bit):7.508712084221397
                                        Encrypted:false
                                        SSDEEP:12:69WK941qMvV6UUSPjhZvAGbXeaFxdP2IvQNJX220IAuTsM:3KK1qKcUUSPjhZxN1viJX2oT7
                                        MD5:DF12C43AA75F38C9F1A7F1A7C80C87DF
                                        SHA1:B6DBA00C7953B0CB04BCDF59D610A5CF0C9E7A9D
                                        SHA-256:04047208F87863A7CF9BD1F279A4D95F15D0C4F59ACEFA4C0BEC558ECFFA4FE1
                                        SHA-512:5BEF6376CB9CF40FA6C79A0DB03CD6C0301D6B45D0D83F540AEA1425E3699E87A197536EC6597B3C6F64D9AE5F7C139B5566DAE00E5D27D26758B900BD09901B
                                        Malicious:false
                                        Preview:....$.(.FQ.\.....A....\....M.B..V..h..}..qj../.Bvh.'.4.....jQz...0<>.jcv6.I..(5.4.....@R*..WkP.b......7..n$.P$...P>.....&>.R.).3..`.q...L,.K..r...ubW.CU..G.0...2.....Kz..X.0.....p...z..*..T..i.#....lg...{./.Q.O.u.G.v~.r.~UD.^)D..&.....]'...>.~......MR.k$Zx\ -G.Qitd9..n.a.xZ{].}n.....h..gz.........9....C..i...... . R..q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):457
                                        Entropy (8bit):7.523080459381008
                                        Encrypted:false
                                        SSDEEP:12:jJpQ+8hYR+87O89t2VCoe1i8mO2/X220IAuTsM:rQ+vRLOwxBi82/X2oT7
                                        MD5:362129037F390A266A3936589E55AE8E
                                        SHA1:2CFD37F45EDC2665E5CE8786AE84DE1C8F271E3B
                                        SHA-256:A459140F004F01E5BA93DBA41FA9A3D0810B32B26EAD244423E1D43B4F352A15
                                        SHA-512:850F8024A24B5C51409F1366CAD7C917ADB1AD04E533C1F4466A9295FFA2EFF082D68482DC77B3E436A77F4C81F2A21F8A67E3782FDC75368264D71920656EF6
                                        Malicious:false
                                        Preview:?G.{3...)...2h./W..@.T<VF.f..O_j+G....{.M.1...i..xu..F..k...1..xd.Q..[t[X...1.n...[...1U"...;^..}V.|:'.%.V..d.f.. z.-6.....$..h..tkKw\..n.{.o...c.Q..N.tL..vJ"...]....r...r....w"....jPr......N....u.G.w.^r\..megry..3O@..(o....>.~......MR.k$Zx\ .p.....o33&.'.2..A.J...4....A1.X...K..@......C..kQ....^-G)4.".-q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):466
                                        Entropy (8bit):7.522530373475194
                                        Encrypted:false
                                        SSDEEP:12:dAkjrUEx0Rq9syuskrJljoRcX220IAuTsM:PjrURkGyusyOcX2oT7
                                        MD5:A9AEB8489101F52ADA9F415A020D169D
                                        SHA1:16E46DD0A060999C5BD3BE8D7D85653538EEF810
                                        SHA-256:078CD083411625AEAD1A5111965A1F5874D3D604536228DBE2910989EBD2A758
                                        SHA-512:4A86D4DBD7AE864B12F1F6D5D25A70BD921D7FBE2BE875766340053C17080AD2E2B68C8272A0B66084E8AF90125266BD29F0F48785EC239114D96310D315FB6C
                                        Malicious:false
                                        Preview:(ykQ/...\t.<..8..e....D..7."*f..E.'...z;.n.5?..".L......:e.,EH._<e.8Y..g.....O..H..O.[...s8..'&\.e..-_...\...B..BU...f.C..`...7.3.|...Q.....D.T.....?0.....\.j...|.tnb[...U8.,g.....ZHI~R..*...zb).-Tu...O3.... ..u.G.v..{..93IUzA.....a.2....>.,......MQ.k$Y.B@.X..o#|G..L.yrToAIY~I....9..."...@.Ro..O<y.C8>/.C`1[.. ..EXn.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):481
                                        Entropy (8bit):7.58711351843311
                                        Encrypted:false
                                        SSDEEP:12:Z8iIO5wsA7xufzyAd7fv/3l8YhAOze0/nMQQi1HKX220IAuTsM:OIfzyKn3lj/MG1HKX2oT7
                                        MD5:9FC4FBCD37BD95CC22AF57235A5D30D6
                                        SHA1:4FEA69F17BE2131102411C20ABE60FC158B26912
                                        SHA-256:5AC64B6E3CFABE0E8EA35636331E60A5716CF939276D3D958AB4E28A89ECDED1
                                        SHA-512:8696902C22B051BF00D0C6BDDB0804FFDF8D62C4A448CBD9CA465BEEA7F9E74BDAC932BCAF34DC8289046E2909860D83E26150B91EDDFEBB9BFD64D78603D288
                                        Malicious:false
                                        Preview:..5a.5t.y6.9..wb....<<DZ.,.hI.A.+...\=...h...GB.".j...9xfi........T...z...0.......i.*..#....+.RP8.w.Z....l.;K....c.n..>{6.%.w.B<..D......|.*..}."uOO...dCG.Z.q.x..7..P..M.Y.7...L.{..q......U.#D..#........T2H.....a..x...........u.FW.~N&[#.gj1G{..8......Z...>.~......MR.k$Zx\ .;........ol....u7.|../z.9.E...........E..AZ:/...y..D.~.n..sq.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):438
                                        Entropy (8bit):7.539858464873384
                                        Encrypted:false
                                        SSDEEP:12:qioh70hNg0VkmLV96kBAFfV8rMtfejSgX220IAuTsM:qioh701VkmKSkfaA4jSgX2oT7
                                        MD5:8C540222FDB5EA9BB9AB02F489801995
                                        SHA1:18B233459511D4476E6FA0ACF68226E498803FB6
                                        SHA-256:60681EA57953CA8DED388554D5386CE9384AD1DF9B983B310F8925C981269D67
                                        SHA-512:C2AF6AE45FDB9028D1F69227C15DF3359B0552507E0F41EBF589C397C9D2F0D338FA0D1FCEF2031C10554EF7ED26209BC04A7EC1ED37E2173C556BCD58D8DF55
                                        Malicious:false
                                        Preview:.....I..m.%.w..Ah......O........u..C.^Kf...{K9.......,E...|o.........j...e..u..<Ls...#0...[..&D...2a.^.uG.D.1..8.,.x.V..N.&.......A...#..Q....Z...}.M.J.L..~....x.B......$...Lo..r.u.G.v{.u...l.4..d......=.X.....^.......MQ.k$Y{\ R.....,xp!0....V.i.....Zk....?U.z..!..Q.Dh..f..d.}.@c.f..h63.dar.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):460
                                        Entropy (8bit):7.575724455529856
                                        Encrypted:false
                                        SSDEEP:6:SzQDlFj9QblS9hrA2XaLOYD6vBiNl8KWgWW9tL8zyS/hje952lItGIUCKcpqKsM:2YFpRbXXKzRlpbL0KX220IAuTsM
                                        MD5:1892134DD857F35DBE30BE7DA58752A3
                                        SHA1:D0DE8634E28418CDAB6EF34CB244217F05555980
                                        SHA-256:FAE639DFCCBF02C59DF2B0B8883739A307062477950618F4D93AEF66625731CF
                                        SHA-512:05E454E99A2650D16A2CD3111670033C1560332BD1CEAA7D6758A2D4D5DBFE01DE91A1125EA66D82F3B98B28F2C0941D366C34869ACCDA03664239C76BA0A135
                                        Malicious:false
                                        Preview:........vR[ut..7.....t.. .Jn.U...{..R.,....w....$*v.9..J,.G..M..#..|sy.f.1.2Cys.Z...p.iM8.N ..|.4..~..V_....B. ....\ny.....b>;#.....j.%L.9.|..+m. e~.-......I..Q?D...3F.....!5$..T.......A..Y.......u.G.v/.Kw..Y.Ux..e".5.0y>M.K2..~...O..MQ.h$Yx_ R*..L.O.,(zC...._.r....fT.H.FsB._..J.!..2.w...d..y.d>..g.^...s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):463
                                        Entropy (8bit):7.486182315687994
                                        Encrypted:false
                                        SSDEEP:12:Un53U4FkmwOE94quP7vXY6MsjoI+uQU8ykpA/dX220IAuTsM:Un53UUkNN4Z7FdoI+kkyFX2oT7
                                        MD5:F356F1199C859655115914DAF7304452
                                        SHA1:91CA258875C3CECA2624FE4AB3D4CBAF22190D38
                                        SHA-256:5242B6F34511EFA4F4A80394C3E1C6BC32328A3535C847177C57174C05951F55
                                        SHA-512:E4B2D9DBA15F8B584AE5770C9E3FDF4390D21AAFFCD20EDC605EE8870EAAE81A45A93C19B58E74A80D8C665C83B51301ACA0AB320E67162F3B2150D184865102
                                        Malicious:false
                                        Preview:P...^....v]tJ.\.ItB@.**..!.=d.1....6..9.O?=\}x7..M.n.[...~.n.....?............-..h.....=\.%hF.h..S>.#{.O..>..A.2|an...Fur.........&(.|wB.Y9.......)%..2.o1;...NXl[......h0.a.D.;Ms`%...BV.....'.n..E..a.S.E..u.G.v+.s./z.ifV+..0....@.,3R.~...O..MQ.h$Yx_ R*aB..|-O..5;{..z.@.>......E....B.......T1..hiG...R...0.@....Abs.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):475
                                        Entropy (8bit):7.5686434173843375
                                        Encrypted:false
                                        SSDEEP:12:0Q70fymnBE4fmg0TKuF3eHcQdTcRv1WaVr5eDgX220IAuTsM:0Q0KmnBZfEKuccQdTu1Px5cgX2oT7
                                        MD5:8E872E6E848B45CDE0EC6EC3DFA24E68
                                        SHA1:EC5B2DDB483033D1A8A4901B6D97730CBAB967AB
                                        SHA-256:11762A3959F72A47BCD4AA70027DC3C95DB422FD7071EE66B8F8BAD12B9E3585
                                        SHA-512:233CDFF72A6448559C0ADAACFEFCEA9CB3094286E8DFA02A736CBD889D322356032E5AF4D6E976F13CA2675515C3C5492A92A7700519000B05D1AB85E642A145
                                        Malicious:false
                                        Preview:y....>g....%...q.....r*..,.........:e.......@..,J.'..9.....#.K...7[.......p.PR./...x..r.jRm.W.p.......@7..R.\.....V......`.G.#7x...c..TP...(..........l0.H..[.....f..c.9b:.....5@U+j....5Q..C.C..DeL....E'..I.Dh..o-.u.G.v..t.|{4.I|]..%.H.\.@'.$.<.^.......MQ.k$Y{\ R.]W....PO;...e.....b.'..^&eV........[.x...r.6*.......S..(.Kr.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):464
                                        Entropy (8bit):7.590310845479037
                                        Encrypted:false
                                        SSDEEP:12:r/e6Rh07dEgDReymhBcBbeF+NX220IAuTsM:rW6Rh07eseyzBm+NX2oT7
                                        MD5:6EECA1A10FEEB8B1ACF089686DF6329E
                                        SHA1:E6D71502F985BD8064316DE5E299A14873FD2BF7
                                        SHA-256:87617A99BAC35179CE121061DDBE5A6B3318F341180679433B6FEAD7BEEA18BC
                                        SHA-512:E6282366A267891839F276D2DA6660FF13DE59E5DA8C9856E17D0C082741D40AE461AD4A3191A714B4DB201D9602D11EF9D5AEC4E55BDB74AD26DC6083AAE891
                                        Malicious:false
                                        Preview:._.Tg.|>......5k..u$|....V]X..(...1...qW.vNR....6j+.v..b^. O.+.M...f...C....a...m.....w...;..W.6.r.d..t.>)G.S,,.A..B..]..m!..P......=.....!.o<42...j..m\..U...u.y..m=.7....M\.i.Uj_...5.x...=.e......0.)P.ep.u.G.vr..t..PC.}...w<!..od.".>.~......MR.k$Zx\ v./D>..uta}Q...R..8=.`..d.g.{..#.....m..%*..Dz.j..d.i.F.V....2q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):460
                                        Entropy (8bit):7.5541676143105185
                                        Encrypted:false
                                        SSDEEP:12:6EuwZdNzi/rzhloMVKKCH2TDQEXcCzEmxwT7gX220IAuTsM:6EuwZdU/rzjoMgjHSDR5zEmqfgX2oT7
                                        MD5:C5A32FF691372ADAD542E7B95581F466
                                        SHA1:9DF196FE9459B30F1F9A16F0726FD8BA9ACF7748
                                        SHA-256:669E14EADFA807399C293CAFF8C875C41C43BFA4DF6AE590E4D58702A647779C
                                        SHA-512:882B02D1D496D9A8B104A7100EFD293FF9C5872AAFE8BC6D79CF2C2E687A7A2C423073897721073791FA766D665D86631FB4C2474DE7C6D7CCFC4508BC345625
                                        Malicious:false
                                        Preview:.~.w.c...C.......R...Sl.1.s....nd.)K.e..Z>..... ...:.Y.`U....fU3.....>Xi;.(.Y$.R.D.....9. .b-.k..\I..t..d.gh.4..u.......Dw....D.."\h]aw..^...7....m..i.s.<..."eF0/!\s..Z..W../.+\Q....,j..{.\.,.....g~-.C.T...u.G.v(.u.{VD.].h.(n.t..o.....^.......MQ.k$Y{\ R.q8a..b.s^+..I..........H:.W.B~...9..x....h.Qmp...-.....r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):440
                                        Entropy (8bit):7.477206278560585
                                        Encrypted:false
                                        SSDEEP:12:imJRgjpcXbocu+VcoCiNVhUq4w1wWLXdgX220IAuTsM:u4ocuniNTUq4w1DgX2oT7
                                        MD5:25D008149D25FAC07F8F3D8D4582A48B
                                        SHA1:F5E1F0C9913E7771767AFAE35173B44ACDD3F73A
                                        SHA-256:D1C1FB3592E0D7F5B7511201F5A9381208E71B58E6DEB29A93DE446C59460C71
                                        SHA-512:05DDE6BE2E8508E1311BFD43005F7D5F0AB70E6F66562C9D9D2D5AFFB47E30E0C3DFC06DC22878C8DF70608248EC23A58695F741AF935F4A4343178EE0D43457
                                        Malicious:false
                                        Preview:.#E...]....S=...xh.B.r..@..v=....F..^.M.RiV.-..Z...,}.......5.y..e.b..X.W..]....P....b..Y.W[...6lA.....!...qGt..Sh...d...?.-y[< sRl...^T../+.>.G...N..!...N..7?...$..4~j...G.0y.L..:........u.FW.|Nu[+.em6V,...E...y.Y.....^.......MQ.k$Y{\ RR.1bE.:@Pt.$Y......?.+^.6......X\z..[..`... ;.'..>.x3x.E....P.r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):468
                                        Entropy (8bit):7.573896352227113
                                        Encrypted:false
                                        SSDEEP:12:gnpoOpCspp2Mq4WlW5bweVV+9plw0iX220IAuTsM:+poOpCQAlwbgw0iX2oT7
                                        MD5:609E5B442A79A18B8205A8C5A1E2EF4B
                                        SHA1:5DEE089A9AD03B0DC667D9652E2CC9A8A1E301D7
                                        SHA-256:622249175D707E515BC5049BC2EFABC27E86E09FA31BFEC58A285ABFEC7EB6CF
                                        SHA-512:39D0333A8DC83017D257DDA2A4B7897F9A2EB9AF78B043ECFFBB6DBC6E7DA781B3084B1DB742554AAA6A4DAD6FFF18E0A49F895C42A74897503EA84B70782A6F
                                        Malicious:false
                                        Preview:...cK%....s`].Fk....zcj1..+{.#C...?dfI...2....VJu....0....1..o[c.z .@'|q..........Z.....E~..)4O...7~j.9.SU.....&K..?q.Y...&..A..Lp.US....<.}.......t.-....u^5S..|*....Q....}..>..Z..|.Z.7.Z..A/.$...o.1V...U..L.e..w..X.u.G.v{.v.#W@.I...ep.=...$'.t.>.~......MR.k$Zx\ .!$..>..-.v....._;...E..j..8.:....#.Z.,...;."X..l........"`.q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):469
                                        Entropy (8bit):7.4815849126275245
                                        Encrypted:false
                                        SSDEEP:12:zUcY/x+hSuIS8Zk3yiILfSkDZWPO/X220IAuTsM:zjhC7rRfjoPO/X2oT7
                                        MD5:1F24ADCA5D8F6B3971FD115CD405A337
                                        SHA1:760E8038A31408D38B579781C821CF48F179A841
                                        SHA-256:7B54E6A1CC2A7BDFAA3B31D46DDCF0B194D95FED259CD53C1F4200E2444157C6
                                        SHA-512:AAB5B2050700868343B4DE70ECA8556899AA4259D9780BA3B7B3CB76E20EB545B3B7427A61F9D81A2185740C480FB3AF48BD92D9F0D3913A26B76DBCC9A4865A
                                        Malicious:false
                                        Preview:\u. ..5..Q,.......`.....H.}..X%..?y@.]$.%...........|.>Qg....B5.4.?...O...<...;.l.3.#.n.9.d..Z..{>.......u@9..k....k.M.....&.R(.>Y....F....ZIW[,....|hI.9...6Pvx.1. #H8.,...z$ak#...j.........n.3`...p..o``Y8..u.G.v..K"..a.h.yd....).AwK..q|[.....MQ.k$Zx\ Q*BW..D.u.|hX.s...'sb...O...i...m...4......')i....8....r..V.sJ)d.u.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):464
                                        Entropy (8bit):7.5245089726867045
                                        Encrypted:false
                                        SSDEEP:12:lTwhy7R8NTugWNc0ZBJ+DvYQeLrbIS8X220IAuTsM:lwhyFH3NFZBJ+rYxrMVX2oT7
                                        MD5:AC37843AEE4854BA7F3AAA37DA79729A
                                        SHA1:0057B350D1C4D4BFB772F79E986C062223717398
                                        SHA-256:1E34C06F71A9933452EF65004C485C823F90900073BECEE9D3367848868503FA
                                        SHA-512:986199A5F88BBA5266914D8481C8AF10C0C4427BACF679DF51271507431A47EC45FB37B7562911B968749F93ECDF11A0061DE5BDC56084B0DB101C0053409992
                                        Malicious:false
                                        Preview:..:..D..E.*n1S....KP......V.5....S..N.)t....4...h..b.\.N.St:.G.n.....;.P...&.ctW..<.a.>.{..KmM..,..h..C.l.t)......5.gy+........!.<.....y...L.x;.._.%..6uNi.(.......*T?.#...8..K..'.R..|..+6.R.......QlZb....$.t....xN{^~.0.f.y>.&h..X .@.,3R.~...O..MQ.h$Yx_ R*y*........j..e9.g[.....!..&.z..#^.".....F.jT.9.c...&.h9.e..dRw.s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):460
                                        Entropy (8bit):7.541209136087273
                                        Encrypted:false
                                        SSDEEP:12:C7wS7QfSyP/Gi1mjWAy59vAYAH0qebOw1OvFJcU0X220IAuTsM:47QfSynGi1h8pU0kOvbcPX2oT7
                                        MD5:C6339BE8546BC2F3AB8005644AC8D889
                                        SHA1:E259A38DF0970A74D53061F89B77AE24ECADBE3C
                                        SHA-256:0B504EDBEA34563939664FFE8759AD008B090BE378A329718323B48AD0AD901B
                                        SHA-512:812B639EF425549DF27960B40C51E0714690B471A1D234C9C2690D560E10CC86821284D906F4C43C615B359AA70B08355B4E9141B22F0148069AB7F0A513E957
                                        Malicious:false
                                        Preview:.X.K...{y$.6......bfT....3.3u.r.w....U! ..N.....E...c..C.'-...m...`.!>.%o.,..s.\F...?@......;.;....ER8.Z....^8iS.i.m2..s..?..N1...J...v..F^.R....#....!W.F^....].?..9......!.dDY....Og&I.D;8...o4.u.G.v/.#...[.])]<.'T..2G.Hr..>.~......MR.k$Zx\ ....vM..(....,*..2.R..u.P_..i+][u..0b?....h...k4..!.L......q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):439
                                        Entropy (8bit):7.496657314343869
                                        Encrypted:false
                                        SSDEEP:12:+SwC+1QQnNf4+BQep97mNwGdX220IAuTsM:pLN+v97VWX2oT7
                                        MD5:5919F9EAB1F4C6D25FA034662441801E
                                        SHA1:0B5D6AF685A5FF962FC5563F11C36AD2C604FC6A
                                        SHA-256:79B09691BC5C85057AD6E5F7247BCDD7361DD1D1FFB58918DCC90466EB8F7A00
                                        SHA-512:07AD290EF1E131748D0629CE286B0B0A0BCEA8E55F4F3D579CFA16C0D23BBC456926BEFBBEB1A04D314CD9A87BDEFB2CF7354BD14170A46348241C6694A5D7AB
                                        Malicious:false
                                        Preview:..g.>S..#3...*.d..HUh....B.R.....4Jk_.j....#.h."..q...\.q...1.V...=..^..P..WP..~l..EZ[.D.........=.X.P.. ..4......N.H...z?[<.j...Lf..s\...Il*._H..8G1&.q..+&..U-F.]....[..j...)..-P.$.?D.u.G.w.T{.+.m.6rU..pE..\..'...>.~......MR.k$Zx\ ..LR..J...Lb..;%.G..x.H'3!qN..^.]oM..2.....G... =^f.,...m..>...q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):457
                                        Entropy (8bit):7.5399502754522265
                                        Encrypted:false
                                        SSDEEP:12:slagytX+bUiUbwTH6iu5RRzKDTB/z//lIFvyQfXEX220IAuTsM:KyFmEbwTH6DToDl/zHlI9yQ/EX2oT7
                                        MD5:F9EFD385E6D6AF15664684C8FD6F1CEC
                                        SHA1:90F15AAAE1C9CCB91C12E117AD7AF32475F8113F
                                        SHA-256:4631E3C07719282BBE0D26B3FBAB491301B6FA5575C83309BFD9671A2BB5B7AA
                                        SHA-512:337A6CC9A0876B5B9E294F1C4EC727DC64F912B5879EF9ABEA2BF8D6CB12BE201CC878872176B4B3EFA4390E5D7B240652151EF9EE51805CB5B1B6E5F87653EB
                                        Malicious:false
                                        Preview:6.*.q........n\.dY.7.. ...:"......~.z.....%...e....J.....Vl...n.#....]3..(.*..h..{./{....$F..%&....IN470A...*......\8P..@7...)...e......|.A.&......,......G8...9..Aq..z(0x.R..v......#F.....Y..z....W|...c.:..u.G.v/.Ks..PC..l..&.%.'G.Q...>.~......MQ.h$Yx._W4.E...\....I...p.u.z/jh......H.o.ij[l.:.....l{:.N.6.+r,Hh..Ueo.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):460
                                        Entropy (8bit):7.565528899147473
                                        Encrypted:false
                                        SSDEEP:12:5X+mFQZORgP0r+Vaps7eBn2wvBX220IAuTsM:pfGasfapr2AX2oT7
                                        MD5:88AD66F79509A30E49E8F7C30998922F
                                        SHA1:33416F3F2E6D45CF3FA96E44127FE0C0DFC084D7
                                        SHA-256:57767D6AFC15763404ECCB7F181C8ADE4D44E002E530B8A41761C561E25D4378
                                        SHA-512:16F0D7D4A2208D8CE7C8F003557B7A555EB868E193ACAD1536FD770096C59C5EFE32850A09C30EE1E6BB9959AE756579C307EE23573532367FD2470BC8B4B35D
                                        Malicious:false
                                        Preview:.F..l..S....5a..3.+....NS..j3...R....|.|}o..o....mW.....(C....t"@@R4}.S..a.......A/..g...Rx3%o.A.*.wU...E....cLc...../.......z.HA~/.O..7G.a..m....E.c/.W....c...N*P......&>..if...p.........e......../M..c.fb?.u.FZ./d$R..d`dW....O...(.z4..>.~......MQ.h$YxQ..Yu.B .f....$.].m8......,D3...W.Q..E...1'F.s.b.)%.Y.p...o.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):469
                                        Entropy (8bit):7.555886997525121
                                        Encrypted:false
                                        SSDEEP:12:pQbVB56H1wX5BbOJ50D3BDTBMgX220IAuTsM:pQpB56HAKJ505NMgX2oT7
                                        MD5:C19223B6A23ADE579336FDC73DFCA6C6
                                        SHA1:16E3A1FC3451F08F758246B6EE4E69803249F75D
                                        SHA-256:C9851F813DDCA99C2CA5F44D648491AFDFC1182A5CDE566210FFB8AB1D2F1137
                                        SHA-512:0F1E4CE99846D48A5AC74AAE4C64584E13FD4268A6AA928896F784345D065F2C0FCEA9C2232F8A1B60E409707D29C795F54385689215AF1DAAC4BD34609E48CD
                                        Malicious:false
                                        Preview:.:E.......'..~9..E.#.....e.T...@..p....~..}.&.........D.*.8-....ao....x.jJ.M.L..W.....VJ......>...c..k......b.no.8..g_d.....5|..V.......@!...n..m.8..`.!.K[.9.,U{]9J....N..#=.}u.K.a|.._m......v...\....Q.?.y#......u.G.v..'.+WDEE|..d.Q0...ov...>.^.......MQ.k$Y{\ R.Hy.L.z.V........D.o.|.;.!K.8.vd..%..;}fWx..m..../.l...N..M.Fr.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):463
                                        Entropy (8bit):7.5703172041614515
                                        Encrypted:false
                                        SSDEEP:6:DZFhVMxPiKUYXoyx/fAZJ6z0H9kJobYBuhBWzXA3Cvz3lDf/hje952lItGIUCKc5:FqZXnF0kGbV2w3CvzNgX220IAuTsM
                                        MD5:BEF7F04B0BD4E19297FAC46AEF34401E
                                        SHA1:2A9553F5179078562CB91839F0B2C55F9FC75B76
                                        SHA-256:302CBB7536E6D3E7E56C30E02620D7EEA815D24F4AF1A12FB75F3D20A34F8FAE
                                        SHA-512:0CD1C3F90BE86E41475EBEEBFD6D27F491BFFCC8D0B3960F344E3299AFA4523C5810F1B4F907242ABDFD996DBC6785A5DBFD944B3B09E9CC964233FE8AE2FD31
                                        Malicious:false
                                        Preview:....*2..x......(...>......KneuR......n......*z.......\.5.k..0..WH...e...4....72{.`}..s.......=]!..i.....M...Z..$...gn"......H.....W7...Y..+|wI'..?..........M.....B....~.e...J2.'.wy...B..98..hl...u.G.vx.v.~{4.6.p|..N..Y=S~.U.<.^.......MQ.k$Y{\ R....0Yv..F.n...L6....8...%.......GW%......i.*...3.,+.i?d\S....r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):468
                                        Entropy (8bit):7.6192366961349665
                                        Encrypted:false
                                        SSDEEP:12:JO+/GTi+kjdaTt4yZQQUMww/qjHYef+Se5M4pHwX220IAuTsM:JZOTi+k8Tt4GEzYaX2oT7
                                        MD5:69A825FC79D6F0395D57351682068F01
                                        SHA1:47C810D13FC65F72D1006B667BFD90D6E1D508E0
                                        SHA-256:3947AF61D6C54D8FB2AF79B11F06F62F424DC582BF52148B7A76C526B77C5E24
                                        SHA-512:80ECF77D17CC8924288E6A88A9C078988716825E3AB9E639726F47564D08CB8339E798B3095DDDFDCAE6346BFA37DCF9FEED1D3D451292A5CAB65C95E56A2DDA
                                        Malicious:false
                                        Preview:.3..7......"`..i.......9O..!.}]....nk.8!..ug.E.v..h9...;.m.-.....o.G.....E.)/09.....b..{..+[.sv+....rm|NrZ....G..wIv........W7.u....1Q.....u.n3......?B.d.W.416_a..d.)-.n.Qs.r..%..D.K.f].i.X.GS.H..&...Fz9^...J..e..*.u.G.?Ha.r....k/.....9.G>H...>.~......MR.k$Zx\ @.c.........;..0i.xs.M...u......6{.qS...._....lc..).x.+v..q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):462
                                        Entropy (8bit):7.5805061868658
                                        Encrypted:false
                                        SSDEEP:12:0nSzJMJD1zkTzYieXWcpkl+ghfG5vqeh+99hwFdgX220IAuTsM:0nAJMJD1z8le2lbfG4q+GdgX2oT7
                                        MD5:C60E3DD5574CD2E99252BDD251787535
                                        SHA1:6551850D15D376C8335205034E268FE8EA2546A0
                                        SHA-256:EDA593648D96004B52604F2B7DD72101BDEEBFE8F5F729AD84B0D003B228F968
                                        SHA-512:0FF8BCAD85757CCE3096A6B7D214922B17F876C810DEEC3CF67738C53BCB94A9197C9C6BBE16465DE29407D3934A52FEFA3B9BE5C2C58BE129739A2A8050E6FD
                                        Malicious:false
                                        Preview:J..i...>.!G.....l..|.y^.&a.f..{!^.........!..UcF.%=.......&..u.........1.6.>...^.....(...=U.{...-,.h......%..rC.M.....D.a..q.vt.D.;.E.\...H....H..9.H..j..`..!.PR.Sd......Z..N..,.....I4...+:*F.;.3.i..|.F.Q...u.G.w.^v[#.gm2Vx....0.7.Q....<.^.......MQ.k$Y{\ RnB.7&.E..O.#....-!..p"...4z....].....U..CZ.<...).{8.......Z....r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):455
                                        Entropy (8bit):7.517694694620302
                                        Encrypted:false
                                        SSDEEP:12:YxXAiN55onk45oZtA9wOw0tK3XBdHToL8wGX220IAuTsM:YtHN5uUthZnB9T8XGX2oT7
                                        MD5:42CB952440878F09E7572D235C926C2A
                                        SHA1:E91D2B0A2129F69C7F9CEB6951066DB3224FCFB2
                                        SHA-256:43CC321784A9E5971AB33E0980DE783CE48E0B23DC7EF5BCB1133D22335333AA
                                        SHA-512:725E780CB7859D02533D18915BADC4D64ED6A156FA04EE8C61BA110D2AC3205CB6895DAB5781CA639C3448C779EA3CABAE5FDCDA163A3498BC288A8446895795
                                        Malicious:false
                                        Preview:..i<.$..B..f<2X..iA*&N..>..C{<..V...n....H"...T..^'.....i.&e.....5~.C..[.~{'.. .mi.|P.M5>s.4;..r$P.;NG:.fX.o....9....[.......6_7C.$q..P..M...>...Z.mf.....C'..y....@....b).l....{Hy.$>.aV.U{.R.=.{.>......mv..u.G.w.^tV~.4ChCy.."N..RY2x...>.~......MR.k$.7.s.....?E. ........L..H...D....(...D.XaR.H.C..V&....=.hiACb..m.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):469
                                        Entropy (8bit):7.576872313174903
                                        Encrypted:false
                                        SSDEEP:12:+ClUIjqN4rlc2f4+/wfzKDgX220IAuTsM:+ms4R/4bMgX2oT7
                                        MD5:8BDD40EA63EA6E3E028CD7C5753D3106
                                        SHA1:C627BAD37738A99568C8610E116F62FD7B5CB7DE
                                        SHA-256:1E43635ED931CF9D98AE8D42E888F99A24735F10780D2631C61970E9A72CF059
                                        SHA-512:EB661FF7BF299A31E832C768764DBD10D8DCD94CFBFA105390FB247D84E17614BDBB78F13FA5D623A2FBE27E8CDB8FAF39C808FC62FDAFE323ACDAE0820BA450
                                        Malicious:false
                                        Preview:c!m..#.Y|K.op.L....KX..Oa.....C=Z.F.].1.$..~5...j6LM!........i.D.Z..!/.Z.~..6e.......c..xJ..... ..o g1.<..C{&..]....0.=...[....?.w..(..G`..,..C...>.0^.1.x.x...SN.......Y}.s..:..R....d.]GDz..I.<n\.H.....I..s.&Enh.u.G.OCVv.-Zc.3.A.#l....o.....^.......MQ.k$Y{\ R........+.....l....V..C..GR..Z,....<.P......Nf..z.h...0...*.r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):468
                                        Entropy (8bit):7.5008111021124
                                        Encrypted:false
                                        SSDEEP:12:CP7DuWcUbJdN5AYHeRS7XzR8X220IAuTsM:0JdN5GX2oT7
                                        MD5:619D0FCCFED9530F4CFB75920FA26C3F
                                        SHA1:B27DAC33932E761BCD7CEFED2727822AB0079CDE
                                        SHA-256:711EA7C5CB97350B166C12404F101BA900FA60B4BF43D60D409F77569F24644D
                                        SHA-512:498DF3CA833B796BA359B4A257B59DC55EB21A0AC71DCB934873EBE42E1C0EFEB559ED4FBC46FEC5B40129E7233A31B6F58C9584132574FE774E4D95863B6A97
                                        Malicious:false
                                        Preview:s.9e...<.M.DI4..4..@...Nr.Z...$v5....5+..3.<W).ol..A..-..".h...AY.M...wQ.'io.:!..P.+sr|.V..v8k...+....y.....r.o.u..L(..d..-......~..<N?...S....ddX..U..;.h...+n.RG.....||.W.."....."[t.Zs/2.{..)..Q..%........9...u.G.v..Ow..[F\{U.M....",+'.t.>.~......MR.k$Zx\ .t....G..9...M.P.g..o...v.....(...H.4......iHD].u>..AD,.X.~.q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):476
                                        Entropy (8bit):7.541722695203245
                                        Encrypted:false
                                        SSDEEP:12:0hJS9EEjm5mrhCP97YWYqBekuuAxQvuGX220IAuTsM:z9nPW7YxqBndtvdX2oT7
                                        MD5:0AC65C0DEC357DF6B083F16C98AE12F8
                                        SHA1:BF3A94915DC23E9EA2135808617C45D67E532E3D
                                        SHA-256:4E9F446497F35A47011FFE0944F2E57879469E1A979F887891053EB7F87CFEE5
                                        SHA-512:D90610483C21D39F8D6D6682130C86D367B529AADA6940698DBFA1221E75E520F9F41B691A9987E67CE2C8BE88441D8A533B23E0FA221967B2294B82922F1FD7
                                        Malicious:false
                                        Preview:Q.N...Y....n.6.?...7b....C.2.{...].)..2.RlnXHc.y........nW/Ux.>...].?.....w..zn..}.3...Q.....c.....>-c..c.=...s.......|...GI.vLQ..1..g..2...g..%Z.r..J.*"..3.ZC%..v/...<.V......g...@.......z.z...#*.2.....:.+...X.u.G.v{.q.-{c.2.zE.....;.%..K...|......MQ.k$Zx\ Q*BWwSp.5....nD.S5x\.c...^.O.U.Mg.I..+S['c.!.L.J8.{.'....r..0*.!...u.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):463
                                        Entropy (8bit):7.540204939561327
                                        Encrypted:false
                                        SSDEEP:12:IcCxImhgK2eqolq4ialffOhtpX220IAuTsM:IP6mmFeqSwFjpX2oT7
                                        MD5:39373B4E31435828B95ED3B9DAD54641
                                        SHA1:8DA546F71B75F80F1C8433FF4CF815ABBACF9CEF
                                        SHA-256:BD068129534D6C7AF61909CB06AA85277006B056FE5CEBEDF9066E56F909CBF6
                                        SHA-512:F8447F39184617B8270DFECED5B56E7E51B2409A11CC03D04B1BE0A8869566547B736A935A4C48EB071270BD4E96499B5A5BBC3FD50E429F3889F3E1396EDF05
                                        Malicious:false
                                        Preview:...vd.6@.$F....0.c.6.... N..q ..-."....<.K.C.h ...a.......u.EnR<"...;....$....3.f..Y..i..T.)v..oI1.U2-..+~.^.2..a..f....b.Pqi.P..$.{......u.....Y..Nw....;..=...!..~X{.A.)....$....-TF...:..Z.q5p&.zt....u.G.v{. ...[.\+Y.K.M".0{>K.K...~...O..MQ.h$Yx_ R*aq....O.wY.6.D?Hh].)..t...M......q......a6..1b.>....0G.z..L..;.:s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):456
                                        Entropy (8bit):7.550727543010607
                                        Encrypted:false
                                        SSDEEP:12:ATaRFJuzWPEMaKHKe1NsuVpldKQSg+H7ACMryxJgX220IAuTsM:ATWVjNqeMuze93HfqyxJgX2oT7
                                        MD5:E23E691B80244A633E74B7734EE8F4DE
                                        SHA1:3C4A4B0B596F19ACE7B065A4368C7CDDDC734F96
                                        SHA-256:227A459B703FFC292AA959AF008E8F84E16E414F8A4A50B86E5E8FCB210BC5CD
                                        SHA-512:B595FB44B15220646D255B493D609CA47CC2E7E5557C4BCB10B296FD30C02B1C326F309A54C8D979FA544623144D828CDA6377499053AFE7D77AB79C1177149D
                                        Malicious:false
                                        Preview:.W*.q..L.XV.....n!..hH.n.c......Mqf.i..e.ND..1.H..H..+..4.......j-.(..|...|ul.AHV..].C.F....Bgo..........<.F.1s.).......`.a......V.L2.l.Y....J. LQ.9H......j6.=R..|D..}....z|.9#j....w..o.tM..h..y.D?..Y.u.G.v}. .(U@I]yM9.rd..[..'.$5<.^.......MQ.k$Y{\ Rh.`^4`..r..ws.......=%y:.....C.OS..vg..p....... J.$Z... ..r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):480
                                        Entropy (8bit):7.5024170824022915
                                        Encrypted:false
                                        SSDEEP:12:0SIHd/fPyzwsS/HkhXsLJGV7gX220IAuTsM:0SE3KzwDBgV7gX2oT7
                                        MD5:BA6556468F322FC1CA16B16FF28B4FF3
                                        SHA1:424D6C16D3659B108884E597D26FB4CD4283321F
                                        SHA-256:D97CD768B4BDDC0BC45229D79AA04BECD780D2FD1A7F8EE37D7C291728D4E5D1
                                        SHA-512:C28189C6F9A112B3F8D4EC71E961236042FE2A2990264604CEB6264EBB87A53B0F4420CFF33B567BA3C6BD77423D0B873817296BB163A3747888C04550DBCDFB
                                        Malicious:false
                                        Preview:B|......e......R......S..b.olm...2..h.6[B?...D....\...V.T....|..O.y='%.....w.F.Y..%...xZ..-*.3..^...9...._.......h..o......y...i..k...W.DTT.`Z. .$A_..$a0].u.S..I.Q.. n.-.+H..6a...'YBw).9.8G).@.03^..a..7....].Zk..5.....lz.s.u.G.XOfLv..J.Aj8..#X....@'.$.<.^.......MQ.k$Y{\ R......S..zL...k.Lx.U.........-........0........p.9..J..%1..r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1683
                                        Entropy (8bit):7.881722349077226
                                        Encrypted:false
                                        SSDEEP:48:3SsXPmUKITBkJLU2viqmrntWZtzHPxqqj1iHNoZ08w5YXv:Cs/qhjvOjtcpwtP8wk
                                        MD5:DF55E55C8C17F5CAA5C532E7BD3B4AF4
                                        SHA1:012A0367BCA0610577D219755471AA4269E4F8D2
                                        SHA-256:9B1C5123A9A41E031D117E0F7A1DCDEED4AE1D21B7FFAD0D021BBDA4BCE387E6
                                        SHA-512:DCE92A680E352903AF8F3722AD1FD54597064A82E33840BA5281CBA08F0A9794C8994AF8B4C048DBE3E22FCD55E7305CD4FD072B07D96256793FE06A3FE434C5
                                        Malicious:false
                                        Preview:.i'I[>.Y.m3...C.....^y1.{...ie.>L...t...f......0Y+.D.i.{DT..`)@..O.-U......o.c.>P..u.q......M*....In...\>.^.............{...a.Vx.....:Xq....1#\v.Y..{.....8..)..;..:]....O.b@....c....+..v....*B....b..9..|t`.Pf..L.....+....z#.}Q.%.!.;+.....#6W...Q%...%A. ....J..2+.....c..._..;%^h].....U.w..mx....i.Gg4..:.).*(...G....g...0..'..6%]t.Se.......}....*."...SS.{....../}..}..g..............[.G..!.:..'.1..4...^.W...k......"1L....../.....sA.+@eg?~....a.S^.....h1..gio..?i~.gG.......07..k....-2.8$.v.N.........@..e..!n...^.EC-"....e.k4f..$/.....r+..T...".WI..H.a........7.q.@S.P.\..<..D...w=..q.....Z..T..<...1aN....\'T.. E&l.)!K?.../...h....0i-.N..H.[...w..:z.d....;N..,V.o.....^.f.....V..(.......*8..).........G.G......`...r.l_Ak.B..q.h....h.]....p>.5....b..z .....7.."...T.^cU.W.|$..o..z'..Q.....@....N.a..^.".;.3..l..k....s3#....U.l0.h).*`FU;..!.....>B.w.....6.Ckk.Q.*......0....................S....>....ue._.K{.....re...>...!.K....(.....5gj..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):253
                                        Entropy (8bit):7.21847508456559
                                        Encrypted:false
                                        SSDEEP:6:ewC6oZskpjjXD7aPE/hje952lItGIUCKcpqKsM:ew8ykpjveMgX220IAuTsM
                                        MD5:8694DEFC603E1F2E7B78DB0A08FDDE87
                                        SHA1:A9B72CC43D21CC17D0661C1ECBB3DE853241517D
                                        SHA-256:483F2D18CCD7D54D64E9D3DFE0A47B28D1241A3FA57C799A65E0AE6934B6D57A
                                        SHA-512:5DF27AAB94D1CE1442EF194FDA6739C3897DDFF0FADF122198F26FB962BF7E37A8C7D251F1892CD8F6492400EAB9879EE0A887204E44DCF79F8E73C7BA165AD0
                                        Malicious:false
                                        Preview:.t...v..._..4WW.........u.G.v/.:...U|PJH...},.=.0x...>F(...o.......3by...6..O........;.5K.~........0q...q.wz..:...[_.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):291
                                        Entropy (8bit):7.273200150525164
                                        Encrypted:false
                                        SSDEEP:6:/I9P9FiIHOY3ZisXVdkUCq2mH5Bn/qIeS6Dihje952lItGIUCKcpqKsM:SiIHOY3csXVybqBnReJBX220IAuTsM
                                        MD5:0A020FD6F33DBA64681045E1D24238F0
                                        SHA1:4EA1A06A0DBE4980095609CAB6E91EE754640429
                                        SHA-256:9EFAC0507B613AC47686103116ED3699AF5A4053F2C49972F1901F4A25C144AA
                                        SHA-512:5754E84DE7A277A826A72FA817BB735F58E635FDD11015721BC392A04DD4B202E32018B3CA3C7E4E358258AA587D5B0A82EB932E7DF9F4530B164B1498B2628C
                                        Malicious:false
                                        Preview:.S.{L.......+.<.>w......`=.....J........:%...u.G.vg.0...Y.E#..eu.1.%.0x...>.~......MR.k$....Z. @&CD...C.#.H....\T@...~.A..l........C^.9....S.l/...@w.m.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):253
                                        Entropy (8bit):7.196302592571769
                                        Encrypted:false
                                        SSDEEP:6:t5vhxv3ZszocoLCjQEuepWjYhje952lItGIUCKcpqKsM:LvhB3ysLzvX220IAuTsM
                                        MD5:048CF62EE53EA0718E20B986941E33FF
                                        SHA1:48FCB0BDA658DDF281E61C2D8A0C8947C2B65E86
                                        SHA-256:282B914A1FF0DF2CACCE3DCED813D04B639F563A685D50711637FF5818782FDB
                                        SHA-512:7F3C47AAC8DFA2EE93499B83DA0D3FB7BB2984E157AA8881DB2C4600B80DFE207380376FC3923AB5F16DED2F713D07BEFF26209FC4F9C07CF416CDC3A22C8A9E
                                        Malicious:false
                                        Preview:...B.R.2.<.d9.N1.],..}.u.G.v/.:...U|PJH...},.=.0x...>...Bw..].\./p...f..c...;9..@..E..J>.A.6,.?......83..o..h.@^.gB_.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):519
                                        Entropy (8bit):7.633670625531809
                                        Encrypted:false
                                        SSDEEP:12:QciEQ3xJoRgefHgEpyv5xdmZ0T8X220IAuTsM:DlbvZpiBvIX2oT7
                                        MD5:822D8343CA16083C45AB1949C3B96A4D
                                        SHA1:5E5450B9D727128B8A543DFC8248951B40AAECEB
                                        SHA-256:6292FD5885D4CBB34A0670F6D6930C7CB43D17A09C839BD8C6D4B4EB7C95DA83
                                        SHA-512:BA60C5CBB46EC395E483AE98E2F465364E5823DEBE4BF378274C47C9F7B1B5BC4D1AE0FB14DFDB4EDE7E3B1AF75C78ECE1691376C95BE886004164AE623B4712
                                        Malicious:false
                                        Preview:.S..c9jI.\....S....X........1..L.......XHE..b3.".._...m7.t..7f]*.YR..A.u|.BY#:P....,3..!..8.. ..p...o..&.|..n...Z..z.S..u.EM...8.4.=V.M..)..<.m..~U;6.Z....z.Y...pl.N^...}...I..I3...I\.gy...c.:.&.".<.Bq...+FG....E*.g......d~.7SQt........L..BW..r........:......Z.G(...rj.*.....Y....u.G.w.PBN..U#PJH...},.=.0x...\/..s.p...@@.r`N....7... /...0o.IT.F.....B.....8Z.!..#.+[.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):527
                                        Entropy (8bit):7.618953213936464
                                        Encrypted:false
                                        SSDEEP:12:nnHv/lTmuqy/aIdwTbdE2og9qSlf8DX220IAuTsM:Hv/lTrqyJw3S8xf8DX2oT7
                                        MD5:1F3DC592F5C0EB66529D58A19964C2C8
                                        SHA1:E5981B2B3635CD99CA06C1ABAF204136B33785E6
                                        SHA-256:2317341F87FAB15716AF63AAE27CAB1B56A8325961ED8A9431F164601B882DAA
                                        SHA-512:38C9681469C3BEA2A8470E74D0238D063DCE24E2987C0A1667FD3BF46806DA304C51F71D09470B5370F54D0BD03E8DBDCD6AC1AD9C424DE3ABADEA8B95E8008C
                                        Malicious:false
                                        Preview:.%y..W....<c...d....c.j*&.K..k...H.z..'R...|_.W.....+..zfm%..z....,.<...<8..1..k....+..L.;X..CT....c.e.6...*D....b.S8y......)..K+....+W...(..:..I_u33=..6.A-...B.6.50.a............X`.M..f....=...@.U.....\...5r.enD....x...t.Z.........:....3.....|.|r..$.....x..xO..,a.(+v-y3..X.a)..u.G.vd.-.v{1..HH...}~.>.0x...>.~...Q...+*.GIR".).]g:sLO..lM...Lv..S.:2w.?.ELH....y..4........ c.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):248
                                        Entropy (8bit):7.125212540068561
                                        Encrypted:false
                                        SSDEEP:6:vHrIZD8Vy/zidwlrlt1HlThje952lItGIUCKcpqKsM:Pr8zidet1HKX220IAuTsM
                                        MD5:50F8850E6E36379B5D0EE6D7B88A308D
                                        SHA1:2E349BDC7DCFC901F93E1A84F52714E74858BE7E
                                        SHA-256:462D820AC9C8F7F80B07BBDA6BCBC954B2CD43DA1A0A9D6031BB3DBFDE4E18D6
                                        SHA-512:C04521B3F671AD1CE071D9D627D0BAA362B69FA541403AA6FE5F6B20B6F55D1FFDCE21604028CA88B4B13796F4EB58819E1A290AB08473469622023C80BD53C1
                                        Malicious:false
                                        Preview:.|..2......%'..u.G.XO.L...NsPJX.../,.>.0{...=.~..M...n..T..|..'jEU....w.......J.H.........><tL.........\I.b.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):560
                                        Entropy (8bit):7.65399141199852
                                        Encrypted:false
                                        SSDEEP:12:1oIE0IPMvMN3ocMs9W3jjCMqCJ4w2vn6cg6D8L38X220IAuTsM:LE0IMEVoFRTLqfP6cuoX2oT7
                                        MD5:4C6828D703FEAB8677BEF773693B23DE
                                        SHA1:28E28DB874DA2CD63E04C786FF1CAEEAE3509993
                                        SHA-256:7856B479F7F950BC207C519074FB2118165789C2798A49976A5C1A66D99FB366
                                        SHA-512:9662341EEA5712DD9023F5A715D5E5992CC2BA33A98E38E4B9025503063CEA223A598DBD6E8A8C156628B8657161DD4C12681929B126CD616059B39C9DB77536
                                        Malicious:false
                                        Preview:+-.Wxl.....;.<.2...8\.....-......]...z[n4f.....qv>..b.,.F.}#...C"....o......P..;/.J=...AK.V#..(bt...u$F.....xhd.@h..f.....cQU...)K.)`.N.(..8..k\..F.W....\..M.M.J.l.jf.uD..).{`..?........K6..S...:..v.u..6..7ib'....?ibf..J..(.`B...5..0.V_l.5.W..._Bc.%..F....b...g..W....8..hQ%.:...z..........t.....E..$..xH....^../Dw....>6..u.G.w.PBN..U#PJH...},.=.0x..v.....v.%...|..%.;....Z.....+.._.....2..!..X.......JJ.a....[.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):568
                                        Entropy (8bit):7.650503344255461
                                        Encrypted:false
                                        SSDEEP:12:An5X+aBDZieiVuLkHffWOBx9y3WMrL7hq5tQX220IAuTsM:An5XpdZietQ/fWcEatQX2oT7
                                        MD5:6D0BD8FBBCEF89AB96DA16E32B49DB43
                                        SHA1:232274A319B76D74F652DDB58157F78CB331B28B
                                        SHA-256:598A1AB73C9E1CDAB4CDA36A1B7ECD387B9A87F432E5A4D85380D5EB6F4147A5
                                        SHA-512:9979154AD42506475EEEA6E5CB29C18EE4B2310D4E5BBAB336BFBFFF06228DBD1E66A05E0195FC27AFEA0C10163578E7DA96E0411BB82D7A041E3B39513C04EE
                                        Malicious:false
                                        Preview:{.I.>-..7.q..d......V.E~...h....IYW....hx.....x.....J.!=.G<.3.R!......CM%1..*..A..g.-I..H@....mH..t....ZZ8...f?....l<N.....L.r..H$?...H.H...c...h.Q.z.)@.P.Z`.KV.s.....^.....kc.).]A.W.O....I.=.......,.....>Yp....X..w...Y...kXq.|......t&5..........?.@...G.].n#....E.....8..:&f..U.... .....Q.L...p..H.Q7d....i..(...TA.u.G.vd.-.v{1..HH...}~.>.0x...>.~...$._5.M^KD.O.H...]..Rv....o.%w|....T.>d.=.........u]..;j@..c.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:68K BCS executable
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):7.314506465422369
                                        Encrypted:false
                                        SSDEEP:6:ALeoE3AhnCqE7WcarZaUc11QjivThje952lItGIUCKcpqKsM:AqXAsqyWcarZazQjiEX220IAuTsM
                                        MD5:17604FC2BA2FDAAE0C1AC9875A021769
                                        SHA1:4AB55FF19E37BAEA365328A7BD07BD18964BE33E
                                        SHA-256:87F790BCD025B4BFF853839E06417EF374C365CA73DC802426B6CFD7B213BBC7
                                        SHA-512:9C95507552F33D30365FAF942B3960B7E3BF87C179F6588C7ED83AEBA3B0A5A8B4AC5E4BC1769E7803D625B56E15B3764CDB2FF32073284C7D5B2D1022611CC2
                                        Malicious:true
                                        Preview:.l..3r,.. .'.7|...D..i.L....C.Eje.m.H.u.G.v...._{....eE...\...0b...l.~......NQ.k....L.T.>j8|...R..o_.......E..gS0.....hdA.`..Aa.G./....{m..j.l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):731
                                        Entropy (8bit):7.730537081045614
                                        Encrypted:false
                                        SSDEEP:12:a/Ql8gD38jJj+pucxkcfz3gCEB7keyBM7cIXvceTXn/bVWJeW5Xx8X220IAuTsM:aYlJInqkqzwZpwMJbVI5Xx8X2oT7
                                        MD5:A6872907C6E01D56E76CEB4002B444AF
                                        SHA1:B50F297395C623D2AEFF70F92DBB5313AEE27385
                                        SHA-256:AD3261B87C740C12E74ACF085959F7D6E6E7A4F8ACE23FFD148A6F5CF504146F
                                        SHA-512:BFBC49D84FD7397CDD86EEFD07325F84A1C296308984840DFD15D7C5A633979AF1FACCA7436408ADF3EFF3E64550D236CA4D613882262E05C3A4821952204930
                                        Malicious:false
                                        Preview:.V@:.7KC^.%.1..O.?.EZ@5p....9.;!X..BhGl....Lp.M5...1...q9.z..,.V..L&h....8G.(...A..K.....g..&,D.O.....gg.K..u.d;....B.#m.m..2.....f....i...h4.Gjx*...H|BQ...q..[.C-....Z.....I.!{G%.4....e...{..]...NHW....m.9U...W..El..s...:kT...d....y..Z./gES......z.VP...;....}...Glg......$~4._...b...:.=....w..Sy#.4....\.[..8.n8y...'g..Sm..(..T......4.+.."QS..nWN.d.%...SD6.......Mz}..1.0....2......b.'6...x;.J._...PA.B3mJ.]a...6H2..~[....?........k.........4F.......3..a.....u.G.v+...J{'.5..E..S.....7t.>.~......MR.k$Zx\ $o........s.|U...9.<..%..@)...m... FZ.9......+..pn.....u....q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):7.270815553844273
                                        Encrypted:false
                                        SSDEEP:6:X6SNlickaXCqE7Wcarl7k5J9RwYgB5vBDcihje952lItGIUCKcpqKsM:X5NlickrqyWcarl7IR8rgVX220IAuTsM
                                        MD5:7DBC87F07E48875CF4C0DF6403232F0A
                                        SHA1:5F3645D5C82C3E42424D664A9AC393F6878BAC22
                                        SHA-256:56C1942C77A8816562B25BBF85035E762278389281C0C413D7CDF125A66C0C2E
                                        SHA-512:C48190571ADEDE52080FA60DFE258CF9E34D63DEC62901D32788158BDA63ECD0845CC1EFC2A9B85F7C3DD3BD1B83F0FC9F4A9D98EF24396806A49C64722A93B2
                                        Malicious:false
                                        Preview:....Ae..t..%P.7.J@z..s.i.t6U. .p.........u.G.v...._{....eE...\...0b...l.~......NQ.k0.~..%..s8.G...4....'.+...lkg......S.l.6w...-.......`X...._>Bl.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20712
                                        Entropy (8bit):7.990071932828405
                                        Encrypted:true
                                        SSDEEP:384:5GwZhsnOrf6I8S1Y47+I3dndAM6Su+2DPlhKV69mNVLJdKE1Mh4Hj9uTb1CXQVUG:EwZanOriw1EA0SuMJNp3KE1Mh4D4bpcM
                                        MD5:12F16A45F6E911DA2722AEE6F1C6B852
                                        SHA1:2B80658D20096A82615A4D7B79DA806B2094C16F
                                        SHA-256:B2A875481AE4BCDB67784D888BEBC8A76F36AB58BFA82ED71FA7CF6DE5428150
                                        SHA-512:B5F356969B2761B2A5D30F4660791438EADD59E9BE9148FC58629AB802845E0C484A8C56BF910E83B0F8D1334DDEFAFD5921A56BB3BFA0DD7E6051F8B5072E36
                                        Malicious:false
                                        Preview:~K...k....."..)k9[...[9.p....5u.0X.$....Z[W`.6..T...d...z...`./$@A......D.=.=...E.QT.J9......V..K.v.+...?.:@......2..*...C.P-.k..=..`.B..`['.+.(n&............,..9.O]KI......h)L..A.......=A..4........wD.3..|.\...(-..e.E..n.Z..h.@....#..7..M...i.....y..s]...}w"..4.o.g....j...*......W..#K..<q.rF...2?#..Y.B+:.se.....0r..........*..P...T=..C...:....7...~|..oA.}|R.4.N.5...Y.}..SX.H.Z......e.xb.f${$...$.....r....UTh./..$g...V....H`s...KY*Pb.7..{..#.}...d..h...c!Wj/=TP.8&..F.-..Oa..d?..,......./..,..>.PQ\. ..-&z<3.oXE..\!...=X......a../....*W...........9..SW..;=..9...f.C..<..%-N.,0......kgk(..J.....Ftw=}..y.(.AZ+..y.3....;.d.CE.....%........M.a..b[.#..$..H.5...5SDP..8y..S.d..h.'}.._....u...&Un..SF:)...S?.......M.G.n..\...j.......K......-......n`.........7mE."e..s....q....E\.%pDn....U..9r....f.Q.J..S.$;/zu...........p}..2...Ip!...[...k+E..l.N..z.X...O...f..WCq...2B..}......"..U.Y3b..]xx...e.m`.z..T.'.`m...p.j...."F..............i...6.D.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):763
                                        Entropy (8bit):7.7375536219326415
                                        Encrypted:false
                                        SSDEEP:12:Mb5jwRjsvPHOCSn1RJ8zPx2nvAnbOeRvJ5YH2cPVswRKfB+0FjX220IAuTsM:Y56jouCAAPx2nMVhYH4wRMnZX2oT7
                                        MD5:19336B212D7D596A8A06300E58716C5A
                                        SHA1:CC2E83BC420EE8A99FFC194E9794FDAAF8CF5B57
                                        SHA-256:A33B41A9BB05C2651828B34321B3EB4FA6D0EDEE36A3D14575D9D2DEE42E64B2
                                        SHA-512:21370642FA7C609459FCC2E5A92EC7F1C2EA514CE1ACD404EF88F0B7C243A982171CAB0944A7E7796FDFD1FAC5B840E263F9912B7C20C68427B8AE858BC08BAF
                                        Malicious:false
                                        Preview:T.gl.B.............~....CV.....>..'G.#.^.P..x.V.H[.'A....,]. ]....Qu.p.!p..P3.g.....e_....%......@... ..c..%....n...@c.>...TR.\.Cc.S.....{...;.}..1.!...N..6...Y&.|g-8...f~.%4t.h+.......i.wk.v..u....\.7..K.....A.V.dv.w..t..\f6....$...:V....E... e}...g...~w^..W.u...JN.q..%.\.h.u......].q\....)m...gM.8..L..i...d...Rvb..Q.r%..UC.F.j.).s.....{.o._..+a..\#a.Vk.w.E.R......Y}......J.<..j.....C8i.b.Z_.&C3......"..J?.]..+.E.&G.w.S......Q.zR...Sy....!{..T..s...ui+...3.|.....u!e.U....J:F_..`...u.G.v=.-.h{>.p..|.....Da.....T...n...MQ.9$Yx\ Q*BW?.T0.C..>.c.)F...&%.Q...n..0BgT.....~...'..IRxR{.. X.....r....2y.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37113
                                        Entropy (8bit):7.995189763205874
                                        Encrypted:true
                                        SSDEEP:768:dlH3x1w12tQU1B7oQwiBQqbqXhRXC/k9FmrrqJCmUqxBgTBRGZ:dN3fG2VDUQfBPkS2krxmUqE1RGZ
                                        MD5:69824A7962172291D34AB27FC29EF50F
                                        SHA1:806D3283DAE3E3E6964DB8A288F6A5BEF8D66881
                                        SHA-256:B2498A5CFE20DFEF633599A1D3D8510C403ED6FF79BB259674008A30E055E630
                                        SHA-512:7FF31229F33047E794A0F9F2A855FC3F78D5081F9D2EE9DC0FEC8B71C0A4AF03C0F9AB738A86D38E57DEA845BAB7274B76847F194A41BA9F513321AD775736D2
                                        Malicious:false
                                        Preview:....1|...............~....y"E.j..C?.....0........f..c........T<.'............D..A..%7.a..h... R...-....z..f..i..M.=...(..~...j..4....&j.3N..T......gu.R..O....9.@kvP>.).C7...mjED......BS.0g...,.#.E.!...DS5...\..Z....Y..#D-....3..`Cd.T.k...........r.`.........C!.i........!..N.......a`..A.......Y..F,.....D............hv..A$.T.i..jB...?+....H.M..-...|.p... j...;} 5..?.&...G.e...........Gv..........#.f......a.i..\..l..N./...:....G.)t.F..Me.~`.`...Z....&..B9.E~._..y.\.?.k.!JJ..$I._.OR.....u..s.........09MRI$...a...kJ..K!.....T..yO..5Y..T_q.....u...$*....P...}...~.`J...]...1.!T....GnNl7..{...j{.. .....Y...!.\").n..%.oi.....5.....w.n.G.0N4...N...p.....iy.a'....=j8m.QK..-.NW....+.h4..L..^h;o!..#z..@...M}.....F..C....2.,Cd... .u.....M.1)^)?.`Ej...$.W|.9.(.....\01..rU...d..............f.....6..A.......%..i..$....\....a..(......&.3v.e.h4..c+d.*KW%H.kK...).....x8.n.:.ox(;.....r.n...c..}..E..%n...%...c..|....k..W~J.$np:....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):3846
                                        Entropy (8bit):7.952551931088771
                                        Encrypted:false
                                        SSDEEP:96:IqWq3OO4Xv7Bz02HhddTQXKJxle3qNQqNMi7:IqW2OO4Xv79h3TQXKXH
                                        MD5:F475A1D8D8D343FFBA48BEF2B1E66D8E
                                        SHA1:EF3DA185378F4E47ACCAD587323D077C0BA12DF1
                                        SHA-256:9625A43573015068AE6796CBD572A65586BC246E7E1D9A9E64237900E1341267
                                        SHA-512:B0AF7C96CB74E21934452B5BC323CF95907B143C194AF31AC17AE5E51D34C3F457252067B8FF03BC8C3277F124CD1ECBA5875AC145D571E82D9DACA1FD1AE4DF
                                        Malicious:false
                                        Preview:n..aXK.J...[.........whm....W..6.....mA}.0......#.......U"Kvl..?...2...9}..#.. .....]..?......th....>.D.Fe.,:.vWb]#.@.M..j\.8..A.z.....0bE+N...!...@..L.....*..Rk.3'g.D.aK..#.3a..#.E].P...Z..).p.F....A....N..@A.a1.oaE....8.9j9...0...............zs:.2.ct.!..ca.w.U.<:.n...X2i.`.c...n.&..8.F'|...p_.9..Bz.........-P..?..(..7.3.;.y4p..C..[.i.&n%_..'..?&.M..Z.6R.E..yC7{E..]...U.$Oi.U/./..L..z.....|1....hz....i........t..<..?.H|v.M.............pXI.0{Bn..ap{...6}...J.).O;........-..y..G..;......[2...).#...e..@..{J....OK..Fl.]-~dZ^R.\...\..:U).....x..J|.!7.e.2....)..0..w...=CZ.o}.d.....]..:l......L..(..]U..@.q)^...!2(R.S..Yk.....:...$.h.IZ..H.....Y+W.P....Sa<.~.<j......n....^.R..........D0n.2-.8......y0...yW...y!.....Q..0}im4...V/J.R7...U...Z...bd?...+BP.......?....$..ha?.<..i....\....'Rf._...6Us....X. ...|B!u.....2E.FlS....6.O.$J...kC.~...2.a.n..x..F..}.+.z.....G.U...).Y...j..&.=m.o... ..S.V.[..5..4.9.%p......5..L*..QZJ?....so..a.&..7t{wd.8t7..T
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):248
                                        Entropy (8bit):7.168579021932125
                                        Encrypted:false
                                        SSDEEP:6:wuh/JHrIZwjXdXZAz6nrhje952lItGIUCKcpqKsM:wuhhrrjAzxX220IAuTsM
                                        MD5:9B3BEBC217F12A7F760748E94DF903FC
                                        SHA1:E85A3CD027046528F5E0C7A40345295A07272B2E
                                        SHA-256:DDF8CF364D95CB91E6671D944A2B0D1685C7A272AA7B32593DA5E5FA334BA44B
                                        SHA-512:C08A94287290C355D3363D304D59C169C598EC16CF945B97DDA6B02F91F7A83A275179BC5954A7E8A312162AF548422F0923CBEED6EABD8E355E8555F41E043D
                                        Malicious:false
                                        Preview:.5.@...(......u.G.XO.L...NsPJX.../,.>.0{...=.~..)X...D......V4..(.E..!..].....d.'h.>...,R.Go}...H%b:...#.^b.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):548
                                        Entropy (8bit):7.5824332319199295
                                        Encrypted:false
                                        SSDEEP:12:mP+ULLjoVLBiFaqu+BeI8xMeN6pXdoIqbGt/pVX8cX220IAuTsM:D1URu+XO6pNEbGt/3NX2oT7
                                        MD5:3F2A53CB000CDA43E18949CFF036885B
                                        SHA1:22062BBFAF8A14D9DCB46BC0EDCEB66E5544C5D0
                                        SHA-256:85741CB4D803E5743F77111DB015579CB7C1EBA693F52F36D965423031212D2A
                                        SHA-512:8C7CE87D681D7A1FDAB4D4F3EEA8C7913FBE0F414931115ABD92BBB600E7726ACEAD0BF29A2CCF532755F41260565CA3E82757B6BB679799D157C8F4169862B7
                                        Malicious:false
                                        Preview:....n`3...G...z-.v.......|...}.1...n.."O.r.A..[g...b2?../.GJ.h...V......J..R...%K...>TV.....l.7Y*.qy.5{..U..4....E...Gm.P.3u..L....P..].....g....T....a..8..B.....v8.0.~=.-3u.t.&>.8}....@.....'.w.2^b.~....@@..d..wB.-Y(.Fi.X.e{.H..P...Y.x.Y!...Bc..,..<.....<.c .]}0~.....(.G.w@..E..%.y>..s..x$^U..@...#...h4.u.G.w.PBN..U#PJH...},.=.0x(O._.cV_16....h@....b....0......U*.K.0.$.e.....O..,.d 5..U...5.[.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):556
                                        Entropy (8bit):7.642828742989764
                                        Encrypted:false
                                        SSDEEP:12:cmjrbxhIGB7BaUJDYK+56mAvUB3X220IAuTsM:ccXxeGNUUxyAcB3X2oT7
                                        MD5:FBE4365196D996B4E7B65BDEB98BEB8D
                                        SHA1:EA94A8636E2EAF7FC7B21CC55895B0784AA3BAFB
                                        SHA-256:AB964BA395BA7B5C23CE282FE0874AC730E0C01C131B9DBD221E75899CC82A10
                                        SHA-512:14AC50D8EA0B8A4D1801726E4FEBB686777BE9A7A1A165D4CE026ECB4F4577A29EDE61C4EBD89F469CADFB929A97B2D2390272C74020FBCC3E11E64BFBA0925E
                                        Malicious:false
                                        Preview:.}...z&.....L"_zn..X....,_..o.3.).8....0.U.PcJ..?../.....M..\K!O...@.c..DM`t......}.=wM..0?ize.A...-W4...._(F...{.`./U..E0....JJ.@....4.O.+...hA.n_.....7...vv.@tW.Yx..?.l.~{..H...FWH.......u.a..[.4Jxc.....j...V#...ru...........Y.Z.......(Y+.[..Yo0........+.o#..jD4.M...).`....m....L..`.+wP......si.O..u.G.vd.-.v{1..HH...}~.>.0x...>.~..v..[].,.V.u...p?...;`.1.......1+F..aU.*.'....#.....l.....:-d.bc.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):7.211381564203163
                                        Encrypted:false
                                        SSDEEP:6:+Karw1oxtfCqE7WcarSO8mqhQXTNM3Rhje952lItGIUCKcpqKsM:+w1AtqqyWcarDt/jK3+X220IAuTsM
                                        MD5:9F4B20250585DAB1B972BC4D89BAB90C
                                        SHA1:2D07CCBACCBABD8B778EFC37B4C27166337A63B7
                                        SHA-256:E5D8B8DB0E0DA61E7E9D7380FFD56D414FA711A599332177E1B56FECEA3FC8E1
                                        SHA-512:3A74CDAF6D64E137A06F1AE33EA0AC6C3443BD9430488517858BE99FAF9F7D303280A4351397485D7F86D45E10736DDE7D2E33BAAE2762499DC8B8DDA04A8F6A
                                        Malicious:false
                                        Preview:..,vr....2/.p.0..V.#...DpB....NHw...Q..t.u.G.v...._{....eE...\...0b...l.~......NQ.k.AS.~.Y.....2O.D7#0.:}4......$.W$../.6g.Pl;...I"..2.fv..wTE.l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):131313
                                        Entropy (8bit):7.998712122615488
                                        Encrypted:true
                                        SSDEEP:3072:BWt3Sg84VcBFb+g85xYrgVjI4M9/ezAKTJ2AAdV:yp8f1cUHZxKTJzW
                                        MD5:44F39AD7F3AF133CA3A6A41BEF809418
                                        SHA1:BF352CA0EEAC8CFFC0ACD9FB5110B73D9B2A97B7
                                        SHA-256:20D0AB1097D1899B17F9A7986FBFA67FBE8789F919594401F3EDB0763F47F517
                                        SHA-512:435E65D5202A0B3BBC085E8CF95D4615391C6D776B1B317DA9497D5E98CF18293124D6DDAF5A87840D903DE7239A87FF7FC12C6FB7F52B8CD84C199048567A35
                                        Malicious:false
                                        Preview:..a../TU...p....i....=.B..../;......A.C....T`....83,..6.}6.D.s.,-0...P.Pg...r+.[ai-...V..S....g..b94..c..y....tQ..)%..\.../CAN..?ZvX....q...Sr]6.....Y.<4L.iF.."........ip0.V[......H..M...2..Md...$?.Mu..|P."..&......i.7...&QY......?z....r) hPqc...E.U..3.D.g.`,..;......W(.....,..._Cih...v.b....0.-..#...)..`....|....Mj..QI...Y.Z.........V.....'..Go.@..Bt..n.<....na......u'$.T.h.SC.9jq;.:};...x^.g...la......|...vh...I..u..;;y\.t-r}...IC...`..SG..s..y.j..V5|....(.a....M......t.0...0L..U.C@...a...T...t.,..,..9H.y.I....F..EF..H.|.S./..Di.c...<..`.;.7...4,....jsv%[....D....5..~..j.>.l.z.!x..>!...M.~.:c1.s....A<.Jh....p.u.:.$'..`4..i<.c.`.6.D....<"..PD...0..........n.....(...[.l..a...h....MMMp.<....L...k./.B.{..-.] M......V]P\}.....O-..Q.w#.]..._......f..^.%...S....Qu.W|.*d..!sQ"....^.b..`iK;.-.h..)...7@C`..E.,....ZUg......r.2....f.[.'....<3....].M..y<x4E.&.x.@..EJ....3. ..:.r9./......>......v.+.,x....8.Z\lC.f.5..."N...X...Nn..o....2.`.U].#4
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):287
                                        Entropy (8bit):7.285663503187507
                                        Encrypted:false
                                        SSDEEP:6:kI9UL6T4de3cyCCDMfYna4vBhje952lItGIUCKcpqKsM:AmT13cWgL8OX220IAuTsM
                                        MD5:2AFAB212CAA197E13B0843B43C13C93D
                                        SHA1:35E342B60DB3E85A6456A27FA74F4582006C0CA3
                                        SHA-256:225F06C62442386777C16332A1C18238C4C5B4AADDEAB5830F854D056AAB6B2C
                                        SHA-512:D71A55DCCE8CDBD327C0A81711C7DCCF40C86746214FD7E38ACE4326C463F37D5FCAB2E4957F0BB82B3513D45DEABBE6947A0F455EC9D80577D437DFB573123C
                                        Malicious:false
                                        Preview:....:U.mD]..%....Ld3q..TY\XN4h3.eC.......o)U.(.6....0.t..vd...u{2..HH...}~.>.0x...>.~..,.vo....rm./w....D9VHd... .d.^.:...<..K..?..z......f.....5.c.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):248
                                        Entropy (8bit):7.228074536053752
                                        Encrypted:false
                                        SSDEEP:6:HZIHrIZuZJbhzy1bMhje952lItGIUCKcpqKsM:HZcr3LlmbrX220IAuTsM
                                        MD5:FF327EB4235687C59EB40D54E4172ADC
                                        SHA1:FD0F0C444B4B55FB2960AA04A10652890A4108A0
                                        SHA-256:61CCE72B204451B942D592293D8DB29CA4D6159630FAFD987374FA9626B43C47
                                        SHA-512:2F596FFE56E221CC05AC66072BC9058EB4573131391BBC86B84C89DFECEFE199086DF7EE094C7F71E2EBEA24FF32636386DB6290B969AB4EE2A3C89A9C6724E6
                                        Malicious:false
                                        Preview:.\>.b.....5<.W...u.G.XO.L...NsPJX.../,.>.0{...=.~..ZuAqR...<,z9V.....~F..daP...7[.;...%y........zR(u...w...o"..b.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):510
                                        Entropy (8bit):7.593945492169034
                                        Encrypted:false
                                        SSDEEP:12:wxAcSldEx7OqJqIz69qwSJtvHSX220IAuTsM:wGcSl0HqIoIvyX2oT7
                                        MD5:D2D71EAFD82AD5305AE08745EB96AB7B
                                        SHA1:B2BA9E1D99D888025439B0381EE65E391F41D1DD
                                        SHA-256:8D089BF19BCB2679A5D7C1A15F523CB9B1F3096025C119FF21BE32CFB1DF840D
                                        SHA-512:C72397CF264D5454003C0277F158AE8B9D47406F2D29A07B0BB46E8900C6D0C7537BFEDC1CE44BC7DADD09FD201B5B06062E3D9F30974682087506E2A4830C9C
                                        Malicious:false
                                        Preview:..?...,"$...9....NhV.lH|B.......I.i<._.d...@p..X.5v7.",...$...b...E.t...8]...8'..k{..#..i.)(.`O"E.....X0....P..Ycn...]N.@..<h.z.^'.#...&.....2...$X.....s6.[3........s...L....WH.."m....P..t.2...Q!..-@..T...F;wz..=._.s..7..y!2..5..!H..>.F..q.lW.6.h...:.@...7..{m.......2....u.G.w.PBN..U#PJH...},.=.0x@..5..nW....fRQ|q...4d+eq.Y...m...N.-.".;h..BA.R.....Q<....^[.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key Version 4, Created Sun Sep 5 17:06:16 2004, Unknown Algorithm (0xc8)
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):7.264898338152729
                                        Encrypted:false
                                        SSDEEP:6:A+tUNNYWdsfnsTkCqE7WcarCivc5J8Im7hje952lItGIUCKcpqKsM:3UNNYnfyLqyWcarCQcvxX220IAuTsM
                                        MD5:C084441D5B1C6EC37924B10068CACAF2
                                        SHA1:065151893B3821DD7BE8DB9B916A708ABD8093CB
                                        SHA-256:F96D3537268DD83F21A4C11006ABBFAEB7A024862B664094A98E87F44AF5EECE
                                        SHA-512:DD497F7DBB298DB287C910D00E1CE8657D8CCDBC38298071C19DE8F58963C346EE580AF4B2C58A31D76E8874203BB81009AD8D207068234206B91439BABEA7D9
                                        Malicious:false
                                        Preview:.k.A;G..?..|9.sZ.W..I....K.A6.<z.!xI..,..u.G.v...._{....eE...\...0b...l.~......NQ.k.6.....m.`.xO...8.Un.....oN.S.!..k->8.....'.5..s$4..lj..$.?.Vi.l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):359
                                        Entropy (8bit):7.409536361088757
                                        Encrypted:false
                                        SSDEEP:6:XI694tUA42gKxtREdOvFHOM6d8R5H2YE9WYXbx1oc4Mihje952lItGIUCKcpqKsM:+tUqxjZdHOM9R5H2EYXVyc4MVX220IAw
                                        MD5:60BE62B30044A7EBBFE1E878A604B782
                                        SHA1:9B368DA8212AA8576730BF9A486040E2595CF922
                                        SHA-256:AB877C1A3FB38AE71B33B31A46D4AED90C9B0C0289F4D345670124767B8E1B06
                                        SHA-512:8CFB40636907D26AC5D47E63BDF0E58AB59A62E3FCC240ED1AA94522DB0AD92086EAB8C28C06568DE6BC38D98014C390DD4599CDCDDF6A392F87AF905AD2FFD3
                                        Malicious:false
                                        Preview:.D.....x.>Ol..9..J8.....d.....C.A....[.Y.c....[>la}.y.B&...}.&.?...U..l.~qQ~..R..a.n.."x_....`..+.q.6. Y..d............=.t..vd...u{2..HH...}~.>.0x...>.~..8U\...MH.e".p4.C.J,.=.#..d.)....?.$Fm3...][.m&X>KEeu....h...!c.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:DOS executable (COM, 0x8C-variant)
                                        Category:dropped
                                        Size (bytes):248
                                        Entropy (8bit):7.216966118706321
                                        Encrypted:false
                                        SSDEEP:6:cKvDwHrIZmVuy28eYRfZDhje952lItGIUCKcpqKsM:ar7yqRsX220IAuTsM
                                        MD5:35ADB86CEEB2F9EBCBEE387010E7AD40
                                        SHA1:190A270A6E70C869448CF9B35C817C7B580D49CA
                                        SHA-256:FE507F2049243B699D1D0A916097C9341D6158B1578E251E20C43E6B2A41F875
                                        SHA-512:3C871514486B40765D3D12794A18478E1164F5A5A97C1AADE25518A9EF70FDD004F2D60C4E5E45E002FF39E5F50C003EA20958331E81F0A39F829EC26682F447
                                        Malicious:true
                                        Preview:.-.,|gT.3.aj..i.u.G.XO.L...NsPJX.../,.>.0{...=.~.0pR.G<W..C...6}d....~`I;.^ ...F.......l..6..0(...+.......- b.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):528
                                        Entropy (8bit):7.60882641985095
                                        Encrypted:false
                                        SSDEEP:6:neSnWqeim+puFGgeQiS1Yzb/AodPKO2rfdOq3oB8OeLk1+nZJyA0+/IQab/hje9Z:eSnWqJmjbg2ROq33kQnZwuX220IAuTsM
                                        MD5:53966FDF6176F21EECC46ED6EF0F7290
                                        SHA1:4EBD816E5CEE17159DFA871C6570D7FF70AF2D8D
                                        SHA-256:08F995A183771A02D10502D10D499584D7DE3323A9A7A5C0B92A45914880009D
                                        SHA-512:06540F4874DA1CCD13D1386A5D0E25BFCD697201FA2989D7F919E2C6A2273404F0D9A792C00DB81B2AF9E8AD2CF1D5D4E4A1B1958EF401E796C205AFBEA6E524
                                        Malicious:false
                                        Preview:.L.....l...<~x..U.V\]Glb..<B3.qZy....)N..'.zz...g.8|..l...5.m..0.>..Z....8...................z.8.iX..H...%...D.V..}/...+..K...e......;.x..Df..t...I.t.4.M#B....h..a.x. ...........*.............3u....E.dI..'..G[.&.........."..........+[....6.s.].H..Nt.....2.".yP2e...w.6...|e...)dZ.zs$&.xm%.u.G.w.PBN..U#PJH...},.=.0xBZ..'.F.{..$9..eA..B..E....zB...;GQ.".V>9..w.+ .Q..p/.im.."[.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):7.234897543115017
                                        Encrypted:false
                                        SSDEEP:6:3pWACqE7Wcarp6poBD2nlM2vu6mlhje952lItGIUCKcpqKsM:ZMqyWcarpkoBD2xvu6rX220IAuTsM
                                        MD5:ACCBBA20966340E16F0D00616A682460
                                        SHA1:3F45DAB1800455A4BE162FDE2EFDFD14B4B3992C
                                        SHA-256:ECE6DA9A45A0D1D56B261524F383EC38B2589BDFC4F9C110F221FFF2C2B18CEE
                                        SHA-512:336FD305C65FE19267C9D575AEBC127056E2E367C79CEA3DBBDAF9E2056B04E6E8294E334982A8F89B560F31552A830C43C8EF4C69409F326E0026348769307F
                                        Malicious:false
                                        Preview:...Cs"R>..M..=..Gt.,Yp.r..I.d.5....nL..u.G.v...._{....eE...\...0b...l.~......NQ.k.......@....Lm....m.B....)..C.z\s.Npn...[.@).ja...z.^.0..M..rl.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):24819
                                        Entropy (8bit):7.991770668297908
                                        Encrypted:true
                                        SSDEEP:384:B4R4AHNK7oDY3xim9V80dosQWrD9wA1Ys2CxvbpmJzQ6Sts078Zcvg0+uUqJ:qFKJkm9V8Eos939wAttbwbST7zvZUqJ
                                        MD5:71F94D066AF54D58A65861100A1820F9
                                        SHA1:1FAD864EE5224A87F9187B74538D67199DC7EE45
                                        SHA-256:4A1B61DF2882BF8C4735F958A6A6CA219E502CF4380888E48186907E78F0A422
                                        SHA-512:7061A9C998C323CA63AA1818DBA880ADD9D676074905BE6DE28DA230E610C2359D199A92AE7EE6DEC67420643C445B5E47C5E4F893BF42EB33B376A4FCEB752A
                                        Malicious:true
                                        Preview:.'u...........a,K9......p.^<DG........,..L.~.^@U.5....k}....exN^..I..-H.hc).b..\...o......H..\....l.....|..(Ba.._isIV.\.a.!..Vy..._..k.IM..iTd.x.@...).y.+b..h..7...N.BQ.Dl.Nn.....2..E.x...+/gX.,.C......k.4..h.._...F.Q..T.<.^{.$s.#T<.#....[....Q.$`.V..3<.thK.2k.C...U..E..K......#......rW?.D8.. ..&.'kz(.`.g..v..BJg......0..Z.".v....MJ..l.#z.Jy..43.....e..&B.1.# .j..5....Vw.19.....H.B.id.....m.O...#k._...3......W.~L..e=.a.D.....*.mU.!C.g. \...../...2i...3....x.k..5Y...;...Y...^.#YL...H...x..j2.l...V..k&.i3N....Y...D..(.d..LZVE.v_....J__['X....O-..Q...Z.n........ V3.68X..4..?5sF..B.k.};(.c.|....z..iJei..hZ.yl......<A..8.y.h...n....O#.9..-(.._..O........O...c^`C.'...O.....3....T...Z..H.Y..*.....DT$...{....2...t=....J..[2..z...\.]h...Pf,....?......S.[....^a.UF...?........2'?R.p.+....._.-.g-h\.e.4.W^.....ita....{q...H.-.-.zP\..<..4......9!.t...3. ..W.L.^...C...z..j...^7..dmE.z.^..Rs..Z..B.....W8X.,.B2.....(..d..u....*..;...`.R$..E......H..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):57582
                                        Entropy (8bit):7.997077156851446
                                        Encrypted:true
                                        SSDEEP:1536:/RNzK6oGDBUV2P2o8EGu2xyhpwdN4nj6G/2gZyg:/PxBUgP2VTuiyhOd++XgZyg
                                        MD5:1CCAE4FA993D4FF06876FF9B42187E0C
                                        SHA1:7F135DE09371A7D2C4F1F10068BB3A4EE0D73CAB
                                        SHA-256:2686EB7C2107E475292A03E2E789E4C19A7E420FF16F76DE5C4839BAFC0A29CB
                                        SHA-512:CB128AC485EFAF375D60CCF896758760A3349B8ADB74DEA21394E723E3B46EE1A4FD0D0CCDE6366E2672562CB03A659E8B17851904F089BA5E0B11EE4A48D88A
                                        Malicious:true
                                        Preview:...p.n.u...rF^..N...!..+^=.bD.6....cD..A{.Mv..L.n.G.Bv%.....tyi...#6....}.|1.0.g.KV...:=.H.t..7.!.u....gz)...k.T....3QK.D)-..Q/K.cH..)/.eG.%...Z..8.VL..".A5.....+./.T.....Vu.(......0..Y#.vF...'.....H..Wr*Lu..(.".n.....S...f.....%....P.U..k.2..R...p.-..;U9..o.(I...C..]~^.&..w).....|.#..O....*`...C....J.:r..Qf4k.6.U.1."..5..e.4.......yK%..C...^.,S0k.;..Gw@.;..a..g^.{.3...g..v.....f.K........`S.x..(....^?..>..:Nj...Q.wk....S+....8.o..D`..&@q,.....0.....Fr]..|}......../..f~...~Q.um.#o.._..?.rF.7.Qml..hw1..&.<.I{..;3.Z!#T..anI..Q.._@...,...~.F4h.^.J-.....T_..h......]...`.tY...#..ubm.fG.4......<G...R|P.u....=J.w(..f.R...6....cl...M...L,t..$.........'..~Q..;G.C"...5..h...r..uxN....@..Y.\..~.o.)..0&;k...3..SZ...7..$.K.;.C.......$...`.Z@..{.s...gPRj@..z....t.|=2..v.X.65...#.[.H.....k.Ihm&.5b..~.v[.'a1.4.........5c.........&\..d.[...U....l..)....).".;....E..,.....3.d$>=..v........./.42.fy...8..<Y.:..-.....C.%?..j.(.3.....0~!P..bb.BcWD.<.g.$..T..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):239
                                        Entropy (8bit):7.215454517068107
                                        Encrypted:false
                                        SSDEEP:6:Soq/R32Ll/D13Tihje952lItGIUCKcpqKsM:emT3TVX220IAuTsM
                                        MD5:DBC7B761F0C7A0B810B3B7E2FD60DC29
                                        SHA1:3814829BDBCEDA659D5DCB70D9D0B25BD1987645
                                        SHA-256:39E50ED370B1BD4F7C22750D13F7293B8D13C4F2C3CEC3F1C8D9E2F5551712B6
                                        SHA-512:A1728160D8F249C40FE20EC7114240CE3172DF91B74CAB10F58AF082117140214129BACAD88CAB2F60BDF5ECEFDDDE0AE9E5285A7A5A46D302A2E9DF763E4952
                                        Malicious:false
                                        Preview:.:...zi..u.G.v8.....5sPEH..C},.>.3x...>.~i..*.4.G...64.|.,..H..L...8.'...w.h.JdF.q..?...o.&P>5+.K..GMa.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):248
                                        Entropy (8bit):7.157470604584692
                                        Encrypted:false
                                        SSDEEP:6:y7UCJX8IHrIZT8b6AEwQFhje952lItGIUCKcpqKsM:0rHb33X220IAuTsM
                                        MD5:9F322876B372ECE67F5513E6BDDB0C6D
                                        SHA1:F7B49057C5FE9581A05E5190C1C96C00EA1EB9AF
                                        SHA-256:BE791843742E4018B9460D92E705D00209EE21396EE4247FE167856C35D0B56F
                                        SHA-512:1CF70F0E649A34F5ADC02F394AEA00846E8535D8D36840DB046CDAC06353400D57946A8D88E34D9610CC688CD48A92F6D718CB8D3E29909389D8B9AFC1B7D6E2
                                        Malicious:false
                                        Preview:a..L!o...{.I..4.u.G.XO.L...NsPJX.../,.>.0{...=.~..U..y.q@Wj...+....2s.Y.r~w.^.j...*p|.n..S.\.._..@.....(q.yw..b.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8422
                                        Entropy (8bit):7.976638349242779
                                        Encrypted:false
                                        SSDEEP:192:f0iMCN4R8dUzEiClU5jxmAa2AkRwcmtzAlyfyiz+XY:f0O6zEibxmAcWwcUMOyLo
                                        MD5:274BCAA7DC3A1B8FD39C498FAC7B361B
                                        SHA1:BBE04704BFCB8A304CE5A44E238E6D36567EE43C
                                        SHA-256:548F5A64B10BAFF0585F9F5D223D57E61219590E644DDB079E40D7764ADA1AE9
                                        SHA-512:CEFE6CCEB6BAA5213EB2C5C3388D30B61FE8AC3B71A76B62BACD69A3B9B01C600FF6812E9FAD63BA93BC31A9198D2D431830F025DAC3F58869CECFEB3F6A4C1A
                                        Malicious:false
                                        Preview:a1R..q@..Oh..3..ylC_Bj..F...+...(....,.&...*Z.'ur>..Lr8.J.g.._...hi.Db......O...8L..A[........aVW:"........Z)q[.W..N.,.....|.,D.(q...N.]._..........=."YQ.p.....fyt.f..p..G..d....B.LT.r..q.V.+s...!f.O..c.....D.;.....*....dhrCC.f.Y.jH....z..C...c.b....M.7..~Hj.6.r.Uo..!...q..<@....w.xq.....'..5M...Td.uMKu>J.............4..=/Q....(...;......rJ.n....Y9.......U..(..@....D`..wE...p4..3.>..P........m..R...23..%Q.\2...Q7=X,....2.2.b..$iM.}....^..X.....k..d......t..n.W..:1q..k9U.r...v.L.C.J9:.;.F.J...K[....@..R..s..z.3.}( ..(..!....!J....Z.g.U.x.........P.Z*,W..+.N,.F.Z..(?....j.Y.;p....V..q..<B.+..?_....z.v.[.R..L..i.A. #.....6.5........t......1...E.B......vN.C.QI..8...le..o...-N.......B...{xV$?...B4>%...}z...3.."|_.....;./....RP..=..._.b..4\L...{.......e.x[..!..)..~.7i...P...u._...=.@.ht5s^..D.. .!....h.N........!J>....U...!?......'jW~g...........mh..QH?e.k|.......hp5.0D71..o 1X.# X ...ob..,.S.y6=..=....I. ...._....B....B.)R.....y.M.4n~\j|..QdBY.......Mh^.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):270566
                                        Entropy (8bit):7.9992849895517475
                                        Encrypted:true
                                        SSDEEP:6144:W8QzrZiH7tEYKVnIPTCRfQDjcnruEGRSNIhNoj:WZrZ8LycC9QvcnruhSehNc
                                        MD5:22268DC8AD893B7DFA096B43CB6A7923
                                        SHA1:E62224B2576FB9AC9B3A32AD0B53E27F59C06367
                                        SHA-256:2C71A1E8AE235E5860CD4C649A9B5670CE3C52B96244E09C4BECD1CB961E1F85
                                        SHA-512:8AF86C15355F77A1F1045AA9D89B59B081C25297BA736C4E79BCE832C1313A5CD6945DDD5EC81DC74725AAC8C704190C7661814E093F9D1733F3DD080BC6001F
                                        Malicious:false
                                        Preview:..&....NJ...~.N..s..F......`....(..W.<(..phD.fF.....<{..O. m...\.E.`j7.^.......[.A..1]....}......B'$V..[..0....e.....|m.>J......(..dd!U...K.#..UHWPw...L...'0.m.|er...L)..}wXWO@.}F....z.J..b.=+.C,r.k....}l....}..*..@.A....p........1..U......I.-+Zy.9v^...'.....}.8......,._.Pm.m..".s./".. .+..?.L..B..)...=.n..p5...n...$.[...._.M.1..A":..P.z.DB\%.[....n....b$P....<.*..i........@5.....Q.[l..^.......5WA.a..k.m...%.f]....F.O...<...Ub.....d....4#..<...^..T\.&..F.A0n....^.b y..'..{..Y....|.d%.K.$..|..v........O:f.U.n1..'..!.....H..B.w,IFDL:..C...J.....-=...q.~.w....^{..}......#...'....-...Z............{.....=9l.K.S..r....i.`......v.5.....?@k.$.8T..*...........U.7.Z....@.cK..}Z.o..#.....i..l.....S.L.J@..$..pV..C9s..\.<L...qH.....P!P.sP..[.^..H..}..<q..a.yj-./8......q....~.K..1..e....S......b....}kz...fC.....u,H..l..!f.=k.R,.{.%.&.D..6...}>4.Q.i.zi...b.,..(.4.j.......:F .[.=k.\.)*.~."E...w...1....2..1..Ue....?F..j...L....a}....yC..H./~X'ee..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8422
                                        Entropy (8bit):7.979065165542839
                                        Encrypted:false
                                        SSDEEP:192:ju0CXynx/N5eamG4uF6Lh+UKcbs8ohcKfWnbLN2bjhs0faEt/:jAXyxHeamGSVzDKO3wbmOaEt/
                                        MD5:F19C4A689457C2A62AA7472B1B7443B8
                                        SHA1:774C6C84C59E58B3B9423AE6AB857A2BFB6C5B72
                                        SHA-256:BDC57752B42C6BD03253EEECF89450C667EEE00FF855969507A3B2252101DA5F
                                        SHA-512:64D285ABE3A354FD6FD0298F7C113A0F1A71DD9E3FB61DDAB1EB50798EA865619BFF55E9058D6A5D9EA5E1E75DC1CDC1AE6ED72A0546B148A7C0E2FCDCA9504E
                                        Malicious:false
                                        Preview:&..P.lM.....s!.....L......%..*..[..Q..........C..`.=K...E#7...G....<..Y4,..1.T}....g*..%...NF.`..e..V...H7Bfmd'...9....T.....`@..$....tP..V_@..x%......c.A..J.(..44........7..0"o..j..<.Q.D..E$.....z...{C...rz+..J..8Q..B..s....2N..Rq....o4...[<.Z:lp...._..V.<-.%q.q.^.....6.8..K.....7.G.+...@.......x.... b.)g)n...s..R......>.......m......P.;.m....H~....QU.[.,.8Bm...v..r..K[....C.'.a...o.,.a....1`.Ed.......G..-b].Ht.....1.K......|.....r...vy..q......j..t...m.I.n.{.....Q."K..$.d.7..G........I;...A.H;...e...#...".W6m...9........'..am...X.......... ....w.k&........e.|..O{.n....%P.3.......)......zR..'....Z.!..j@.w...[T.SIF..sB.....o..<i.oM.h..k....).)..CB)R..=...K..]%..D. .`0...Te......."2..M...L.M..z.jgnr..vM.../.q...2....4.D<.uJ...)Y..`I}.....;..q.=...ps.....4.}...~EH..e.:.!.E.|7.xl....w..R.T>.M......v.>.M=z...:A=.z...O.T@..^.(...D.N..M...cVEo...a......3!...n.o{....Rm2......L'.`.bA.W".v.a"..1:&......eA.A.@]0%k....a....5.u......G.(m...._~..k...dI.#...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8422
                                        Entropy (8bit):7.977401318788357
                                        Encrypted:false
                                        SSDEEP:192:NeRvapAcL4qpOt9svscIc3WiQ5VhbHaMfEpWGI3+fw:MRvIfp8s3Ic3QRbHffEIGI3+fw
                                        MD5:B0CB7E1BEA24F3066E23153B2FA3A0E8
                                        SHA1:7F9D3FB7BD162616BAC71B963E419512B7241017
                                        SHA-256:7925C1B3A2CEB5B2163B1C000DECC84B15230BA051A92660E7E2220B2193098C
                                        SHA-512:D70FB813B5731560D80850FB8D9C1DE5BFF69516A170A65742D40086EFC712DA80F7B2C7C52AB6D1C1FCEA32F3F5F30E394371D6C3EFB7FA43F522CA60DFC04C
                                        Malicious:false
                                        Preview:.%:.....,.s.OV.>..a...u..(...S.j ..u....R..X..R.AxfW9.....n>.....#...=.?Nu.Z^.NeYhJ.|...|.....8un$..p....93i.h....[...R..7(.W.t............~...{.....@...U@.8l..Y.t.].......E).T...Iutb..~.Uh2..I.H."....]Q...K....e..cS.`..`....cQ.D......>...."P.Z.)e.X.-.5.nTom@..=.Yq..G..g.V...?S+.\..-B..0....E.6.Y...J.O.B..H.Q..Us......C.V\d...3.$...M\F....2mriy..znl.9.......i..;...yS^9../X.]t.9.:O...5.a..J..%..JZ.m..)*..0Y..d..j"A..N.@.G.....cV.n..Q.. '......-.#...[.8-....M.'.#..De.].%.:.....nk[../:.%....X....P.?A..Zp...n...].?..^./.N.JUSm...x+..M.;.EC....~...[...p..........)=......]..q...X>..Z.,...l.tI.v.....#.-W..YJI_..h.{sm....p...w.I.(.JDa......k....H!..Ou...$?......3>.;b......J..?.A.....U.i^y#..8.:.9..C......+..Hi......1..>*p.P....@K..=1K{f.p..D..rt..uC.O...#/...s,.c7..mWi........'........k(Hy>...D.V....n.w.53ZD7H..f..l..w...byD.Ba.!.......!..?../3.......et...E.......),.....E?.I..?pB1.i6.......v...(.Y.vD....b.nS.\]....+'#.`...i+4.1g..o....|..M.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):262741
                                        Entropy (8bit):7.999275457822652
                                        Encrypted:true
                                        SSDEEP:6144:Le4yl3XVPxNjma3TN9cMPJ5NMbV+gVqqlJz:Lcl33Njm6TN9PJ5WB+gBlh
                                        MD5:8B704C6D356B5000D7E6ECBE42A969EB
                                        SHA1:17F31C9419F0C24B70BB7475FC446BEC02EE83D8
                                        SHA-256:A00310FE94369A4ECBD8DAC12E6BC79F2BA24F90D24A4D643A91FF52CEFFDF72
                                        SHA-512:0E816D17BEE608B8AE2C1F7469CF8772DF91B204DCB6B185B4E1E5DDED15F4478149A4028B89143416F8F2FFCE2A10A2B11CF723803687308F8513D98FDA2BFF
                                        Malicious:false
                                        Preview:.?....tz_....).paA...O...;(.......`:......&s...n.=.......h{..[..._o.u?...Mu........2.p.8.dH\/S..bc......Q..5.....!qb..#..t;-.6.."..M....2B.2..G.'..+...uO<...gzo.Q..S.D..ud.......*.i/..7t.?........|.k...Y..,....1.xR|B..W*.....M1........V..-...kj.`!...^._.r......k.QtME..?.~..UI$...U.....].&......2.............q.7..v*l.[8!..a../7........h...vVk..4h.....X.l_.:.t..q.O........\.a3z|.5uL9\....OtL.c...v,o...z.l..0[....B....*/{...A...]...P...u.DN'..,R...!.....8L.9j...~...\....i.).@.D.6sx...)..T.F...3>.Yi..t..`.*=<.W..r...SZ.j..Y..|..6.l.~.R..?.F......W]J..Q8.\.H .......q.]..U#|.."~.P...Z.4)R.s*.e....Z........G#K....nK....d..U1.I.....8.(e.."..;Hk.A....\.l........# .v.6..V.)u.7i\.M......2..4.@...K.....R.i.j......{o....[.c...3.h..A.e.y...iC>6.z.:..v....ko....`P|...:{I.O.|tO....(R.sX.V".IT\.6.J).....k&pB..$5.&{.....s9...-....n,...'.j*{..p....F......{..l...7z..^..P.3.a..lb.....E'.oH..!."....$9...,.oX.X..nd.]S......L<..`r..J.g.FR......N
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):458
                                        Entropy (8bit):7.522527609105248
                                        Encrypted:false
                                        SSDEEP:12:dnyzpiqKY8AaI6uf8eYskg5yX220IAuTsM:giqv8Bgffqg5yX2oT7
                                        MD5:67DB05121C41311BA1EFF763C6384A87
                                        SHA1:C90B7A7DD939045E3EDD7647036A37C79B1876E3
                                        SHA-256:EFB526B5B5CD756056CF5D27D12DEB4BE6C67C78EEB88E3CE6327546E4796EC2
                                        SHA-512:07450B1D34B08B49041297A8285776ED696A0EEA268F88A75426D39CAACE497648415140FD6BA322DCF110C33F7D8276DE65D09BB028AFDB07F812FBF1A10C80
                                        Malicious:false
                                        Preview:.......Ke..u9....#...J..~>..B.......Y...^..T.......4..S...N.4..?...xE..4..7........(CZ...V.ft.G...'.k...p...Z."g.G.?5..j...j#.83'..Z...?8.H..3p...NwP.M........C....:|1...u.=..,/.......cJ....~....u.G.v~.{.-BXu2.-d.....6...G<.~...O..MQ.h$Yx_ R*.[..P.gE-.t.(.....Q....a...M....m|..\3.=@pI..2.09...N.8.u.s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):420
                                        Entropy (8bit):7.491199223518731
                                        Encrypted:false
                                        SSDEEP:6:lmaYrV1zkFk65yIIXuybarNk64GU9UX3hje952lItGIUCKcpqKsM:iVg35OesarnjUaXIX220IAuTsM
                                        MD5:6E92B0A5379DEAD8D33D2D556B6CA1F3
                                        SHA1:32F1CB21163B437C08E534FC72CFBE7BECF8D4F3
                                        SHA-256:BAEAEA622080EA2B7ADC28E7D4431A04B543A7AB12206F2D46A139C18250ADEC
                                        SHA-512:428013759088425BF41E65D2BD4023ED2D2B1FA238017838871AE5F9DEB9D3AF114EAA2A657D809A2C3BA92581FDFCD3F364823B36DF117AF2656D847052442D
                                        Malicious:false
                                        Preview:4o.K...V..-..8..9.8.<.w0,..,... a..ave.9.1..g....,?...6....o4.pe.....-c.=E.B..ZQxB...MP4....},.m^l.!n.x.:...rMc.].hp.8,.S...}BU....RS...-..=....h.......A...W...vu...!..(.u.G.v|.. ..6tc.L..#hs.<.0b...l.~......NQ.k.ZM..=}.\$}.a.....27.#.f.._.F...{.B.7.4.....~...PE..IF{V.)8l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Secret Key
                                        Category:dropped
                                        Size (bytes):498
                                        Entropy (8bit):7.540990869824884
                                        Encrypted:false
                                        SSDEEP:12:HcZ2XKeVlaXUCB8+u4lkmQDgX220IAuTsM:K+MPubDgX2oT7
                                        MD5:4EA8F018FD7067EC8D2CC16CA94C9108
                                        SHA1:332F7D38C6E1CFA2A58700599D73DD611D0365C4
                                        SHA-256:11570B13DAABA8269962D3DDCE1C3CAC288534EF440ABBA65C7F0880EB48CBB2
                                        SHA-512:175F2ACCCD1A219503C1B084F4836B8F9960AF81A5F5294C2F4C5C20B282E7FA3259F884D14ED5F5A38BD55D17609A20C3B50B1529A5F11E4D65D2AED2C249D1
                                        Malicious:false
                                        Preview:..?.r"......q........S0c9.GB..|[. ...z_.I...../....>@P...l>..S?.y........l./?...=.....~8;Q..N.v.....-.2..=.."...*..zQ....d\.>.%n0.!.v;...:..o..naN...?.K.?..G.\......!...g.....'..SdY.<.&EO6........`.@.y:...L\..T.0..42.n..G ..|.c.\.9....;.....u.i.D6L%..Y.Yx...)....).'.P...^.......MQ.k$Y{\ R..Y.u1...w.CX.."xj.W}.b........3_.c.<C6..:...X.}[r.v.|C<+.FW.8.r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Secret Key
                                        Category:dropped
                                        Size (bytes):461
                                        Entropy (8bit):7.562473836477536
                                        Encrypted:false
                                        SSDEEP:12:GYlIdy8f4PmaSATXUAeJgmGX220IAuTsM:xlM/4PmfAgrGX2oT7
                                        MD5:BB921297E680C1DCF30D5FFE4726044D
                                        SHA1:DDACB482B244977AB1D80CEECE136B5DC1D47BCF
                                        SHA-256:AC42C186F26022D6432AA50FD7C3E02AD12E75C90015A4D2C36AE27EB8027DCE
                                        SHA-512:54CD644E43BF81BFE258A61665FF3AA36DF31E70F9CF9BF0A6E3A2C1175DDA7234A14BD0EEA93D2C20D4F1EB7DF3118C00C2A4809EB023F4CE8006342367C1A2
                                        Malicious:false
                                        Preview:.V:.p.=.lz...14.A..X.....%...F.......x......[G.b..b.........R..o......G..4..:.OrDJ)b....c.B...v.h^..t.>."?..H.#.....q.....e..h.o..._.~..+..yo ...].]..%....Kd.$P.A.r......X.X...e....o..:...9..NY..9.6.@...u.G.v...W..lm4S~..BoN./}.'...>.~......MR.k$Zx\ .L..@,..%m..o;g.bZ/.fH.'.b8....M....g.c.a_..|.8v.j..v.......-q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):467
                                        Entropy (8bit):7.555189288377909
                                        Encrypted:false
                                        SSDEEP:12:wYRCoOccgviwHJlyWZhfeggynlbOkJLUKX220IAuTsM:wreiDWZhRlCedX2oT7
                                        MD5:B9F9CABA446F8432CA53A979A6046824
                                        SHA1:9D697374A585F2C77EEBED1DF77A55E53158EE19
                                        SHA-256:CB9611AA48D648FB0B1946F8C3F2E595AC9161410EAA1617D6BD354415110EB2
                                        SHA-512:E3E06EDD03FFCE2294DB74427CA9DE3B4B3ACA3A5126AD908C2771742CFD5AA77026D87C9CBD655929DD3F188EF0ECF5561EFA5A75BFAD94F7B585575FF973AA
                                        Malicious:false
                                        Preview:t..........C.*.>...U7}Ks....8..G'm)\ET..2Y.....aL..u.@...Bpt.c..(.p.],.;5...@.%-.c.Y....9Z,..........(.t..<4..17..k...V?......*`.V.o...b.V.[=.5."u(...-Z..;.....l.w*.{.p........c...fM.,`.z;F..V.....<n...8.E.~.;.r.u.G.v/.w.|DXBY|p..wMN.N{]'...>.~......MR.k$Zx\ .o.R,.N[..<.n8.......=.. H.......v..aD..lcM..+....C[$.`...y.q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):461
                                        Entropy (8bit):7.5777913939365735
                                        Encrypted:false
                                        SSDEEP:12:kFyzIY+AjVVcqjx5lbabdb8giqpyEgX220IAuTsM:JIiZxGdb83qVgX2oT7
                                        MD5:873959FF848B0B41AFF86AFF27ECF6FD
                                        SHA1:04A248D3B62BEB724B71C1492866B1450300D6DC
                                        SHA-256:80D85FFF2873AD5B1ADD9706C1538E99C2998EE53CBCBF4DC78D0405C17640E8
                                        SHA-512:506A8EA369D022BDD71CF23A0C356F5E6FC4FC253C640DB0C79BEF144D33F04A2208F964EB9209EFF6ECB7B7B55CC55A3524D8A4B47E8305F985C922E6A73D36
                                        Malicious:false
                                        Preview:;+..W..HL..B...t.?..........Q.3-.i0..-g...-.m....8.Z.&3........$...7.s...D.9.:..*a-'...U.+..xc..L2r...N.^.9Fk.Y...k.....[..3.b2.....L.2I.....!~.T>.~..#6..D>M|..Z..o%.........B..PXE."<.}."....KU..=.......\d0.u.G.vr.r.,U@.^{F..#l....SN.!...^.......MQ.k$Y{\ R..y..`_.i....j....m%.\U..y...R...r.. c._.]..u6.|.0y}M\Oq..c..k.r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):432
                                        Entropy (8bit):7.502053815936445
                                        Encrypted:false
                                        SSDEEP:12:FKn+wAdpE+HXUXmBa4EhX8CYAYT8X220IAuTsM:FKDkZkXsa4jT8X2oT7
                                        MD5:1218A315644C348B25D6BE7D2BC8718D
                                        SHA1:9A3312764CD29E253DA075B9D2D69D7FDD17E8F8
                                        SHA-256:D3F3A557A78C0E31CDAC38D8B8F5CC40A5621EFE456072C7734EF5C21EC6C133
                                        SHA-512:31B18DFB72DA509C424580B80AF69296D2659C646FBCD2045FBF287083558657B68FCEA89277376419055D82A5C010B0B66A06895B62A16A8FE5E33A9FC55E71
                                        Malicious:false
                                        Preview:T...J`Hm...K.....,..]n.`...l...*..N...++..n(.X.C.5...6......}Ul.2%.G.............q1...W....C..`."....-.,..K..m..b9e......iF*ja+...\.T...o.(Q..p`.K.R&jy|!F.8.Qid..l......F....u.G.w.^t[|.dH....et.N(7.%'w$.<7~...O..MQ.h$Yx_ R*H.j.|..K.=Y........"....|..[w..b..x.R..xuJ%..J.........=Vgs.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):431
                                        Entropy (8bit):7.477054276148636
                                        Encrypted:false
                                        SSDEEP:12:sYaC1VUN3w9Hp3WZmRR8iYKn1IWWCX220IAuTsM:sY6qh9WZm77dnCOX2oT7
                                        MD5:9D755541F72278331023D16B4B1DC596
                                        SHA1:5377EECAB27EB269EA0EDA7A61E9F42EF3F2B12C
                                        SHA-256:5C97576980316EF5CB4791FE02DC611E69F556F936579D358B8361E5AAEB3365
                                        SHA-512:7F98388ABF72B72267F950BA0C3E57574666874D7881A1E5BB2DD9C4AB378A55F45ED0ED3AAAE632E5D50946DA0DD6B54CC869CAA6D107BFD8B4FF3153996061
                                        Malicious:false
                                        Preview:%,=..L.Q...g...'.p.....n.....g..t.O....&.an.#...>D.k~v.P...[.V?....R....`...?....Kqugd...l.2"s..o..h.?|l|*...%x..M.....o...H..kh.gAAc.....s..........Q...._]...0{gD..u..u.G.v/.{...`mgVy....%.\h...y\.........MQ.k'Yx\#R*Bl..~qT...=.[n..*.CP_........I...^.-..L.C$..>.JMZT./4..8.4..m.t.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):462
                                        Entropy (8bit):7.532355232247504
                                        Encrypted:false
                                        SSDEEP:12:xAe4aJ73c1joNqWl5JselpiKlcX220IAuTsM:CE7M1OFlP9pikcX2oT7
                                        MD5:386D9321107750964A62D2A1C00C4F8C
                                        SHA1:5F08C5E8034A2F543A32386F49CE6C8413F72A5B
                                        SHA-256:31A2378181DE889D4643C74AD1307D40E597C7D19DFE50692EA1155F85206D50
                                        SHA-512:868EEEAF534F697BCD1FDB37046A5D5D7D190C80E94330FAE0833667CCFA6A3891A7DD2F1AC17BC64F9B768C4280BBDC69AC27697E5C9E4406955F8400F647AE
                                        Malicious:false
                                        Preview:....,.dK.&.>..y..o.<.S...a..C..9.>.j........P%.b.8/.l.E......E.......B...c....+.-+.3VY..K=n..xm.W3...!.?h...AMK...2..%:dH..<....X...K...2...o..Q..^..y.qM.<.....a.>.{0H1..Q./....n...:.kI9.h2.......X..t.%..g..u.G.vy.O%..YIE}.....4..G.Hr..>.~......MR.k$Zx\ .L...q...Ta..uYC...u...2.4..2...$.?.20..#... .Z....e...a.F..q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):438
                                        Entropy (8bit):7.5016580084444815
                                        Encrypted:false
                                        SSDEEP:12:qK1UNCSRRVHIfTMZep24o6O9NrdX220IAuTsM:x1UXR+M4M68NJX2oT7
                                        MD5:53FD1ABCFFADF01649A480045DF109B1
                                        SHA1:F6CE50D48D4F933782A1FDEBEFDDBB521BBD44F4
                                        SHA-256:1B24C64B5E07E02C44A31CF801471F5B9671ED16CED98D7165698552E76BD12C
                                        SHA-512:B93614DB81C047FBB8787ACF075275DF3E8FFE6E2834B72B0D92B0961B8A1C74251C0564C998C99E3B48677E1332331D4BBE8657E8DF2BA14797E034C30B077C
                                        Malicious:false
                                        Preview:...P.xn....$..0....]..Q..3.G...'....<.n=;gl%.cjk.x'.^............b..A. .Yr.Y...386,.r....g.C.2X....w..u....t...'.,j...~:..-..|..._.c.....1......!./.I.G..'.X. dn.4....P.9.....b.L.6...u.G.v/.{.y{m.2..|.9M:.X|9'...>.~......MR.k$Zx\ \..1+03..|+..t....H?...-..M^.O.m.|..'...h.x.&...r..5.=K..`/q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):497
                                        Entropy (8bit):7.543812225124965
                                        Encrypted:false
                                        SSDEEP:12:OmBi02tmn/lcUUHBayDVFDok2LKFmwtcX220IAuTsM:OmB6Q/AHkks2QccX2oT7
                                        MD5:2983481BF9F287BE925AB81C311EA593
                                        SHA1:6776AECD6786E698B9F476F6F1B134BEBA854529
                                        SHA-256:176733A8B72198AB1F0EF91ED0727E4E7633762AA5B25A163A6FD3DAA31C5B0B
                                        SHA-512:08AF63141EC21491D6456772C15B7B921487243A23471A3E3AF708E6D7187670DF3886B0011D701C53480A7748581289C95CFCCD9EE70BAF3E7643CCF5736CE1
                                        Malicious:false
                                        Preview:.v+k._P.,n"..0.I....... ......;.D.p..k..:g..)............../=..m..R!.y@.......WN..mG..b>hR......f.........#..hv1\..{Cw...}...D...fn....=..K..1b..g..`.N.m....5...I...o..u..o".-.,.e..?.....?........_HTI......!....q....1..}*I.u.....d..i.E.-.u.G.v~.K#..[@^rB....5..z.'5$.^.~...O..MQ.h$Yx_ R*....BfMx}.=.b3....J'..p......vj.9.....'..*s.n....N..B1l.ks.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):463
                                        Entropy (8bit):7.524862816348024
                                        Encrypted:false
                                        SSDEEP:12:Fz3RoUDAz3yu13IWi7DaFvIRRgmVp5xBdgX220IAuTsM:FVtDPMlSeARd5gX2oT7
                                        MD5:242EA12064A5D4AAF0429359544B3D34
                                        SHA1:E547F5B7D1EAEA431D4261D5396CFCDC4CA159B2
                                        SHA-256:D4746A1EDB535CC4A425DAC15AFF2FDBC0A75287DCC5A2F981769F124932272C
                                        SHA-512:CCEB3C8076628D42A9ED80CD56D38D13D03CCF11D366857E2A399E5B824462DF660FC850D08B101A707EFD895B87882731B13C3B8E4F6AD7FED78E64DBD29274
                                        Malicious:false
                                        Preview:....d.....0....>g6P...UJ.Y...I,.)afS!c..x<..Y.....#...b_.V.*A.j....0b..,G..o...I...Y.QM...I.q.w.....=.....i..R....!.g.....l6!F.F...%...=....}..xL"a.m.F.....q..!.......(s4A)...9.b..~.~.K.......@Q.z...BBbL.u.G.w.^&[*.fx3.|d.XK....~.=.<.^.......MQ.k$Y{\ R....UFx.<...M.V9.%nV^|....d.S.....t2.1....y.z.#t$s.s7]....}w.Jr.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):455
                                        Entropy (8bit):7.524678072573946
                                        Encrypted:false
                                        SSDEEP:12:Krhuvthx/VJYzodlTtx0EI8D+GX220IAuTsM:6h0/VXdlTtx+qhX2oT7
                                        MD5:5EBC049EA6D348065D82A8A23794080B
                                        SHA1:37662A43BB942A96E2D25D54282B072CB2CC8C3C
                                        SHA-256:540E993FAD95313573DD6D11D45FBB272DF98716519C1FD9FBB075FE573E36AE
                                        SHA-512:89A04DD33A22B30B9B3EF2555739A3FBB726491EF326EC4326563C42B1E88D5813BAF89EFECFE0A4E32956357BE4054370ED8A09332B134DE532771A544E1B81
                                        Malicious:false
                                        Preview:3g.99.M~z...2.....j...o...|.,.....B.5CWq/....*.I7.ZKH.d>dT.(...J.B..s...%t.HWV .w.7D..<g..u...:JH....z_....f..Hh..:.#R.qmdK..!.....[...%.Ty,..4.j..Q.....@..m*..1....m....x"..ev.d.im......Oe...B.I@0....u.G.vz.!.){`.2.A...l ..y..wKo+.~...O..MQ.h$Yx_ R*.{.n!.B.Q..0OB.;|.....r[.i...x..g.$.9/...>.&..e.pq.......#Ks.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):461
                                        Entropy (8bit):7.531994560263125
                                        Encrypted:false
                                        SSDEEP:12:gJ326p0CkqmixPBgzorMiQnPqZ0gX220IAuTsM:sKClOzorvQncDX2oT7
                                        MD5:C07727273E02EDFB4D48EF441F51AC34
                                        SHA1:0BB88A28E1909469B71B52FCB5C07CD63D4F729C
                                        SHA-256:B79B8C2DD6F3CF8E312274E7C89092793365983B0E248B4B10FBAE3D2452C3F6
                                        SHA-512:00671FD38700C9DEAB58EF682D8E786AAAE4333F91662E85AC5A95C6410983F48F4710E59FB904F595896F6A2E214804A226C07745785DD5A41FB45961E71363
                                        Malicious:false
                                        Preview:K.(.x..;..sv*.&*l..\..xw..i+.\...Y.A..........Bc*.J.3..:)...1..}.....r$W%...T.....;.....(,W>....<..'...E........V.e..........z......)y..Y....^..&N..he..C.>G.}2.....F..~F.&.9..+Y. .L.z.v`.[.*.N..L.u.G.v/. ...YDU....&+*.NG@H,.. .~......NQ.k'Yx\y.i..}._.f".H.8.vq..n"..JKH...k..gfZT..$'.x...!...o.C..a...p.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):478
                                        Entropy (8bit):7.543392136554375
                                        Encrypted:false
                                        SSDEEP:12:Uq8zQFAc++88Qml6KW0h0L98Q+rRHXa7q0XFsyFdgX220IAuTsM:UcFP+Fml6lDR8lrR3a7q0XHgX2oT7
                                        MD5:8BA9E4F413984FF81D30700E10C479E2
                                        SHA1:0B36F110C7FCD114D5FF0FDCFA644D36B6F93ACA
                                        SHA-256:0B54119CCFF936C62FF13A767B650FED092F192F4114583FA35705687138D15C
                                        SHA-512:CA07A87CEE7408983F913DB48FA727DC3ED356D19287D312927B9A05EB6235C59156733644D233DBA25ADBDE7CCCC1E060FCAEE0A50E83822DF0F12890ED6049
                                        Malicious:false
                                        Preview:.HC..WM..Y.-j5.3E$?.\s56m.,Hs...x.......Q......c....R......p-h.6L.Q... ..C..y........[.},6U....Fc.%........Ss].N?._'..v.W.^..n...j...iB.*`{..a."..j.....c......{y"..Z.b.....:.W....C...W.@.........LM}....t....Mi{.k.Dk..O..u.G.vs.$./V@GI.D..vIO...o......^.......MQ.k$Y{\ R4..!..=.Gt..!.U.m..p...j'{....Q...y....y.....~.H........._h..r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):465
                                        Entropy (8bit):7.532715482317432
                                        Encrypted:false
                                        SSDEEP:12:zZwM9AR27B0Ya8Y0FhBVFNuynIDXUlXfgX220IAuTsM:VwM9T7a8xFhBVFNuyIDXUxfgX2oT7
                                        MD5:CA5E0574F72AB3EE847F76365DC98378
                                        SHA1:21B61D268DB16AC5B907D41ABFD2BD14EEE72FE7
                                        SHA-256:39028D7DE5549012F2687093C867A5D4FD31EF048ABB0ECBF83B403D27413ACC
                                        SHA-512:023A4C76F9425751C3E23309CE41B659902B705A19FAB7AAF2895E44F3328DC985AC76F2F4EEE70EAB89CBCC075817CA4A24C4969E2FF87D92298282AFF8C333
                                        Malicious:false
                                        Preview:.1./.O'....[.rG...9..;.W!..+.2..._.S..`..#.9.....s..K..b.....j...'.~....a.!...zG..+b....{.K....4..}R.F.].....@.4._e.U.....E0U.*/.`e?i.O.F......I..:..n<>.....p..p...q.P.]..*.i..._.:...8.7...n..,...M...?..2".u.G.v,.Gt..[@]xi>.&T..N|@'.$.<.^.......MQ.k$Y{\ R!...r...CoYj.x,_..Vm...~..IV53....vW.K.`...].}.Z..C^Wz..U.}..+r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):457
                                        Entropy (8bit):7.576104356276847
                                        Encrypted:false
                                        SSDEEP:12:IuT5OGtysAPhFB18oef7nOqX220IAuTsM:IuoGtwPhFj87jOqX2oT7
                                        MD5:3DFB024FF39DC8B1CC00AC4466A19F33
                                        SHA1:A00AB659B22587D2C4ECD154A797E391BA8B8958
                                        SHA-256:562E194D9E134801B98D41AF9B4857ECAC913D288CB5A26D7F54ECAF793D496B
                                        SHA-512:881C206F1058624BAA1BB2222C7C80EF817C446B25E7BAA92AAFD21C17B1974B604CE9745E996CF15D0CC92886A1B769CFF3D6B61C144B50D8768F2FDEA8431B
                                        Malicious:false
                                        Preview:2....(U..k!.._m........>'**.....B.oc.s.}X.6.9..S......6.~h..D.4.....i....z[.........:....S...s.N..Q......b........-.:J..T......C.c.2p.HDd.....B...-w..!...A..Y...HdE...SCC}.V.Yw...y.-.y.q.m;.....u+'s..P.u.G.w.^r\..megry..3O@..(o....>.~......MR.k$Zx\ .p...x%...h../....X+4,.%.]X..N.......e.;...F.....Yp0....q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):466
                                        Entropy (8bit):7.570737226365131
                                        Encrypted:false
                                        SSDEEP:12:8r934r1qh8woNIRffZqZObskECEPzmwTX220IAuTsM:U4r1aoKhEObscEa+X2oT7
                                        MD5:F5FD34E59B6B837A6BD750F8466DBA83
                                        SHA1:5C925D7A9502B75BF96ED5392B941F9535B091C8
                                        SHA-256:9E2CE3EE53BB35E01D5B6C47B31EA35086C83EC5A34DCCB387312D0437B4F306
                                        SHA-512:6CF7240CFE33C6ABCD82B7BE6C01F9C28DEB026F33B8F3FCE208994C356C73FD7946152BE014E9BEDB4393D8C97D461636E7A0DEDFDB51E1124EECB87604D828
                                        Malicious:false
                                        Preview:...4.o.-......dO........_. D..\.B.O#....E.....-..a..W..z=@".}..4.i......s..P.S.hsiI..t....l..S./....2..Y..J8.T...PJR.."...oq..G.G..............F....'L.9.YX.c. .jg..G.U..M+x...e^|.C.......^+.P.[....8...Tg.q.....N3..u.G.v..{..93IUzA.....a.2....>.,......MQ.k$Y...e.WZ.w].@X_.6$...K._....W.j.KB!....m?....r;B..p.Y.Jr.....$n.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):481
                                        Entropy (8bit):7.567550296948252
                                        Encrypted:false
                                        SSDEEP:12:V1jc88CNc6V8aZjM4C/n5AOzeRg91sQNKX220IAuTsM:V1jc88CND8a1M4QyX2oT7
                                        MD5:F6144165F4BD4A24172DE5B72910D5C9
                                        SHA1:26597BA74BEF6C318A01E34935C0AB69FF172F66
                                        SHA-256:1DAD395543F36A4D420A5169E44722FBCC16154BDBE48145396C6EEB3B781DED
                                        SHA-512:95469C96361A75ED8FB9CACD7923B6CBB973C14B5E99EC1E3A08E0B1117362A7F5BA25C745BA80F9FF2717D1C6548D807B8525E5A0AED24B4D05855CAB3E3548
                                        Malicious:false
                                        Preview:...s...p...Uy..%Kq..%.].~..f...OvM.y.N...B.}T.k..3<t...5J._.PXI.9>.....W....e.\!../.+....#r..GS8..u.........tt.a..... ....C..57.k......^K....Vn..s....|O....z.!..N..N.^jlMM.\..E4.r..V.}2a.=.../q.,...x?v.....[ni.7q?.x..u.FW.~N&[#.gj1G{..8......Z...>.~......MR.k$Zx\ .~cf..:.LUsL:y.l..1.0..S.!>.l..o.3....X.t.....@g.....3.LKF.5.q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):438
                                        Entropy (8bit):7.502724532210163
                                        Encrypted:false
                                        SSDEEP:12:tXtgZooU+gbWfCfzZpnnksSgX220IAuTsM:pPoUAqfXbSgX2oT7
                                        MD5:9F13D2ACBE5DEDC0F8D1FDBBC5841B75
                                        SHA1:43D593738735475BB122369D6325671AAA3047A4
                                        SHA-256:A7A7F580FFD18DF19661A6E92238EDBB4AF73E1F3AC6AB22C48682B632EAD1E7
                                        SHA-512:88C481F2F2D550FF39A5A1BCE57D2835D746D425A52A55117D10658F93BC7F6EE25205CB89398055C60A5DED5105DF5189EA7B2097E89B370A76A231CA4CBB83
                                        Malicious:false
                                        Preview:...cwl..c...}.>^....j....6.6.huv......k,4.....6Q=|.i.w..^....j]C.mR........|.:.c....gX..~..$irg.....HE..O........K.$@/u...n=+..X+..`o..:.\..r?.]z.6.lpv.w}/&1.]O!.......R>.n.'.t...u.G.v{.u...l.4..d......=.X.....^.......MQ.k$Y{\ R..@Yod.R...[.z+J..G....o.?E/..|.},.m..w'.{.[._R.e...p.,..r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):460
                                        Entropy (8bit):7.580582422582158
                                        Encrypted:false
                                        SSDEEP:12:qUY39KSbJSZLP4+iNlpbdnrDnIsAX220IAuTsM:c3AsSENRrkVX2oT7
                                        MD5:75860621CA96D02A6A88056D4FB97F11
                                        SHA1:81EFF8BE5BF590B81EB784B07FC22CB12084E43F
                                        SHA-256:958AA6A783A91703C54EA3701EDFD2B84E06D5B8D75B81FB560E7239DE6616E0
                                        SHA-512:928C96F06F65DF92C956FF11D09B622AB52FD83FBBE08F5709DBC81F874AD1F748503DF28E29D83A04C0AB6D59A33BCDB59174C7B2E3D37F7397E303F30A4515
                                        Malicious:false
                                        Preview:.....Za.8h...Y...*...<:.w&..zw..Z..l.i%......b..=/s0.......5.."qU...9...... ..0H.>K...&.-r. .".....G.G..@.`......TP.Q..%./..e...3..PS.E..'.....t.>.D.h!..w.m9i..xDB.?.R..?.2p..'...7.?.:..H.....>4[e|.Gf...u.G.v/.Kw..Y.Ux..e".5.0y>M.K2..~...O..MQ.h$Yx_ R*S[.....~..T.f...Y?~..Ak.*.%^{...C...N..)?.......m.f.......j.s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):463
                                        Entropy (8bit):7.496039969764988
                                        Encrypted:false
                                        SSDEEP:12:NmQyFqkQXi/UN9H35/U8sXuLcWuV/5X220IAuTsM:NmZUk6icN9+nbV/5X2oT7
                                        MD5:F7FB5AC8C5623A9D5222E149E8C757F0
                                        SHA1:ED6E579B2443D6C3EE7445C25918AF08765C5B63
                                        SHA-256:A8B2D37393FD1A8F8E1569322DBD02C68B3E85E08A0D45E45F87DC572F917DE2
                                        SHA-512:99CB9137B9F9834E437155708BD73856A94660C2DFB9F40B7F60EEBE1A01B1A468ACB0F6961AEC470E4C78936E3282130F136D99F45F580BACF1F0FAA37365B9
                                        Malicious:false
                                        Preview:....0h?X.N..}u.sw..LxJZ..IOZ..I....A.T.ak-.n....^....!....}6...k..%......~.....]..&<.>......,...)q....<..t.<...4..Q...UU....5..M.r.i..-_g!.W.uj.`...<XR..(....u....*R`?..[v`..}...A.......m:]p.s...$+fM.". 3.e"...u.G.v+.s./z.ifV+..0....@.,3R.~...O..MQ.h$Yx_ R*V<.8|.@.RDa.0.oq9Qg3.L.,...:..S.k2.....f.....`...9j...?J....s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):475
                                        Entropy (8bit):7.552852527596024
                                        Encrypted:false
                                        SSDEEP:12:ez8T7MjwHoawSPtpNumRv1WaBxS4dgX220IAuTsM:jT7jHoaWU1PPSWgX2oT7
                                        MD5:5C5A41C6E3B94FF9065E5E9FE506B2A3
                                        SHA1:FF40E39BAEDFA2814EA99DD74C956CE9E8669210
                                        SHA-256:D428AED8A162B4A2A75885C35117197FE15BB26F2023295A6ED01EF0D93512C7
                                        SHA-512:26BEA13EB8C66B98919C707E579E41632726EF974BE966DD04CFB7A1499B2178B377E7327F03C2002BBD4F7E0DE3F89B35C839122C28920B3D1CAAD014223493
                                        Malicious:false
                                        Preview:..x..TP;.....!P`...Qu.1......Uc%|..ze..y.....J...A.y.z.....1...g....s.-..W;s'....y..i.m...V>o...Q.K.D..%..Q....F..p....$N3Z..k...P.+..6W......g...Oq...9o........[..u.zP....Y..N."........S.>0?.].].M..j?u^ww.7).S..t...F.u.G.v..t.|{4.I|]..%.H.\.@'.$.<.^.......MQ.k$Y{\ Rc.{...V.q.5.`.u..OR%".g...-4....%#.......8.Y..=........D.r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):464
                                        Entropy (8bit):7.577950204329227
                                        Encrypted:false
                                        SSDEEP:12:EPUEDmGsAALGFYITm4jBYPt8wmAtZBbehtmLNKK/X220IAuTsM:Im3AgG1bBG8wZBUHK/X2oT7
                                        MD5:5B6E2B4AAA0B44D39654B4E7903F63CA
                                        SHA1:D993A0C59B3E8D38C6D15F55CA23FCBE1F1C5DD8
                                        SHA-256:693CE777121FD5922B642B656440021159351A650CB6BBD56B9AA59C5F9F8DEF
                                        SHA-512:0496492004768B1DCF86C7D74406E25C00F346E4E92BE65001C6AE0A2628A62CA2C13B47DD07AFB0B4AA5E74AB3028EA1E66109E89E3D3AAFF742EB00F7C5F09
                                        Malicious:false
                                        Preview: ..3j... ~a.<K1..$.....l..1....2;......Km....tj1.>$.+U.....I1(..;.+..P.e.BaMe...L...h.w.0.8...'....7g..mn^..|.2}....9.R.~.2.....W...G*}...'......f.V|&7..,H..Y...N..t...B...(.g.).C.1..M.H.}%....7]...a..\.....y.u.G.vr..t..PC.}...w<!..od.".>.~......MR.k$Zx\ ..\2..q%!.&9.........D!>........g..v?..S.....A....E....<..q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):460
                                        Entropy (8bit):7.580864733739851
                                        Encrypted:false
                                        SSDEEP:12:v6zXNs9t5WhYbu2TDXT3dC7gX220IAuTsM:SzX7KbuSDXTg7gX2oT7
                                        MD5:0E9C452959DFAD9682EE2D5054F72A1D
                                        SHA1:118CB8F7FBA46A61D814225E89B1E9D53219E45C
                                        SHA-256:4EEC8B82C82AA558BF4340DB05F48BBCDEA7AF15B18EF51F4E23875D13765F06
                                        SHA-512:2B75D88CA1C15328820C09032F47D3CBA5393FD45EB1758D3117231F6EA59AF4F0191CD440D816E58C55DC9D721FE07ABAEB514C6BCF7E9D63EDA0F61E64EE47
                                        Malicious:false
                                        Preview:..4...4{.9.7......mg..2.....+.......!..r..+.OH..k..A.g........9...*c.%z....7s......_ZeQ)l@.....A.N{FY<...j.."gjE...".R.f.o....6.W.....k..o.3.6..va....|....K..M./D....!J<~...n.y.p\j...X..KR.;y..6.Q.rq..P...u.G.v(.u.{VD.].h.(n.t..o.....^.......MQ.k$Y{\ R.R....wp....w"...2C.W......N?qN(....|R...WS............ 9.kd/r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):440
                                        Entropy (8bit):7.495762635461449
                                        Encrypted:false
                                        SSDEEP:12:UBqUkmOevhMNbQ+s2NVhUqLZeZbljI7ngX220IAuTsM:UBZfqWx2NTUq1elljIrgX2oT7
                                        MD5:BEB9943426AE000116E6B005E2B648AA
                                        SHA1:AB9B919591FCD54BAD6EE08A2A0F9A230757E0DF
                                        SHA-256:63BC67AC4547D375823E43365899196C5252706FA6A49466BDD73746F74630FE
                                        SHA-512:09CC0CB5E245E6D39D765543FC52119916F39CE63513F600E6DC788ADBB6F346A48DBB9EFC20F3467BF2A6CED4B1CC8C2BFF52E6F607182BFEFEE05482F291EF
                                        Malicious:false
                                        Preview:.*.=3..b......U.....t.nF...D. ]......U.qx..pB...n^.+`&....3..3\.0.t..U.U...6.....+h............u.c....6J../..el9oi...l).C.h..X!.m....~as=...<..3....tP. .^Y.25...\...d!.}..z.......m..s.u.FW.|Nu[+.em6V,...E...y.Y.....^.......MQ.k$Y{\ R0k?X..u..zis...Q..f].:..4..%...?,;~tC..s.-P}..m.G.;Zr3....D...r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):469
                                        Entropy (8bit):7.557903023298058
                                        Encrypted:false
                                        SSDEEP:12:kZ9uoHNaZwOzgkRGrMpHfgLCekeQMX220IAuTsM:69v6wOxU4pHfgLlXX2oT7
                                        MD5:D77D4EB602A195ECAE2758D9D255691B
                                        SHA1:E28D5D92FCEA6969720BC09F44C182D3743C21D8
                                        SHA-256:C7B2C7D98665AB9FECBCF5D4AEB2B4EECC8F129795FD697B36F03A9AEDAA2C3B
                                        SHA-512:8686F3D7B10F90631F6422EBDF1A2ED5BA7B09F51C2A719D2C16B5E3B8EE6481E564DDA2ABCDBCE4FFD7C7B416E6DDEF25A72721A12892A9A7049F6D2567134D
                                        Malicious:false
                                        Preview:......=..=....T..e]...s...G1......C.n............Oa.;......Ne.C.Di..8...>.4..T....0U~..P.z.....n71.*v...8zO.".SH.b..jcl.......1....n1..U.P].^.......T.....NT..@...u.!..{..K#...Q`..d..6n.s.....+.......Z.2R.3...u.G.v..K"..a.h.yd....).AwK..q|[.....MQ.k$Zx\ Q*BW*R..Z.......{A.....~.m.<\x.&....%.l......T(.'...g..m,..V...>u.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):464
                                        Entropy (8bit):7.460119974282234
                                        Encrypted:false
                                        SSDEEP:12:3WT6R4nO03uEk35UUvYQeF9pUQX220IAuTsM:jRL6s3CQYXUQX2oT7
                                        MD5:59D1D2F67036D22B56B244D09F00ABD7
                                        SHA1:035C04C0E2FF1BD3DE018614908A2FDF5FC05C81
                                        SHA-256:DAA219D270959CF0608A626940A0C8465E5895C2A652FD09413932C67F87543D
                                        SHA-512:7340F395CE1F638908EE6801B7EF6F61F79DC593151287E7275353060DB7FBC75335CF3073F88AD7966F74C44780DBAFD124916F6505224735D868E0F1E56BC0
                                        Malicious:false
                                        Preview:......e.P.....M....mX......?.h].[....{..)...a.3I.It.E..X;....).*.`)..6..!B......0....H0k%.).W.kd.[..RP....;N.Fr.fN.oW. ..>...!I..5...>@o...T=....X.<s....k_..e..:]....5O@..9.;....#.T....a..2..J.._...8._xd..t....xN{^~.0.f.y>.&h..X .@.,3R.~...O..MQ.h$Yx_ R*.=g.......X.......fXHWR....../1.......t.OF.......9.....*.. .s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):460
                                        Entropy (8bit):7.508577728144278
                                        Encrypted:false
                                        SSDEEP:12:RNq3QTIJPow+mMwlTNoiWLtsh5TAH0qex+4HCX220IAuTsM:RN2QEJPM0fotLWh5EUvHCX2oT7
                                        MD5:CFE468D87BE1BC2FB11972BF209E9A6F
                                        SHA1:3C345E5CE3F901014B6A29A4D2337AAF17ECE513
                                        SHA-256:03903142F5C4774370524E1B8FCC6EC95F465B309C98F0BCEA2381C21E3FE1CB
                                        SHA-512:AD460D0163A0772F70B28473822F00884E6906E3C70B9DE2D129A7D83B70A00E0E54FB7A562B6F619F82032DECE8F1CA72BE00B857582B189719FB45F2F8F30E
                                        Malicious:false
                                        Preview:.B...I......NG.?..b3.;..'|.0.$I:...k.Ce.O}|s.....y.4,fm.R.p....wY'..(...(....b^t..u>.Y..S..[..v.y.S.s..9...$E_....J.g/..Dh.......g..W...l...)6.L.{f..>9.h.M..<...-..[^...J.._.fE....j........SJR"..b..m/...e.u.G.v/.#...[.])]<.'T..2G.Hr..>.~......MR.k$Zx\ .......!..b.H5..r.a...f.t..N....~........r.upb(Z0-.3.2./r=..-n.q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):457
                                        Entropy (8bit):7.581122382574686
                                        Encrypted:false
                                        SSDEEP:12:R8e4HMSUGr1hDMDht30W//lvCha0I/8X220IAuTsM:RH4sSLrzDRWHlafX2oT7
                                        MD5:1BD5A58D6D03C532C8AE0A063C573F48
                                        SHA1:4CDDDE6BA4414BBF0562DE9503DB78F236E0B582
                                        SHA-256:40971DDE57A8E8BB5A03ACFB3AFAA900C61F3A0E801A57117308B622035088FE
                                        SHA-512:D4E15C8D5034F3FD3070965EDD15579B53D092F7BA10DE9ED419EF37347ACEB54CAFE2F5188C220D0D293CCF9663838F422B68B1567CF0FDA7B9FFB5E39FCA49
                                        Malicious:false
                                        Preview:.a..]d..{..EPE..J...m.yG...........i..oE..,S.RY;..X. ..|.....0.*@.z.C..).W...g.9ci.4`R..u5..$.g.s.A.zD#...B#;P....c.0L..97=F.|.1...[.n....`....4...2....a....&E...(...d.%..W.....Ig'Yx.. ..>N.s.D.......5.u.G.v/.Ks..PC..l..&.%.'G.Q...>.~......MQ.h$Yx..@.A.7.P...7......T..h.=...%...6..5./om'........f....g...;.Co.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):460
                                        Entropy (8bit):7.538178924993334
                                        Encrypted:false
                                        SSDEEP:12:Q4XrWdyw/kFP4YUd5rbZkDFU6E37YIX220IAuTsM:Q4SdyWkh4tTfZk+3PX2oT7
                                        MD5:E1B67892E94DCFB68D6A79E836A259F2
                                        SHA1:0E97B1494340B7C4DD6F325C0CDD81BA08F4D7D9
                                        SHA-256:F576480A1CE4FC489716472388F80D9EBD3EE7E3342FD9A3CC1134B4FC2D4551
                                        SHA-512:A939AF880369018B889F849341B0B37755271F605A4752A9312C3DC444E4A051473D3B7FF5181E309AB46726FE32659DF07E94BBC97CB425C5B77D0384B3B1D7
                                        Malicious:false
                                        Preview:K.`.V..K.?..06..\...S....l..'r)'..?{.\nCfj. L.....!...i......!. ...c....j..TN7..u?...I.z..;.._$.m..(.K......H....p.D...3.{[._.zQ*o.}&....c0.P......l.mO....A......y...*.O..A..vnB..Uu.Ac(.....`.XeO...n.*..e...u.FZ./d$R..d`dW....O...(.z4..>.~......MQ.h$Yxe8..M%.9<.~.@........!X....d>.}.+...l..fH...e...;Kc......^X.{..o.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):455
                                        Entropy (8bit):7.516807600128195
                                        Encrypted:false
                                        SSDEEP:12:8pwRPX4v5lgAHUf1dP3XBxC8fOTmVvcX220IAuTsM:8psItH81dnBo3X2oT7
                                        MD5:3BE7449EEBD3911367D2E728E6DA751F
                                        SHA1:411CAA44DCD6B2E86344974FE729A921797AF4CD
                                        SHA-256:3A4EFF8F672813FD4859E4C27F9B33AC353C65835A512A33E108D241CD26B0A0
                                        SHA-512:E89A38289E7912E38CC98314C7860FA8D872CC3BC5B10A4D0C6C1EE2E5F10429B6AA1D29F8B19955875F314733D38AF4D0F41866100816531DCC6D08B667EAEA
                                        Malicious:false
                                        Preview:yh...........S..+9U?.<!M......L.+.....P<S..Q.r..p.....`H.L..)1<.o.......\........G.4..P.h.r/.T...>...!......0..X.=..j..9.h.Vy..x..........V....8.'......< ......;M..i.\..f{_.[M=.......MA..!..}.}._....u.G.w.^tV~.4ChCy.."N..RY2x...>.~......MR.k$....)...O!.#.............G...u,Z.G...7I..6.....X.T.....xp.p..Xm.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):476
                                        Entropy (8bit):7.536003901343846
                                        Encrypted:false
                                        SSDEEP:12:68rvq8jPxNiWNAucugvLuuA2YWHMw1X220IAuTsM:68rSAPxoIFMLd7Ych1X2oT7
                                        MD5:B380766AEA2B50449B0DD09D398FD07B
                                        SHA1:A27EFB005A6786E2B922C5D99A10D4746BD54212
                                        SHA-256:5A4222991D5FA9657875586B5C99A1B2D4AEA5A3757B0E3562330C1F10AA5391
                                        SHA-512:6F98074DBA79278CF8DB6B1DA54900576DACDA06085A2FD2EB95ACA3FBCD59AA9A0FBB6DE28BB739ED3D36C62A6DD13550A4F069A50547B6FC4FBED730441C50
                                        Malicious:false
                                        Preview:.....4...........T...R....1.1..|.3"AV....L@.%...^.N....p,...=@....o.<.c..t.....wF.X.=.zr..!.[.B......S<.R]....A.._.y.v.....k...,=.d....A...b.3_.........,.Z.b=.E.mJ.3...Gb.7.vKs..L8.........Y.Csdn.e..9.....k.=........u.G.v{.q.-{c.2.zE.....;.%..K...|......MQ.k$Zx\ Q*BW9.U..]....{...7...../..[......W..w.X.... E&..J.n).lO6..@jYu.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):463
                                        Entropy (8bit):7.553825903894927
                                        Encrypted:false
                                        SSDEEP:12:Iv9CQnFMzYsV0bwdZAhSqq3alcXiACX220IAuTsM:a9ClYsV0bwdZWSBzXidX2oT7
                                        MD5:BCFFC8478A4D393DD135502017285818
                                        SHA1:FD293A1B4929B6CE38644970A04BAC4D403163FD
                                        SHA-256:59FF52641B302B74113510FF6D4442F094C094CFC36EEF533DCA855D9D4D6ACF
                                        SHA-512:CCE317497D16C7C13E2ECAD0A4B5049509E42A9D26B59AD176C556499E3C81CBC360DBA01BEF5966F845CB5861B09412F24793C9E242081DCE348EFC7B01F186
                                        Malicious:false
                                        Preview:.....7...=..Du.U!..N..Vm..N..-....u.../x.....l......(j.I........."..U..G..."...k&..1(...7..o....S...^V.q7p0..)..obo.EW.DxQ;.....:w.Qe..`....$........h.>.r.[...p...%&..u...\..:..$..J.PtJz-.....];.3..D.u.G.v{. ...[.\+Y.K.M".0{>K.K...~...O..MQ.h$Yx_ R*...,.(^N..~<Q.....#.#..G......XJ.o.s#.r.[.i..#.7....T......2..s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):456
                                        Entropy (8bit):7.503017715999301
                                        Encrypted:false
                                        SSDEEP:12:7Llqk6XhiKQNHnW86N5nSg+c99I5zdgX220IAuTsM:XOYVtei3A9igX2oT7
                                        MD5:85A6DC27D5939FE2740040C170D81C5D
                                        SHA1:28CE8C91C8429C87A9367F12B92FA524BCBA1B4C
                                        SHA-256:598EEB39FF7DBE652B1E49E1C9D55CF08D8CE8D224979502A5AE8238E774A6E8
                                        SHA-512:AB8DF38FBB381631A89389E57B9765DDCF42D4B77C7EB819DC9D0577BF8613F0786D1212F329B1E1C174C1297813D29411F67BC028A229896903645C973FC0B6
                                        Malicious:false
                                        Preview:.0e....<.}<e..T..M....t..P.a.4-b+.{.o.6.6?..-....g..[....k......c..1.\.ID.........o...'.NM..."h...\.Rq.w.1.L/?.........fs.@gk.P. .H.O>..\...h............,+dE.Ur...^.VY....KQCG!.....?..#SG.v....u.G.v}. .(U@I]yM9.rd..[..'.$5<.^.......MQ.k$Y{\ R.E/&.[.2'.c..R.{v.S..".....,)...n.Ak.._.....NR7.<#....z.....r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):480
                                        Entropy (8bit):7.561262376222412
                                        Encrypted:false
                                        SSDEEP:12:Nv1mz4mo9XcJqNgF2wwwQtAsJ23DQ3yXgX220IAuTsM:Nv1mKMINgFx8tNJMDOKgX2oT7
                                        MD5:0AB4CDAE2CD1C3EA1EEB266B30037B4B
                                        SHA1:52642BB974EFC537149593D2E57AF661A14D0175
                                        SHA-256:F597108E5FC5C1CDCE32BE5D6BB2E0ACC5C6B33A4D60D950D38C4E175D19C4EA
                                        SHA-512:B79B604AD678B086D46F4AF0AF6886650952D606536BF32942A76D79AA751E125D0545D52FEA96738D6E9A430E8A9ECCE4937D8B07B031C83898D2C7B65EBE95
                                        Malicious:false
                                        Preview:.....z._.v<..X*z.....ICK.r|.>.XK.vU}....lW....Z..&\.`...h..;.....6.j..r..[.0~e...Yw4...?....o.F.......xL.B..V.1@.F)w....A..E.....,.9..H.\..+.A\............Z...`..rCB.....|....M...........J`.....{..]bkQ.U....W<^..W.0..b.u.G.XOfLv..J.Aj8..#X....@'.$.<.^.......MQ.k$Y{\ R|B.+,...l.x..*.C..PzAm.#Q....J..*W....%........i=a..h.AQY.3c.+.r.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1155
                                        Entropy (8bit):7.844908991062134
                                        Encrypted:false
                                        SSDEEP:24:IwNvZiyDDoof/v1/nVqwTGMuT0HXjAn0YmBv8X2oT7:IKyonv1/VqwmT03Un0YmR8Xv
                                        MD5:61F5FF771F860370C9AD71C6FD8E447B
                                        SHA1:AD063924BD7DE130BC2C9048402FF828265DD619
                                        SHA-256:991A9BADEF9D2F7FB5F0372128FFBFFCB45C9E423E57929727807DAE4FE75483
                                        SHA-512:351EE772FA2D151E959D33D9EB1C7192716DAEC548337867ACED9FD628BFBD6A77289189BD2B7C7FBD25845E156D41EA0D53887C4BBFED7871C5551C4D8A8729
                                        Malicious:false
                                        Preview:?..^............G.9..$..Br..h..V..u.#!.....n.2#9W^75[..ny.R..._uY..{.e`.p,.J......\M.Z...-Z...N.a.E%.&&.9...._8.-.L..............}B.FX..p~b....0......V4....D..r....k.f.Ke..^..H..gzO%....4"..+o...\.p...I.!..xLV.u.}....y.u.-..cq.8.O..gf;GI.q.@..!`..z.1|l.}s.$.c.............7F..2f.'.S.}2.kfE...q.......%.t)..,.....u.7F.u....t.#.DPAC.7P...Q.r ...e..]=u.q.?c.. ..#......>.av>.p.x....;....c.^c.,d......l...E}z..W....C..$#k.Q..G..U(eC..R.........g....t..k.`0.Mn3h...y+a.1.~>&.........n....v1.DA.H.r...=..!.+..o....8........b\..z..63N.8...|..N.m.=TL,f.L.^..W-s.W....=(M,4....3.;ya4.]*./...O.....M..:..AxD...(.oH.G,5..E.!.....D........F<Q'.....CEz.....jB.,.1.......8.].....Nv2.jO.PP......Q....!..e..v..o?..>[..a.FF..}V..$....i3..e+..8JQRX....`.s9.2...-..1=..u.I..s..YF>G.6l.d....O.......\XK..f...i|H..31..6..G.L....^Y.c..f....U..q.Bs$..tN..V.K.g........7.5...V..u..F...?a.9.W...&K*.u.G.vg.0...Y.E#..eu.1.%.0x...>.~......MR.k$.}1...F5..N4oi>g. \.:.cjq..zJL.,.0....K...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):253
                                        Entropy (8bit):7.2188698097438895
                                        Encrypted:false
                                        SSDEEP:6:w72L9mM3ZsXnJ0hwzZBB7wamQThje952lItGIUCKcpqKsM:w7S9mM3yXJgSZPwwcX220IAuTsM
                                        MD5:1CC2BA310C42128802883E9AC5BDC44A
                                        SHA1:182EE5E436E28D33139A41C559E4CD40F0E0354C
                                        SHA-256:A78A59EB4D5AA975A42102C2586038A1FAADCD03A709DCDD286777BE590F8762
                                        SHA-512:3EA365E8AFF4BA71664E26BD8FE73F0A0A401E4989EA2E1FD8DB0CFB628873F0A22645D2C50FCDA511D8E8EF15035C4C19DDCB002F7C1E34DDC57290DC9E96CF
                                        Malicious:false
                                        Preview:......S..8:=..L.?...'..u.G.v/.:...U|PJH...},.=.0x...>.....U...dM.#%...]...a#-Pw;'.b\T..b.....}..._&.l.C"J..0m~._.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):291
                                        Entropy (8bit):7.283353478505864
                                        Encrypted:false
                                        SSDEEP:6:82QBhO8e1CXVdkl2bSCxu3hje952lItGIUCKcpqKsM:U70CXVylGYIX220IAuTsM
                                        MD5:49B17C720D5F86D4DD0F0A872EB7927B
                                        SHA1:A69764AFD10E0AE5B367D5A85A93FF01666CA99B
                                        SHA-256:D9D21081B518523A3AAD6F37838EE469EEAC11E39868BCF90A19FB18868E0B13
                                        SHA-512:20D375FAB212F4B3E889DF12061F43CCBDAE48EB1F1B375381D2061370C3D1B1D8AC187C4763C7A8C73EBE50C3968B9175DA5E4FD41DD908A8D0A88C2DCB1A30
                                        Malicious:false
                                        Preview:1.z&NE.).#..^.".Qr...l...@.g..........z...d.....u.G.vg.0...Y.E#..eu.1.%.0x...>.~......MR.k$.O.0N#..IG..8U...sv.7..s...&k...^.V&.6.`...-.5..z.....+...f ..m.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):253
                                        Entropy (8bit):7.182327863112128
                                        Encrypted:false
                                        SSDEEP:6:gh6FRxZsa0EL6uBjtAJhje952lItGIUCKcpqKsM:ghgrya0vQX220IAuTsM
                                        MD5:C7B4A2CE6946521B6CC531D2CBFD5F29
                                        SHA1:083F5FDA48BA0B39B5641393C751D44C22221012
                                        SHA-256:4458559DB6B4A9CD88A54DBF3928FDCC729CEE06D8AEAC43F236DA635BD90673
                                        SHA-512:E897CAD56586062F741CA6D1A5C063E88F027399AF8F15D2450DD72AAEB6F09EE78D8964545FE23BD463A952D20E710844307756B85A2758EE57C05003411C32
                                        Malicious:false
                                        Preview:.\......VG.Z..4...:o.:t..u.G.v/.:...U|PJH...},.=.0x...>@2.NfYT.Ix...ol.F@1d..NtS.o.W5=aoAa.W..K...X.8."U......'...._.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):510
                                        Entropy (8bit):7.55391912528302
                                        Encrypted:false
                                        SSDEEP:12:R/2TCoUZcHWoDySsDfw8l+KX220IAuTsM:arUZcH5kk0X2oT7
                                        MD5:E38EC9DD58BFB61C44BD37B4DACB2AB0
                                        SHA1:03BD60B192B8AE8DD674A60E7AC79AC03799C607
                                        SHA-256:93E1052842908D63D44E0C96AFCC15813E70AB8CF68721ACE5CCC54FBAF7A018
                                        SHA-512:6D9DD5A6A0674E543A18A14B7948D5219141D29466717CAB7FF8DA2C231FA5ADE282FD9B05DE801F87E66E0637777B13501067ABA1B6DEB5C4EFC38E7F459757
                                        Malicious:false
                                        Preview:i..j!....dF.....X+G_...z.Q>.h...........i..!dtuNQ...*,.(.sz......,...V..@.,".&.....b..^.c..}...|.....9...D..A..K.,VKV.6.....Q.'VS.6..a.:..d.*.(..3.k.,..,...z#n..}.m..Trj0.m..n......?.....%.RU.g=.b.q..x......k;...."gF.Jc.dq.}..ax.._....9&/L....j.J...7...v...F..6.u.G.w.PBN..U#PJH...},.=.0xKlQ....t..D.2O.[....z>A..A.+..E~.......y..f...I.*...x..K...(WE.[.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):480
                                        Entropy (8bit):7.551739107487101
                                        Encrypted:false
                                        SSDEEP:12:hlj3JgVSVS99Kb7kkrzDYTOZgSX220IAuTsM:j3JtVS9UXtPD24gSX2oT7
                                        MD5:40E8FAC2EB58D562DB5ED7272B3B17E4
                                        SHA1:AFA20CC2E22F4199A33408333969A26000C47926
                                        SHA-256:47AF663E9C6473E199B78197719A21004D1644B846C567ACDA6C91E811E7E785
                                        SHA-512:1D005921C152A42E249E0EDD88008193781EA230244B5910E4369FA8F662502C2273D44A43362671440CB035139F5E1835F5AFFC4F816C6641CBDE16BAE6FB61
                                        Malicious:false
                                        Preview:.e.'..Q..........<.nn.,.c......p..nN..t..(X.....w. ....d$zx.o...z...2..[...h.3..MH..l...K...m......%..;Xp8.b.._.5,.....9/..[.<.M.`.E|....6)....S.B0. o.P|...wb.f...pH...?.*$..>C.G.C....[L.#.l:...4...E..(.....T!..f~..x.........2..a.b].EqW..u.G.vd.-.v{1..HH...}~.>.0x...>.~..._...u./zf..;k...B{7BH..1...%..`}O..p)...[&f....Y.H.'g..FO.c.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):248
                                        Entropy (8bit):7.120191925157929
                                        Encrypted:false
                                        SSDEEP:6:cfyuHrIZr+rW+yoeRGLQP3hje952lItGIUCKcpqKsM:cfy6r6+zy+X220IAuTsM
                                        MD5:C6524AD92C8D798C82E93854B7DC35CB
                                        SHA1:0407EB685E9F848FBCB372EAB26A053931C8E3C0
                                        SHA-256:377608FD7AE61C886FEA583800C51FDF56EFDFEBF2D745769415383657AA6068
                                        SHA-512:8757DD126CC823770E3679C8F8D5BD0D3256342369F3176FA4FE1C644E9D2736CD8D191816B7BABD56BD66950BEB684506FFEEEAB2A8F9C146808F8EE0EF25F4
                                        Malicious:false
                                        Preview:.....zb..|=..u.G.XO.L...NsPJX.../,.>.0{...=.~....C.-..h.q.Jh..4..~...OP.B..k.*tV]. ..b..'......)vt..&..e[u.Nb.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):557
                                        Entropy (8bit):7.6382205768927305
                                        Encrypted:false
                                        SSDEEP:12:1ehfHKA8W6b3bJhdygOx4U3iDOJ4oFgYX220IAuTsM:1ufqA8W6b3bsgOx4r5oHX2oT7
                                        MD5:7C12B88182D50AA6AD4A263734DF57A9
                                        SHA1:B04AEDAB0A8FF9204657EB6894FE023BB968D254
                                        SHA-256:7A62C28D7C4F3594D9AD2BD7BA705A77D39D1D6B28A88F67A0A75CD38C256674
                                        SHA-512:75DF8C41A25E2A8C3EE788E8994296A5A265F0A3354830348BAB15AC4FEEBE8BE98621237426170C8058DBCE534BAC7F4016190A0DD11DA69B9882116E9A9037
                                        Malicious:false
                                        Preview:}....3Ad...5......8....R.n.oME*..v....:....e._.z..u..7......%wY....F2$..>.......$.P;.B......7C...G..uy..>.q<.W.&d...3..e.b.......=_..o......._.j.!#...q..=.._.4...A..S=(...^..!.wr..M......TA..t.}v..cQ.>.v..(.j...Q.BM^.....8.kJp.n..$u..*.j.....:@....D52.......SG."f..39^..C...'..............em......e........jc5yr*l....u.G.w.PBN..U#PJH...},.=.0xg.....X-P4.A..\.....`..%s"..5g"....S%cWV..Uu...>.,...:hR.'.][.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):524
                                        Entropy (8bit):7.592659269989168
                                        Encrypted:false
                                        SSDEEP:6:yiaaEpGSEFWD7d3xyoCA5PXzfxfCHC2NStYp1vW/6XgJpKiJ39UYlHzhje952lIj:Arr5PXOC+/pcJn3CYB8X220IAuTsM
                                        MD5:36F93137E88988E9E047F600F004BF64
                                        SHA1:2BFCD9502BAB7824A3079F6F9BE4C4FD84A816BF
                                        SHA-256:CEA8E72D8160409D489857982A8B929E96486DD1577D48EF7AED1F1C4CC5A0F5
                                        SHA-512:BFF0BBBD24394E38E77CC5266BD0136A86EC1AC73C7DC3ECD9CED5C8F478D43B5046FE022400D3CA30DE5E620609519F95723DAA9B7654094069E6393C9C2678
                                        Malicious:false
                                        Preview:...|19p.s.....8.~..f}..Qa.....?....%...v...(......;2Q&.A..Y.$d....WY.Eb}..(.A.Q..9A..^..s..K62J.....L..../f..>..sq.0Wp+.3.'`.Tt*R.....a...N6~..eL.Z.<xFcO...U.p....7Z.#..?${]....k.....V?:O|A........K...VX3t...8.....w.!kG......._.6?=..3.._`...G.NW.],Y..8.......9.....!HI..Yy...c-.u.G.vd.-.v{1..HH...}~.>.0x...>.~...W........}.kZ.......tj.#:doA...n....8.uf....u>L....HcmE..%.c.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):7.234191780075369
                                        Encrypted:false
                                        SSDEEP:6:hahkFPCZNsigTkCqE7WcardyvEmuHkcRnNhje952lItGIUCKcpqKsM:hayVKNsPLqyWcardychHkSniX220IAu/
                                        MD5:A08BB3B3F6F9B077265D2F384D86BC23
                                        SHA1:183320416A177F5C01AD2F7D562B1AAD6AD76AD7
                                        SHA-256:6BA1DAF1F48C5B9D2606B97DE480DF0F9FAC55AF77073148C719E2D6B81D50D8
                                        SHA-512:9D77BE8218ADA51D546838A3A822CA26964AA946B11A9B4B313BF3C4A68E38FC5E319213F93CAB0DE7A5A6CBC5B3CE274D83498ADF37F3CA1387B2BF215EB21C
                                        Malicious:false
                                        Preview:....G.......3-..Z.d.N}2Mdl.}..L.v"&...*0.u.G.v...._{....eE...\...0b...l.~......NQ.k.l-.'..@....!.!.......x]..A9.0.50.8..q.....x.0.j..h...5..j.J.l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):731
                                        Entropy (8bit):7.755279876676943
                                        Encrypted:false
                                        SSDEEP:12:SBcHdFaQgOzinONRDNdBq4GU7mo0Bk6u75n9kti9UZPrcnObVWJeegEW+UX220Iz:SqjaHOzJRDvBqy750EdnJUZzcGVKUX2y
                                        MD5:2C942C2AE1ADCDC163D30EA42766C874
                                        SHA1:266D13FEC448E3FA3B45BCB85BF84256AD975E68
                                        SHA-256:ADDA853EBDBD789248462C46FED028A6F23AAAEDE6B788B44ECC3B0549BD9F99
                                        SHA-512:9AA23A29ADC93967A30FB1EB75D273F2646A96EE447C5EE0F6E3DF4FFA8D4444B5B7668BBA5CEC7308C76ABF6E8784ADCFFD0224FCA7B56102B3C0BBB2CBB790
                                        Malicious:false
                                        Preview:.lir.<........-.%..>e(.N..Y.W.K"...`..o.... K......3.0e"6g*.`....<.di.............x&..Xf....d(..../..+.....}.%Qy.1...9f....nU.g.....h...n..P2+..;..(;T{ V..]..$-..y.or.@./2.).(..F...u.F......D.k[.|.....b0Sk..'........"...ca...a..\.N.B.Z....29#..#...nX.K7.iv.3.j.dI....Z....t..Q.Ho..H~wV.L.....\../...=.t....MS...$......PK..sO....?3..OW.@..d!.]).Lle..5..~.|V....=...`.z..J..`J.Y..:..d.D.$....I...c...>..g.q........M...+v........Xon.:.....@@U..o.pr....{.#.pN~.u.G.v+...J{'.5..E..S.....7t.>.~......MR.k$Zx\ ...e....W...2.......l..~........;w.XR...y..I.fy#4..u..*.&...q.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):7.248587659655394
                                        Encrypted:false
                                        SSDEEP:6:/OPoaIcDgACqE7WcarfmC+PA6BG97Fshje952lItGIUCKcpqKsM:2gHiSqyWcar+PBstX220IAuTsM
                                        MD5:8B7AC42A9A77B52199FEB452234A5402
                                        SHA1:33693641738637B8834F12BD42935977F68A7D6F
                                        SHA-256:C9386801760E97CDF9AA3CD22F2221C11D236CDD0315A0914FCC78308F9B0439
                                        SHA-512:6C582E66283843E5873D7F2E76475C65651E569E3E2B1198E0D8BF3CF12EBE322D5D5143F1017661632628F6645965583B7A977B00633D06DF01E17D083964B6
                                        Malicious:false
                                        Preview:..}.3..0<-..-.n]...-.nBDxl..-m.8d{.,.b..u.G.v...._{....eE...\...0b...l.~......NQ.k......qN.A..<........_..0=.smi.....51.X]...h2....c....'..5.3 .l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20712
                                        Entropy (8bit):7.991308491620861
                                        Encrypted:true
                                        SSDEEP:384:qoFGT6/2tlWpppxNOhBozFUNogP4TD/doq98JQrR9AuWriQtX:qoMi2fCpbABoygHf9ww9AvriMX
                                        MD5:317D0BE9FAC022F5A28184439A0BF5A5
                                        SHA1:8F7C83981B5F47F0E9774D56D82F74EC9A96E029
                                        SHA-256:0F180755FBA622F2808587259DD1B3CD10996E403A017E7E5560AB04F5BC08B0
                                        SHA-512:822F485B21A9FDEB54992C407A8BA26EDF21B535B0CCF7BABA8FEED94A94F2018F0CE9129598691279CEE594C5DBF46CB1E3A348D4541AAC40E5D2A00F3B690D
                                        Malicious:false
                                        Preview:...H.iA..../u|.....XR...m...WI...*....@(..S..ob..J..)...X..f..E.!./Y..\#..W.b.O....V..k1..Gx..../.Z.q..Q......g...)....."......>.t.{../V,..N,...4.P#...[.....U.`Uh..c....ZZ634....G... ....g."....B..j....C..].+...,.?.d.e.p.LO..w.<g.@.[.......P.(]e......q.s...f.*..$.0.....Xr.D.{...aG|....?(.......W........1\..B.8......}U.C..r.%.'.......7.#..q9..k...X..W....&+..N.e.D+..jW........D.;...Yj..[.%..J.+.W..#y.X.Pd...W. &6...P....mP.x.....m..._.~...c2..i....z....]..J.... ....s..R3yw.i...p....`.cx..<...c......;.cY..r..,.>..V.p6.....N.SY09w~i-]......%a#...9.R.N5...........A..r......OG.....(.x.4"j.....B..}.0&8.....tn.P.wL..4].S..]..2.=[..C..*Y...V....G..T...p.4..u.{.D...[.Jy...{{..s.....[.Qj.X...%.2.&p.z.xO}...*.tHswl.#.....m.>a..1U.1.l.....<I.X../.......'.a./q<.^.S.....e..l..i.h4....0.a..5.-.z..A.B..wc*.GY.n.....Z.cy}F#...".n.NV.h...N.{...Ksw.W-../..J(u..4[..BoZZ.A.i...=.....N.;.Y..:...6%...j...V....u..H...i.......s.c.sZ<.T...wE!QL.L.N..W,.u} ..U5.*.(".
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):347
                                        Entropy (8bit):7.313807992411701
                                        Encrypted:false
                                        SSDEEP:6:3Dv/oh7D3quPPZqaVuilgMEGUyHmfrEH+/bhcTQSzhje952lItGIUCKcpqKsM:zv/SbJPZq+ofPt48X220IAuTsM
                                        MD5:37D133B52A18CAC43C2BDD01100CA0F1
                                        SHA1:7D898E002CF22D0EEC9B13EFA60061E54B7A66E5
                                        SHA-256:72FC09A3A82D5B968D81AE6BDF176784946C18DABF004823540B5BB61825AE91
                                        SHA-512:D2E4D9C29F3524F19D265CE1477BC05415788FB975C84A2F97F9B6DF0EC4F934A01EC6D27711E2B86D72E298A5B3578438168F9152D097DD3BD9E1B68C157C20
                                        Malicious:false
                                        Preview:.......TB.;..M.8i.pQ..@..LoM..!..*...3+}..P.!T..Q..#H..-......R.a..p_^*.GkCQU.s...../......u.G.v=.-.h{>.p..|.....Da.....T...n...MQ.9$Yx\ Q*BW?.T0.Mr.A.;aR.{-O..1D..e...7|.....t..-7....e=..?Z.g*S#..M.....2..y.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37113
                                        Entropy (8bit):7.995628010920949
                                        Encrypted:true
                                        SSDEEP:768:nJbXZtCSZGRP7CMyP5ENnGP7ak7Moy+ogK49qqC0hnFx1:9XZtCSERPmMyPWpw7I+PK4M0rx1
                                        MD5:D274DEC575D54615CB2D030108D829D2
                                        SHA1:E64B3BDA560F3BBD69B89CFC034D94DE917928C4
                                        SHA-256:ACF13AD8BF2F9FC6E29967FC6E938884B09BCF802C0FB5439DE2FBE90C1FE726
                                        SHA-512:CF4AA3FC48F98F970D30495AE3798C6B958946347E558E69C920BA94CEEF0224B1CC9A42CDEEE67FDF5D47708A32E582D77B8A01462DDBF4FA480349910D6BF3
                                        Malicious:false
                                        Preview:......w...#.!.q.vj...L.!>}....G........$.5.U.}...b..q............d.D.;...9.U.+Y.....{fGw.v=.+....W..x\o....,...:..}^.O......L.....D....cP....'/.1Cp"...~A.Mts".*..k...{.=...fAlA.M..(Lu.V.....A..UZ#F..#........$0..iC.+}...q....9......2...\................2....c.?U5..?.E1wP.M^V.......Y.(..`yER.?3.f...jy..."...'<M..O...F+.#..*b.j..t...g?>).....iL....`....D"-.$....fX...L.....F...A'........k....w>t.#.G..nO..R..{....W.1R...,.....I.Y." U.u.....5.*G>.Tp~.]...<.g.C.P....-.H...,...C...5...U.Y5..~.h........,...4R./..t.tkO.a.y^..._.UYh.....E.+..h.M.:4.*...q..a5.^e(.'.Je..v...SrE....Xn.=...... Q....(Q.y....@...<..w....8..1....a....lJ{....Y...:Aj.U.S..&...O..[.."..&........=.P.u..fyo."..a..J..1....bsR,%.:..v.........Y..(.8....T..;..x....S...tz..'V...._....\..ho.}.,.jC.. ...+..d~...]..."..'...0....W..s..?D..K....G..{L".'..{6s..M..aT.k.}c?...G..;7.W.:...1s.....0.`.7w'9..NQ..G..2.D.a.c.T..AC.e.W..Cdnl....%..M.L./.|......5.0.dcx."...T...Tz....L,SC.s..N.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):511
                                        Entropy (8bit):7.624673502744144
                                        Encrypted:false
                                        SSDEEP:12:XoFvl/gMNGwKhgZ4IP33AxGBYMhQDX220IAuTsM:XggMNGLbIPHwGuM6DX2oT7
                                        MD5:DD1D144A4F7271617C639F0AC461A660
                                        SHA1:E04545B2E379065FC5F29B2B514DE9084D38DBAB
                                        SHA-256:BFD5BCE59DEA69CBB65A2F2151EAC56E2DF8AF84B8318311F5CD983F89AD9C79
                                        SHA-512:179A68FB502524FFD6FA8CCEF4E04FEEF94F3F6603BE420C2FB901159F7ADC494F5C253C722FC4C782910F19E72204D751CFF22BE1FF7B232EA2F768213BB9F5
                                        Malicious:false
                                        Preview: MAq.....#.s;(..f...u.N.../i..`.......r.*7..:...f..p....R...`m....b+sqR.iG.$.c4.MO..j...AEo..)..bI"e.4....$..0.......d{......I.sq...........AB....F.!iVG....rR.3."0..G...%xBDx..a.p..&..{..[...T{HgP....A....|iN...$T...+....~..:r.I..,,......3[...X.'A.q.p..p..x.. 80KL.t..vd...u{2..HH...}~.>.0x...>.~...+S..@^..l..,.a.c.5O.....;B...sN..E..M...+.a....b....C...XDw.Yc.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):248
                                        Entropy (8bit):7.170555735624355
                                        Encrypted:false
                                        SSDEEP:6:TKiAHrIZGWYppiF+Kzhje952lItGIUCKcpqKsM:TKVr7bppiF+tX220IAuTsM
                                        MD5:AB4CD9EA3E5E467105945653F737C5DD
                                        SHA1:6F966814D4A9F0D4678ABFF54B35761A840CAC13
                                        SHA-256:B1AA5DD15FD4CA12A8669006656B1E9B551D4E33811CBB13BC332ED114D20ECA
                                        SHA-512:78C76B4A717252D3E1EE395E991FA89A5B64AB7CC9D806335CDF06C5640F8164942AD4FF5959430C38F4FF66F08857319C3CB525485EFDF7C5BEE14D86EFCB1D
                                        Malicious:false
                                        Preview:^..<.=....S).gh.u.G.XO.L...NsPJX.../,.>.0{...=.~..'B].]k..L2.E...>...+w.>..i.4..C.....q...jv...[S...3.......b.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):545
                                        Entropy (8bit):7.607628174176218
                                        Encrypted:false
                                        SSDEEP:12:AG45uK9Hi7AD3EZ+ymn9SH0JQ/In7gs5RJXRSpX220IAuTsM:AG45uK9C0zy88Qya8shyX2oT7
                                        MD5:3E34270F8677A5E038321C1E0A5D2375
                                        SHA1:6CAC3DC81424CAE8A2AD780007147102CDED1676
                                        SHA-256:E44DC9AAD7594BF899C2499FC29EEE77FAFA023DC48E4A125527FAD6BBEE9BDE
                                        SHA-512:C4BBEBDAE41A3372ABCBD88F062383262D60A85D6F5043E216215A78E2AFD6A285E1F8FE991B09116BB445807C04AF430659B31441ABB5DD22F42689C76F0E90
                                        Malicious:false
                                        Preview:..<.b..>.x.#..>....f$[M...`..=.$..*.....I.M'....H.. ....@(n..sQ.F^g.a'M..S8...d.%.a.........V.l...Z{P.....v.L...1.KO.%..T/`V..wK....EF.S..J'..!._...K`.3@.&8I..V?tK.?I...7.l..v..!.l6.H......m.Ib`A.f..11.j...K.....].._......#]_...f..'.D.....3..yx.'.,.>..$.n-.....l..VOh.Q.{=.S...z..g.g3..|v.Z.!Y..N......u.G.w.PBN..U#PJH...},.=.0x~.^&T.]..._L...Lg.BQ........m...s.*B..R.......78......P..+.[.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):512
                                        Entropy (8bit):7.624466829378769
                                        Encrypted:false
                                        SSDEEP:12:OH65vpEyMKQzVbaO0B6fYfzTvGmX220IAuTsM:mEpPT4VaO426TvGmX2oT7
                                        MD5:7D0F1979DD7B702DE9712B1A87E818B1
                                        SHA1:76548270223A02C8B6648F2D8AC5E4DDFB6236A0
                                        SHA-256:158461CE968B351DAFB5C5913251E3A3A9D1E5DA67EA137C97143607F9A1D85F
                                        SHA-512:9D3D4531CB6E151FC45902792C4F096AC2604C5C500BD1DE72301EBEC1259B533954AA47CDBA7BE3E11E2534E7CA8CEE8CF0D50AF556ED73801745CEA209E72B
                                        Malicious:false
                                        Preview:E......"r.X8...?..+.G\U..u....g...N,.?ZD.DG#.....w".a\....>.+.........&......9s/.^4.O4....q....ob.h..A.o.5lP%r...[...e549....r.J....K.!....)..\.BH.......^.x...5.....&..........Y{u.-=..(...aBJ..k.(..+x..,.....@Qz8.Q8...v`..$.o..}...$...r|.,9.3D..%S.$c...p..N.(..' ..Y.y.u.G.vd.-.v{1..HH...}~.>.0x...>.~.....%M..v.6hj?.3.0k%...`.a...iY_Ps.CH=1..u.q.....1...../..l..^L.7c.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):7.253784391058288
                                        Encrypted:false
                                        SSDEEP:6:3Mo8CqE7WcarC/jlfF1JVnAhje952lItGIUCKcpqKsM:vqyWcarC/jVnHX220IAuTsM
                                        MD5:97A3AF01615BE8A70B45A15DF91209FB
                                        SHA1:99A248EF6417ECC969FDCC25148B576401717062
                                        SHA-256:F84C6BE2B39164E9FC9498D4D5DE9062A96C83118A7A7CAFD7D09A709C12EF8E
                                        SHA-512:B123CB55FFB4242C982414CFF326ED1DBAC4BBE1FCBC875F63837BC655C3348B9991A859E852A64DE7931CAD060AC1769ADD5C66675E252F38BD7803CAF486D0
                                        Malicious:false
                                        Preview:....ZZ@..I....NR..5....H.6..=.........u.G.v...._{....eE...\...0b...l.~......NQ.k`Wh.......0.SZ.B..jO...).m..G...GOr..A..F...HB?0.....}e...l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):131313
                                        Entropy (8bit):7.99867024710155
                                        Encrypted:true
                                        SSDEEP:3072:uP85KOI8X2pvWnQwwYwXlLAxiET6xL08WBnGGwDp:AN8X2EGVVLAxi2BnGDp
                                        MD5:71B9CF0353FCF162C9831ED41021D513
                                        SHA1:EE80B296EABCAEEFD2AA48FCE9049BF79713D9CD
                                        SHA-256:0DE97D738A8334A5A448B4D634E980F692303CC76DC308AC1E231C9A1BBE1C60
                                        SHA-512:B31E79A8A42F161836EB54A12E931C8CCF253E0D9ED4EC43DCD99E8D199C868A4181C053ABEF8EBF66C41692DA8BF5E829B697072E3AE5FA3FCB80FB9F6D286A
                                        Malicious:false
                                        Preview:I......D._.XL...R6\..D.^.S.61*x.....e.7.q..8q.'F..gb..........\..KC1i....oB.G.a....h.....@}...b.t9..V.[&...+.>HoY(5..^....1po].ui.,t..Q[n.h.9..K..k.AWk.|.Tn.`L.l.).p..Ei....P......B..1..".......k...O.o.....C.......X..v..x.r.}.Y...J..d.4.AB.k....,r.e....u.9..u.;.......^Y......>:..w..H....L|..'.z.....w%k.@...<y......e.I6.]A....{M9../.5...%..].j..A.kQ..!..#9H8.4F.W..p.1.R).?`Z..U.k.F...o{..!zV.~...?[;.......),.E.... ..3...'...qe9....1m.@].......o.d..._\....@p.y.u.lE.d..A..y.(.3.$/T.;.;,..<../q...5...:.t..F..M...F...U..<.....=(..y.=...}.s.~i..W..<.....x4..mX}.Zt.E.)....On6*..F...yN.5..~J.w.R.......D..f.....2...D_1..rs.X..I.)...-..6.>..[\%vA...].9,kr=...V.~v......3X.G...+.-x..8c8............k...G|.*..=P..be...cc;...{.H.r.>........>7..W\T.0.@~.....II2R......$.C.S.).-{Q.J....?^^.[J..F.....z .^..c.|....8.:>..0wB..9..$.y..Z.a..;...v...B.w.................j......2X..^t..Vz.`2.'..Y.(....uEJ7....YNF.}B..O%e.r.`.V.*........J^.......-a.'{3l....S..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1487
                                        Entropy (8bit):7.870477510326098
                                        Encrypted:false
                                        SSDEEP:24:vXMfn1+mDECg/l2IMzf/imfMicP5cSS71lvucaavWjcVVOKRAKnyDZ9jU3OvqX2y:kfAmQ/sI4feL01dufQWjMV9qvDZy3OvM
                                        MD5:5138C574BA871F957BD2EFA5CB7FE5C4
                                        SHA1:06D8FA15B61A7CE937C2E7973992ABD8E7FBADE0
                                        SHA-256:0680B9C01753E39962F72FCA159D6E7B93747EBDDFF534B45788584CF6588B31
                                        SHA-512:A6CFA183DC352FCAC931A42B01A64762B73D1D4529CA9A6FF2E3CDF1C90AA6E9DA9F792FCE4415758FB05D6DE2BED4D3CB091D977EC08DF9220860F2B5DDE6B3
                                        Malicious:false
                                        Preview:....0,\.d....E{.....v..|:......:Q..X.t..aL3.z...#..Q.s...cL!..Tru..Pt!..r.+ufm[..rB>|.}..O6...S......;.:.M.d...Z..\.|.....9..E.>..... ...X........| ...4t1.-...v.{g..g.g.....`....-..F._v.}..w`....F{.F..,7...T.z..l.c.%3.,.Ru.Ar..Q.....~e..ys...sGl..b>.Y.+.........QetV....2D..?8.IY....yq.Yq$c.....4...8...w@.(...X..s&.;.<.C.._.{_jH&...C..8JW...?D~.iy.Q6T.h..8f..m..@.@<X...ks...|a.m.......5..v,+..\ D4...^C..<k^.{.U.T>.go.._.%...._.r.>.........*...6..&00zq....@D[gj.....0.o)x...`.e.&CZ...a.p..I.bxk.de.>....2..-..Z2'... G..v.H.&4...>..F.a.@B"%.&aL_R.1.0.......9 .....z.8..?.-.9.J...t.F..xg..E\.c.s....%T..z.6i.W..d..m...}a....GX%x..G...5..<%.....*..s.4|..(#).%.|.:.........cqtW........*%..[.F...@.X#.V.#@Jle...5m[./...B..t.C.U>.....:j].9.....^..,%..D.....[..@....-...O(...%.O....)vN..$sn.....j..}...u....yW...g.q=.)o..,4g..-..#.dxB.n...i.:..:J..HfN....S\O.`..@...^........'..=s^._...)........:.b...n..N.[....#......5....XSf.RUi_.....O.....'.c....j...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):185350
                                        Entropy (8bit):7.9990689196850076
                                        Encrypted:true
                                        SSDEEP:3072:H7kRHL/LYnvxnopEYDYf2NOLjAI5IuvJVtshgF2HOTKZDhkOFEZhEjPGK0:HGfWZnopN0fLjAIPvJVtsRHOOZDhkO+V
                                        MD5:C001C5B218AA4D70ED9B567CEDF23435
                                        SHA1:12EB92FFC55C138BAC41753C16B5C003A7D15950
                                        SHA-256:D299202FD295486A287B021F1C4957BEE566B44B05588A453D2F5AAB6E7B5387
                                        SHA-512:678950EFD2336B86EC06BCC2D82D92A287BCF0D4AC4EA9F3B6ADDBE7A4D8E6EAE4348ADA534EAF4BECC2D8C854D4740DC3A5FE95DDA7E603805199B35D8D4799
                                        Malicious:true
                                        Preview:...IL.....t..C.....r........:...5=.]Y.w........u.Y.+.9Z!b.I..+..6!.....b..p~..............q....jN.......#[5.Xc.........!..2..'r..i......AU.z.g.^.\.0.j.....T..P\.w2D...Z...$.sSD...o./.r.......hJ.......;....A....>0..6.B..b.Gp.&H.5Can.......8.....^..........G.4=....7!.*.K.......a....ui.MJ..go.!..........>...9@.....}...iqxF.*.F5~..I...W'z....yH,Kq./...%wr?.*.}...."..=......C....u....Zf4E...-I.8.8b.|..T..hA..+S..v.t$...2X.(i.> W.v.tR.ly....S.........ym....].........W9.....e..= {~*.*.y.Hb$.].,..}..).E.!.;x.@....q.B.X.m}..kj`.C..../.Y_....D.u4.[.IG.n..k.{]......RY.v..g.0....#.ii4.6*.tX....c.:....T5..be8.x^...3C5]{.4....[.t...k=.....Z.(..m..g|n.3...Q.g.k..-?.u.<..I...7.Z%.7)....pR`qo.A.I..#..{<.,...._..V..;D..*\....L....kT.`D..{.. .@!.z..v.`..+...U...@,.C.{..%../(..k...RI.e;.Xk1..6..I.....*..3...3...7.........P....0<l......t...e..?.@6,....A...-D.^...sv.....q...j.O.=.a`..g.<.F.F=}.i..x.D..s....E..!U...F...]Z.F/........N...".^."'s...P.8.+.l$...{
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):11124
                                        Entropy (8bit):7.984271124146282
                                        Encrypted:false
                                        SSDEEP:192:BtcWRMb4/NvuEJArGDgU1v1ZQ/bjwOzclXYelHHG7QuZNGvOSYBmwtC6GDnUvM7c:wWRy4/ok8s1ZQHw+YnLuZQv/6N88Bz
                                        MD5:99E2987824EDFEDDECA2D6C9E7EADE5F
                                        SHA1:F82AC105929326FF356701052EDCF1F2D073F509
                                        SHA-256:15D0DCE897CC91C28F921C1979264E72997132EFEB945390110B11309A754524
                                        SHA-512:227A57869DC002C67A1D8A29003BDE0FFA8F12B19585FBE6A929BD554C78E6C7C35DA8BE040AFD00DCA30D24FB1392BDF3EA10F24C5E2E8C1587F3C8B19538AB
                                        Malicious:false
                                        Preview:..6[.L.z.../.......F..n...O~..ou-...:....j../..KX|. ..mDb........&.....],:.....D^.....V.R^...A...U..m.`...rL.U.q.:...ng.?.Z.b..~T...}.....x'......at=....,.M.Ix........ G...:.E.'.g.I......-i.(.....zC........4.c......7^:to.a...mz...X.....|...}A..?.G.G-....s8...|U.`.G....C/.ai.V....F.....+.R...%x....r~k.|........b....kOj...C..K..B,L.D.SQg ..P]e......9P..K*..r.w....-..../.\.%....CQv...k."~B..i...Ca85.s..Q..S......u.B^bbGB.71...zz..K.n+Z^...g....w....%.|.a.....C.\..0..|.o.IM.:..]v.ZVs.\.04....!1..H..`I.}f....7...F.R...M..b..v.Y.A%m...S..(.S""..k...~.,A|...@....6...y.v.P...RB. /.......o.SO.A............f...M...i.KjJMI.+.`.....I..!..._H..J.8.U=..JF.5..v..A...QS.."g...ig..r..2mP..*.L..}..o..c.t..2...........57,.o..:.S.[u.O.....yXv<...'........'....(.0.v+..q..H..;q:..S.......r.-.J'..(.nRb....e..%c.;k}O.,I.T..(.Q...i...)...2...t..QRt........E.f;..4w..Y......b....J.P....*|..%<.J(409..w..6u.L..@..6.ys..k.O.7Ml.....<.6m..k..Lx..:..de......]XO...G...].P
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):227256
                                        Entropy (8bit):7.999254880054784
                                        Encrypted:true
                                        SSDEEP:6144:F84WjYzsNJfkuPVygjAkaILVO0I9KFYbMLlJ9yjofZAsn:FVWjYzsbXygjAcJO0IUFYbMn9HfZpn
                                        MD5:EE42A80284798DDF3154A9EA0AF8E4B0
                                        SHA1:D23E69D132C7B46AB7FE2FD88C925D53E8ABCC2D
                                        SHA-256:52F1C54ECCBBD08DF904296B2559ACDD66EBBAE02ABB242A1255DF74FCF69D09
                                        SHA-512:FEC0BDABCBF503BB2A7E246AB915F3F204CA0A3D7DFE9013BF6854475A8B0C33E3769E2D892B899A2EFD4E38ED1B9EE0686301E115C9420C45AB5D9983608D77
                                        Malicious:true
                                        Preview:.**.`(\a..3.........6...$.....,&...Mrm.z...*?.C......n...i..05..V.f..F......e....n%15....}..1.......v.G.....M....0..B...<..*.o.s1o...s....)..2..`.k......t.....SiV..!E.K$...nxI..,....x....._}...]z.Nb.6<.....at..Z.c.?In"VO...Z...i....v......F.}....P1p..V..fv.....p.Q..&..u.....T+Y^V2..$..VK..}]Q..........Q..x..TB..c.....0...Pfz.^.K.6.....{3(....1..u.J.Fo.......d.0......,J&...7~..X.ovC..(bc.Nh..h.w}.u?.&..'jP....a....M}..V..2u....l@~.t0..h.f..T\.D.y.....`.[G..}..6.'...|..+.X.{.a.. "..g@.....\.1p.f.i.D..._7.w.8g.0.........#h.\....+.s.B~...b..#......e.../>..v.....%....x.U..~....&`$d}..&...z.w.#....PX]....M....! ....2.....6y..5*.... Y...W.+...Mx.|...N......q.......gK.O[....c.o.H..+^$....Q$F...Dw.<....Ue.s.;...'.p<.:..?.*.Uq...9l........0+.1......u.*..j.O-:..v..f..Z..R.xnT.OZ..F..n Y...H#.[x(.^0...<:fL.y..Iq*........c..E.pP.^.=.E..[.6...*....&s.h.%<!......W*....c..Rn.Yb..z......)v9R.g...q..xBFjh+.=..-G.....Pv....c;..x.......e..._
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):556
                                        Entropy (8bit):7.597453952875104
                                        Encrypted:false
                                        SSDEEP:12:WcdwOMZwNVVy7iyGli4wd9VCOauaH8X220IAuTsM:W0wOMwN3y7iVli4hGX2oT7
                                        MD5:81D774CBAE2B270DB2EC2BA8234B892B
                                        SHA1:0181E532857B5F05F6159217DBB68E0887D34662
                                        SHA-256:F72E945CBE9AA2E37BEF92E28F3CFB7BBC75591AD5D2098D8CCFEFA46E9C63B3
                                        SHA-512:625573DDFA3F75BD2A22CE97379C61DBF4297810B97C4C117D8A485F29717CAB9BA01633012AE345A526CB4C7F1C82CE7FFB629B46833E100A9F7562A78F1C55
                                        Malicious:false
                                        Preview:...W..)...X4p..H....yd.~.na.... 8(.k..z.m....o.m2R...p.K...~....e....4E78.>`...o..>.O,V...a.B..<.C..^...^....qL"f4yX.s.H...yW2.rt'PB..p:$3T...*!.O..Z.".I..D...&.Y.....\.....|..f......Qu..Z'..c...b.f."..Ei9.;$...aW.".#...3E..._.#,...^K....\)E2$....r.r....y?...W.I.Ca..a..^.%&`;....u.G.v.......h.S.9.UFin"U)+U$...+...)9....i$tx\ .*BW<.W0.n.X<sm.|q}X/[...Y...4...<.....H.O....'.sk..'y...5:3>.J.{._.{..(..o......^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):560
                                        Entropy (8bit):7.595505736176502
                                        Encrypted:false
                                        SSDEEP:12:RFdDn7Wdn+8KHHqTUu/jLecxotTmSX+MC1cX220IAuTsM:jJn7aVKHHgRicwySX/X2oT7
                                        MD5:456254EADBE9D2275350595FF7F630F7
                                        SHA1:B9F721AC2E0906E3F81DCB3D6F2773280E59819A
                                        SHA-256:566E13DE4C772E9EFF99AC82363C1B85226E2379F95C144978321F564FC2C6E3
                                        SHA-512:9D97974B8F23C1845774BD5D39CF5CD2493A659741B28DC7300C31B8636318AECFA66F36864DEFDD59D565AD21EF8416AF7FC6B654650C6CFE6100147803F15B
                                        Malicious:false
                                        Preview:/.<...4....wj..z}V...........Y.T..S..a.-e.b...@....[.E.1.UZz.<.nY&....nX.QLqq.....1...hL.A...<l.f,..{.1/.|57.HS..m.K.&e.}.y..84.f...<....Z.HC....W....?t..=......z....{J....du+...|.2."...Cz.~.{..j9......z....l.j...X./....u....j.....K.a..}..I1.l...f.Ya.`..r....g..b..)B.3..%....Js...m.u.G.v..+.h{&.$..k.}qI.v._....hDW...N...7x..:.y"R.BW<.T0.n.[<s{...f.S;D...p>.\...L:z.^..}.Y.w...D.....kE.h.?f...=?.5..*v.P1.Y'd......^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):557
                                        Entropy (8bit):7.657025267314036
                                        Encrypted:false
                                        SSDEEP:12:0TFZbPhtkCdzTET2GLN/SOjRBvCElky0ZX220IAuTsM:655OjPk9ZX2oT7
                                        MD5:EC173413B28378F23CD02E8D62A3D6AE
                                        SHA1:84D2A859CC13B1A022D77590442F8AA13C5D506C
                                        SHA-256:9A89A6F071A84E4086BD116ED099305A5E225BE6870C1709087FCE268F821634
                                        SHA-512:240EC089E1033B6851CC547DE405CB040AB76394AA22E9A94BA6DC266A55B47BFE4A6C5E9FDA70013C3A5208DD1014A7EBA46AE66633F2EB0F02AEE4CF593183
                                        Malicious:false
                                        Preview:.....hUyo....9..9...g.e...0.#`..R8.Ta._!.;.=Fs:..^5@...).......z;3.h.3@...#w*...L...I..)%..(.rY_...|.,....e........u..$.et..=.D.If...'W.;.-rh.>.0Y1v.:)[.H@.p...mM/..$sO.[pb...fSM~.uV...(.E..y...(..=z#v[.H..O......&.Z..$L1%.....g.'.........5.30.w...}4,....t............?mj.5..u.G.v..+.h{&.$..k.}qI.l.W....[.[....L.m,..OD[xs R*.W<.T0.n.X?s{.b......w|.~(....j9.#......d.?:k..............o..5B.b|_n+~..n......^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):534
                                        Entropy (8bit):7.625919950554018
                                        Encrypted:false
                                        SSDEEP:12:nAbe3HG92ro8O57xtx4/7UyrX220IAuTsM:nzG9YORxSrX2oT7
                                        MD5:C1C08AC15CB226FE4F56A8699B489087
                                        SHA1:180A33655FDBBC29F01FEEF99A9357597B0C11EA
                                        SHA-256:219FB0668F10D90C926D62CBEF49AA24738EC37E83CB49C04AD412D654BA4C1F
                                        SHA-512:62D36F0E047E370E2561547B7B73B5D91FAA351DF4E349207A3E21FCC762C0A50D96266C58BEA62FB2CD0621EAAF5F935B830DAE83C45E41C9C8505F04B44E28
                                        Malicious:false
                                        Preview:"...}-d*...7.2......o.n}V=bi.....Z...Oe6w.B.<#..~QwSa.......u..b..i..=./%....+.j#."..G.^.!.l....Q.d<..0.5H...Y..m.ukF...Yw.8.N8.t@=`...md>....l.AQ....5_.C..._.R..|..Z8./$..f..,..+E..o..Z....r.i.3...EL\)e....k{..&e...w....#Jq.w..&rm....|^T..B5......H..0E........Oc.y.E.u.u.G.v....[z..].U.D.b:.P-..F:..~...O..MQ.h$Yx_ R*l...k<.Ub..Z5.Y......7..>...&X..vOk...sC.X..>*g..@.r.....-..s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1514
                                        Entropy (8bit):7.888500981053674
                                        Encrypted:false
                                        SSDEEP:24:hN0WGJaU0Y5aYRJBY/AqJWxfLKkO0DzVvCvbpjgjGguowgKZx95hVsxX2oT7:6uWX/2/Aqkz80tCjpkqk+x9lsxXv
                                        MD5:ABA253ABA54474DA253D6B12E67FCBC9
                                        SHA1:168F34F74F5C7FC9F403A61E7E5B46DA2ED8E11B
                                        SHA-256:847352596B924645A69E6EFF50724ED9BD7BCF8696096ED67BDF66675F303550
                                        SHA-512:CAD41BD1E7456363BCC19CA72D3B757B9DBB936C2A89E04DA938F165192CE33C551C58B8A5C40AAFE18F914294CA83CCFCAA2AFE91D191A805547EE145D014D2
                                        Malicious:false
                                        Preview:jP.....k.c..|b....<_..p=.._.w.!.........u&j.m[..).....o..g[..#...B.....J.R.n@......~f]....NS..E...*..W...;...fM.,&......N...bE.{n.1*......b..]R.i?.P+...3........H.....=.\.n.-.r_*..z...Rm..a..T.Z..TAzF..5.*,./..g.d....N..(.M.......}...A....}f....t...O.0.^...........s.......Q4U....`op.....6....y.#.b.;.....Q#..=..Q.Mw...?Y..W.8..h..O.....3...i.$.w:.~.:1...C7{.`.y~Fx4!....|../!...eE.Q...6.........z.".,|.py\.6......[.......O.>.e.\..7.6l.1..S..T.H..D..Z.......).....Au.k?.U.x......a.....3.'i.6.H....gA.}.*..........X...ML......:.7.O%.FV_:..h.zA...:b.7Q....."z:...........m..V8....Z...`...o..S(.....].\U.....1......H..m9...".yr..6.....;.-&...;.p.if..B.vt=}]|....Vf.qY2K%...3...y.4..D..y...(h..{.........nJ..".%...0-Q...;+.5c.....m.aOG..g...e2.f.._T...O......y.~..#.....g...Ff.&F..ar....i.....+.R8...5H.<L.d.j.......Rl...<c...r...jh...H......S.`0]P....Y.%..Am.....@...~-.<i.&....3.@.[....bV '....I'.T.......`......o.\(.g....x5...y.,J..1.B.....5swb).#....,*&.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1507
                                        Entropy (8bit):7.868095538314975
                                        Encrypted:false
                                        SSDEEP:24:cZjml+ekg/l0+NfmJ2bk4rnEc7Dkt9aTT6RWka2BI6QP6f7J+eo9akC0AKX2oT7:Ak+e5qYfmwoKnEc7wb74koCf7bHkC0As
                                        MD5:F4FCCC9B6C8451A158C3EA9D87879505
                                        SHA1:04E8EEE92C5C5D96A68444E7EE3072933C0E1474
                                        SHA-256:972BCA811D03AF540DAE421EDDD80570F509C1B0572905342DEA732EF77914E3
                                        SHA-512:C7E5A1B33C83B00588B5B06F19FF63F8CB8DD126BD48E4DA13690A59DFC5109704202C5DAFCC408678925CBDD8AC9E0537D122665405B17BB0AB20BB0574DBFB
                                        Malicious:false
                                        Preview:.G.@x...d.|=..e..f....-.......5......x.v..!"..D.....V...%2z..N^..xh.,s..~..(..h.. w....ZP...,..i...F.72...uV*8%,....@. .`..g._\B.|..1-....D.|e).....ku.....p^.....R....u....Dv._.{0b..7.'...B.c. ......X.....gM.*..U.{4.^..........R.1..E{R.....y.T......r..[&.J,P$.k...........TZi.{.?.k....,=Qq....N...t.m.x..{[..n .Ft...%....*=..I......h..u..0..f.yG...........ny........0...*.h.....6~...th...z..N.....YtAY.R..}....n.#...J3L.....3.....+.....G...+.S..Y.K....x.i.H.kg....-l...D.T..I1.e.X....[..."!..pk. ...".Ea#V.k.w..a...FWfA.`...c.E.S6N,.........$.......cb...J..xJ........N@~|1.........53.8....{...Z.M.x.g..&[..$H6..K..v......)......!.e[!..+x........;..9....m..5..x...d..Y.{.l..7..y..aYz....p.;r..q.6py.h..1....)Xv.-m.....,(.K..6J..._|..kKO.j.B..^....c...g(.n.&Uh65......d.....7[...a.+l.'H...8....a....5...?.......]:7$(.'..w.E..G...<NJp....f.\k.b'....P~.0.z...0..' ..[P=...==.......g.F.Gt_..+.....x.......=.jtO..H. ]E[..>...i..).....{.9.....<.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):552
                                        Entropy (8bit):7.625238708844416
                                        Encrypted:false
                                        SSDEEP:12:iEgIzxnNzEqTUoaDdy5biRdHtRhLepiJPAf28ZfL4fgX220IAuTsM:9gIdNzDToDd8biRbRCZLUgX2oT7
                                        MD5:C206A2AA597FFA7A631F3F2F04A698BF
                                        SHA1:41571C394FCDBE8B0377C9007826F9EF4A6D4929
                                        SHA-256:B9E2BECA3B9365C41D6123A596F47AAC53A5D2FA57D1E02B91581E8FBD5995C1
                                        SHA-512:053BDF583669EE5962ECBE52ED6AFB4037B9305A4587B046263544B5F5866248C96F390851F8CD6649A80FC719F907D3D0D26689C3F8F0AB809A8C19FD618E73
                                        Malicious:false
                                        Preview:...Cy.-#o.q.!B......p@.....!...n.........A2......,MW........U....+.....F.Xl~'......f...W.K...-...f&.%..u..."........t&v"...%..P..F.TV.2.L...h.`.#Y..0.. .:.6.k.;v^..6........:|.d......;.W^....9.'DJ?..U}>.....v8.....p.fJ.F...?.I....tn.x.....t.5..g../..f..}.B$>..#.;..l.u.G.v..'.{{1.]8U9.xa_.].|...Sr..V.....\1.k.Yx\rR*BW<.T0.m.X<>..N..g.W..5.i..7.6G.......[I.$.*.:......2q...p9/....*..Y...~.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1486
                                        Entropy (8bit):7.863535002500099
                                        Encrypted:false
                                        SSDEEP:24:XAM+eJ6sO5pVYBfD05HCJpihXl0e1jLvo/0r1M+IUqLoXP9UuGGSQdD0X2oT7:Ov57UD0pCH2Xl0e1XvBr1M+59+Gf0Xv
                                        MD5:8D7FB5762D4946500AB41AE5799CC237
                                        SHA1:C1747D714CEDAE7FC649A15E1AFA8D1B5CEE1E75
                                        SHA-256:1DE5BECB11EAAE32EE6AAC2CDB9D0360A073F20CFF717DDA5396C1E8F2A5393B
                                        SHA-512:B1A33B7F952CC38F05D590629D42821CA95A25D8BD2E7BB7641235716BA6640EA61CBB300D0A5525E36A12FC26947422806C7D2074E70698EA854BD144ABEB91
                                        Malicious:false
                                        Preview:.j.X..4w......T..B.x....F..A.wG.....o....V.`*.Z=o.y.....`Iz2..*.....X.].......jWw.".3N.o.....T._.odg&.......=]2.ao...........r6............VR[u..b.+T..V.@x.W(.6cy.....P..D....J.a..l5...(..g.....-0.+.8a|.h....^...@.=...jS)....`.s....&5.l..U...U........>Q7.......7..P=...../(..:..',.@....1...p....K.l..J.y.w...*AS....A..I0.?..I..=...PO...!6.Y,.......p.88O0b..N..........=.=...._Q9!.>...T_...H2..`..].d.....8&v...TR.....{.9Mj.(a.?=..@..w}..~._KU.l^...F...S..93._%..c.?.jf.>.....*.D...N.D...0....=..9nx.....2.q...i......6s..hPEQ.....n.#.#...)...."%.....5C.....d.'0T...x....Dt..c..]},.7.S..;.GK.......y6...G.X...Q.....\e......mU...2......<^biZrS.,...B...;..a+......`......QG...%2x.pp.7...(.J'.L].'\..._.o..D3N95..m...4X...i3...h2...+a..>=.MG.,..k..+.s..+!z...n....u6.Yp$.i..r/>.6.Oq.Lp.i.}.=..q..zN*...7g.........c................VA.e.J0Hl..].-.@.2V..89.r.(.*V."..J.Z% .v...".oc.1g./.jF...[<.(%........ .Bu......-M.HZRQ.w...$..e....{.-yd/f..2*..L;....UT.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):558
                                        Entropy (8bit):7.6638907262319425
                                        Encrypted:false
                                        SSDEEP:12:Ax4PJdZYg4dRqtIHNJZXEzP2MEkBMolwsX220IAuTsM:BPHGg2RyItfy2MEkBM2wsX2oT7
                                        MD5:3123BD863BBEB4D3EF43AF620B65E744
                                        SHA1:3F61DC11A958E24C8E7880C5F5A7A3D356EE5439
                                        SHA-256:54AFDC737C80C36C603B513CC75B9E3BA035E1C57D961C59A6BA550A31B6AA4D
                                        SHA-512:8B484A70AB343356C4E626BAF8E9AB39C0ABCBAF974D0CFA0304AD773A826389C40A9EC777054474987E47849AADF9403E4E49A350A94B3059B4A48A5B25D656
                                        Malicious:false
                                        Preview:.g..x...................$So..)..~ .J..b!...U........z\.{..........B....h.Gw./.......L.)...64..w..(e.Dnk.\.9.Y...M.d.V..;.l...%!iZ.=-...;......[.Q..c.2.....X..9..4mR.....w.'~.Bp...... O#...c.h.z.....$..Q.b.|....[l.>,6K.>C.*V9.c.D@.(.-..5..@ik.r.2..g...#...|..5...... ..nr...p.u.G.v..'.{{1.]8U.e~.A.'.|..D.jnO./...#..G.[xs R*.W<.T0.n.X?s{.m......]j...EG.i&... ..N..#.[e.v....w#...p|Yg.....{.5GS.\.j........^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):545
                                        Entropy (8bit):7.617353660461216
                                        Encrypted:false
                                        SSDEEP:12:UNW5NgI5wvZ8Hopu37ra8Obh0uJXPH6LtlcX220IAuTsM:UoxouIpI7cbh0uJXPAsX2oT7
                                        MD5:6ADE45DF762AC964E01EA03A3BC20F0B
                                        SHA1:96304ECCA2B78E2C46CE26362D63B7386EE2E9F3
                                        SHA-256:96DCE3CC4B1AE022BC7E159E5274852AE460604995BBE97FF09704A3A1A70C9A
                                        SHA-512:C38169811E61E648CB0D46FA720E66EFA61FBB112A80C08C43AD06620427E732E78757069586190B380F382F7ED3882E7D4BB743CEEACED99F00FF997C295BF9
                                        Malicious:false
                                        Preview:AxF....4w. *.e.xj..M..z0..F.\(....CG&.q.6...t..9...R...g.....%.3\...H...W..."....p.Is...,.C....Vn.>...D..;n.......ii..j...q .\..f....z._c..P.....\)./w..iE.[L.0..........]Z$.....>...3...H........)q... b..".|3.eW....,u.HtCN..gum..h"X.Y.p..$..(./:.B..J..T.{..).........J..{...$.x<.u.G.v..'.{{1.]8U.e~.=.+T.0wD0/.C.....eQ.kvYx\ R)BW<.T0.?...}.w..f)J..A.....=f.#...r.x.E.tv(.t<2Q.!.Z...&3.t.d ..ZQ.z.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Secret Key
                                        Category:dropped
                                        Size (bytes):1643
                                        Entropy (8bit):7.90696935310479
                                        Encrypted:false
                                        SSDEEP:24:Z11/GVYJi/UOEmBcXD8KhaVaC5C4+A5HNNh2JRti6+W+VXKzclgX2oT7:nAZBcXDjhR8C4XPH2l92gXv
                                        MD5:ED38B0F83930D8614F986E9901740EA6
                                        SHA1:B2C6C7FDA91284E915425AF0FE79134562664037
                                        SHA-256:2DBD610E49B41C1F2FB59ABA1DB941E7AD53B4D20B5ABB0CCC7CA13B72135B28
                                        SHA-512:228F941377E1D27BF7DE0E1DCA4130E95C098267F0E41C3F99F171021303E2771DB12E6F82DB5A19784F4AD726919602E8AF009A3C0771B2E0F9F3BA26422AB0
                                        Malicious:false
                                        Preview:..[.;..`'.6r.....%.L*..`F...4X.^...y.?.!@....Z.d.-.........x8.09.....2#*..x.-.7o.j......V...}...[.V']@"3.}..e4*n.vZ...C%..:...r...w....p.+.......v(.\.A.S...,..V-fvmH&Z.........|.t.<7s.O...B.C8.I...WvY...M...T..fC.J>Z..cv..A...d.X.].; ..)SF......o..}......P.S.#.wLR..<b.9.XD......=O5...6....[.0.2"...6...i.....,l.S.d6...W...8....L.yy.q'a$......{..4..PH.|........W.{$dIw3..........&7.qlGo..S_...X{s.H$..^yG..T.==...nO..m.......z..1f..-....uc.Z.]{.:.O.!.zy..L}..8...A....`3`6....7n...}....ME.......x. .SM.....j.Axm..u-_~....(...P7..D...R.....1..o;wbu..a.c."p.D.8.4....O.Q.J#._4...3l.N^........=^.._..j.....{.u.y...l..C+.....$.5.7...^h.l[GW..c...!9n..--....R71.*.1...[m..)..+..A..>.....,..1.J.K....OT....x&).......D..........>..3!...O..JG..k.o.V..o..8.,./K>-..-.t..YF.,ql.w4..w.....98... .=.x.9R..._.`7..?.s...-.p...G#..].~....y......ZY...e.....A..XT..a.sT.;&...Z:.9.[...5.&.!..[|..N......}}..-|..n.a..Klo....^=~&..P....*...3.z...Q#..3....6G....Ja;i
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:COM executable for DOS
                                        Category:dropped
                                        Size (bytes):548
                                        Entropy (8bit):7.574510895441286
                                        Encrypted:false
                                        SSDEEP:12:0EbbGZXGJv77pR+zkuqdBa7+1VAwX5Ua3QjAzCBQMtEdzZX220IAuTsM:0W5v77/+lqe+1VA6qaQMWeM2TX2oT7
                                        MD5:EAEC4C86E4EE96DCA6A34989D5B1EDB9
                                        SHA1:7DF5AB8E183F8BC5DDBEF6CF05AE5553F1E5924F
                                        SHA-256:49C7230F8D59ADF5242558036F70712B93233575CED0C86565281D70AA9F30ED
                                        SHA-512:80879FB25BB25D25934FA68A207D3CD3540D10EFED0375F96896B9D32454263B583A65884B6B6809B41A7EFAF62C019D2D51897AF245606F452CEB9456F7B714
                                        Malicious:true
                                        Preview:..DVlN|.XO...6.f....F..{.#Y.'..h=..ul..%...+.1. ...=...P.2].mG.|.x.)..V..}v.d..s.2D:....s.:Q..b....$T#.6......!@.r.O...U.s...l.Z.$..}.......\.-..+....}.......$.te}-.O....L..........9....>...0...\].?...L.&;....q..nJ.......`.D........l.N....@...N}roc....JqG.$Ncb.._").....'.X........u.G.v..'.{{1.]8F9..-=..v..V<...<.p..9..Mx.k$.x\ R*AW<.W0.n'..d..~0T...;..6.......1......J..2..".|.....j...f.=.<.T...\.{.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):538
                                        Entropy (8bit):7.58167002661248
                                        Encrypted:false
                                        SSDEEP:12:4ANgLUyjBZdJ41a71567SdTogTNKUX220IAuTsM:s/jTvaa7WSdTNFX2oT7
                                        MD5:EA6422FFBA71F0F2F66C72F0E40ADC76
                                        SHA1:B0F8167B51FACEC1A48192FBCC458EE9F0FA3751
                                        SHA-256:46CA390FB93599C28186CA2A306539765D5E4B85F865F1D3E10A322B1EE24487
                                        SHA-512:16EDB67C34E67CF964833CE8A86105E9A19A31AA00C02C48846858554E13CEFBC868B447306044685F0C3DCDE36AE3CF83EC10145C25EB53E5218BA680B637FE
                                        Malicious:false
                                        Preview:.C!.Y....|...!)d......@.k.c.~..?t..Q...<-..sC.....,i....@..F.Rw..O`;#.T..-.@:....^..[^.mY....;w.D<.&.2d..h./a....%.s.I@?.........`V..`\{=.X.m.N..)..4H..k"x..q..8...@.#...:/...T.KwC..2o5.V;p8.........$......9.#.>.....(....68.Q.;...K.2^....^....I..8..2z.....:.c.P.uw.(U.k..u.G.v..'.{{1.]8F9..-:;J.^..}.Q.......MQ.k$Zx\ Q*BW..X.w=..c.Bxe.cA.'.......$.R.?{.]..9.s.Th.m...>nE.?....;I9.|6u.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1508
                                        Entropy (8bit):7.881091139033932
                                        Encrypted:false
                                        SSDEEP:24:g4kRtE0tWvvAvXCNsGJhFAX4X44lCwjlvqfQrAFT3K7jDIbQY4t8B84Sn2oX2oT7:grnEUOvgyuG7OQ4tKvqfQkF7KMbr5SnF
                                        MD5:780A27CC188C5E4A102F2D84601F22B4
                                        SHA1:FDBB29C76A6B5693C1B67AE4CBCB1AAC08D3D61F
                                        SHA-256:1936C006A344DEF3F49E51EA4C04611C928E058D32771A9005C5AC730B08627D
                                        SHA-512:DA6062140508ADC9EB8830ABF5163D53082CDA735275EA6968D6B9C0CE5DB2FD2C991979BB6F216A2568269284B2753CF4819B2ABA3478C425AEDCD4C2E3458D
                                        Malicious:false
                                        Preview:.B6.~]f..T.R.9..[.A..85....K.F-O....|../..o1.cT=..lWP..jU.=.............T.L}......T.Q,..cwX\...h.y.g-.s9..j.%|lTv...`.}.e...t,iJ2./...qWcU...G.."1'....R.`.C..T=...=.R..8."...........YI@CX'?.=...........30y...._......K.x......c.6.s...=...qJ4.....d=$..Z.5.2..2Z..\TL..V..u/z=.......(..z+D.Y..Hm.*.Qc....a......Z.#v#E.#...m.V9.@...>x.|.;..._.n\._.J....^-&.J..100...-......5y....#m.s.s.-|.....r. .4..Lf.Q.{.......@iZ#H..g..j^.:y.a..\.....Q2.\.+.... ......>...Nk........Y..}5.+..>.B.P_7..)B...."]..8.,.U..;..P./@...j.1..u. .."...-....L......j....j..!S;.]'...RuH.M...f:./......>..)...+..xu.e., ..qIf..>X.E...b.h9..=&,.F/.....M...8.'.{.....;.Sc."k.G.... .?.t.......1/..&.n...."..-X........+.....Wi..'....PB..gP.#-.l......V.....$.[.E.4.....Y...i...|#.#.).......aa,+...!g...y...|H.Z..d.y.A.j..g.~...C@,..*W.k.p.m.-}....a..8.....(.6n..r.........[.Y..Bd.NV.1Y.....{..........u..1.I.]..Q.8......j<...S.....\.4....Zq..:.q...<..]i...1.....p.x.mC0..?...c....%..[.l.ls.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):5472
                                        Entropy (8bit):7.967929402042464
                                        Encrypted:false
                                        SSDEEP:96:cgnoNHkMOZRhahTzU4OLzY06DloBs3CQcD0T8ppexCz9BiuQ1bIaeaBraROgHn:joN2Zer1XDlD+o7ucbIHaBrQn
                                        MD5:26964A921DBF261C18EEA5390D166797
                                        SHA1:3985CC81499628A1B5E5E626EF15BE447D809BAA
                                        SHA-256:DCF445BD7CD2FDA14D7E7980C124921B785A25FF70C4A56868F63C125AFF0120
                                        SHA-512:93105B09633ECF9B8DE82B734BFD6EFDC0944E43F26B3F2E1A76D17AB8DD8D7005AB0788340BE715A09436A7BED2F47BC26CE276A8F7CC35C6C3D2B04996BB05
                                        Malicious:false
                                        Preview: ..:.`.....*.$...V".._...........t.0.h+]9@...qX:jOJ#.@#sG...'...P....2Pc9.2.:w..<.MJ.6EZ.B2>.._.*.G.... `3K+.~.k......;...88B....j...<.|.........K..e+n..JX..v.N...#.r...N.k7......./........(rI.k..w......jB_.......X__ .._.y'.,.T.-...G..GH.o..~E........@.,M.{..f$[...]..W..a........Q.K..Pzk.t.9....47.~Q.d..:w.H.........J...AD.(.j..04.v..&..Bc.n...$}x...k]vE..xG....Y...:........,.:hP....X%G.j...H.Q.....//.%....aY}.m......"....o.,B.]N..X..S.......R...+.......O...7.w.P.,....h.z"H.v.a.v...&<..P$V...0.4.........".n......z..C.Vs6.d..A....!.c.D.PCR.A..K..o..]"F%>P.U..(....V.@.E..3=.IWT................H.nf.....e$.=..%p..Z(&.9.\..sj..U...s._.V.@.c......}..RUb.>y8.O.<7..m:hb.r....|.g......e....tyM..u...]..|d..A....t...L.1.u..!..pe.......a...3....Af.X...J...M.f...5......5E......|.D.P.b.[...........rW..A..mt.,FrF..Ld..7Gu.?...|..Xv.+..z........:f...i.../..}..y.>R...a..e...A....I)Tn.....Y.;.e.~.^..U....~..R.......s..m.GZ.,...x.]w..hs...'..=.&..{K
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1031
                                        Entropy (8bit):7.807823116439989
                                        Encrypted:false
                                        SSDEEP:24:KalD/nZqlUtMbXRLO5imAfXrUwb83JAhTDN8+aLNcX2oT7:zlD/nD4XRLO9AzXIJAhTDtXv
                                        MD5:AEFDDDD894A6E1362092F7BB446E1EA1
                                        SHA1:7206AC40DCD0A24742AC6A20039065BCB2FF2D74
                                        SHA-256:6256401C43C9113A67BE40BCBB2019EF956F456240964E9908BCA1C3CE505672
                                        SHA-512:5DEFF76A6ED98B28C3C75FADEB3B5F5CED5EEE3926A3CFC8AFCECFF89BE8672E3DB436D24A20BBE8401197FADAC91883055E204BFC1B9481BFE9233DD33611BD
                                        Malicious:false
                                        Preview:.:.].U+..=...x..u./4...!.....m....@...>...6r(m.q.c....a..d....~..rv8..p....H8..../d.d..V...U....7..?..a..&.#1.s2.v4]. ..h...^;....FQ.n+>j`..t.'O.B15 .*..igD%5..T...?zB.p..~..N...x%Q.-...Im.B.pA!.o...N.F.. ..z.Rg..p.=.$,....P.z.Mh...%..T..&..6..G. 2.......^.]..3^67..D..+...f..A.*..Op..D./.Hh..W.~9..=wLK...6.3...7...U.........p.&.Am...d1....._.b.......xv.!.zm..Zv....;.b..j..........I...q~..@.....%w$.CB...;.~...!.i..+V"*7..v..;..w.{Hb..............'O.I./...........M.....>.\...@.`..........(.....T..[.......x...x.u.;.qzs^.....!i..{G'j;..C..M...6..Z..%.R...=N*}..Hi5B..j....M.x.?....-.`.#D.....FWXv[.B..j...../.+=..-.........Bz..E...|. .`...1..%),.V..H+KE.C....7...]P.\!4fJ97.$..ow@.G.....bC\..4.S..D.k.]..+]..W...;...{\..U..E.......ZK....u.G.v>...S{;...8z."lYtY.....<w~...O..MQ.h$Yx_ R*).@A-...k.p`.Xvf..3Q.?`.o.NQ.E@...Uu.X)b.@..2p8,.T.)....*y..Y.s.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):236
                                        Entropy (8bit):7.1239199560314805
                                        Encrypted:false
                                        SSDEEP:6:b9euVZTbw8HcFhje952lItGIUCKcpqKsM:Iu7RHcqX220IAuTsM
                                        MD5:52E0FEFAE006FF412D3C36E53156648F
                                        SHA1:2241D5E4DFEBC1499AAB86731A8AD8CEC0A95052
                                        SHA-256:D49BC225135CF0221313FFEDF5D0B990A45D699C33BEC3624B11D47C5E15AC1D
                                        SHA-512:647D58F5481C5D829F7BD1485E57D777EFE174656AD5C4C59AA6F4EFAC0752A44E2B3C0978FBBA03A5F63F8D06DC153D15D6405D4950C3A65036F5211F684BB9
                                        Malicious:false
                                        Preview:...I.u.G.w.^.[T..GRJX.../,.>.0{...=.~..\S.O..u.G....O..Q.q..m..A...A.P.L.F.......&#........XL .?.b.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):3059
                                        Entropy (8bit):7.937530092615867
                                        Encrypted:false
                                        SSDEEP:48:sPbyphbt+VSkyY6cUzd+17xzF2dzIYw3r+LoVngjqjEMhsS6pdNfjtbr2BqopJGx:sTyphwckp6Xzd+19gzCbioFegpKpdFtD
                                        MD5:C0A3A7A54130E1B73EFFE7F1D8A27185
                                        SHA1:FA209E57270591EA98E4320B63F6467EE1BB40AA
                                        SHA-256:08877C22DE37FC8871B9060825C565CBF5B405C3BB7D23A37648E0FEA687CA93
                                        SHA-512:57FA2D945018D26D4912FFC4ED66F35116B70E9AC54BC6A1B4AF71CD86A145BA524873CF99B0466E9254FDC0E83334F0452CB4AEC3A5B265673147613898DE56
                                        Malicious:false
                                        Preview:..[..R.<..!.I.j.-S.......E....T.o.........k=JA..9J..7....i...I?=R@....&.......`......<"ZE.h.H.....-.Z.A.Z.r.P..W6.Y....i.ws........9..u.....%.2./3<+I..B^H..s......AE..).Q....km...T.!.........?.O..;..!S...........}dO.4{.v....J..5.M....M.S...9.d'|]..+5"N....&$......d..gA..DX{...?u..l.%..u.eK.\....$..<_..g.pg.:..;.......S.-.G0.&......P>.. y^y..^-)a.XLQ.j.....\..'.[..}n....i...V9..\<n...+&...D..].......~{..g.c.[.R:G.......%..f+...u..UN0.t.,.e ..>p.k.W_...W....Xt....F...\..[o.....'.#.(.[.1....U.....g....a,.......i._.i.Hj..ka......-.=..Y..G.....$...4.....0-6.b.....B.A""|..-.V.F.........N8..5.Y5.......+.....Z.l..$.Q,A.Z{...4.........*".i.U4..]....9.B.P.....\.'G&4....UF....,@..t..}g....d...k0]..I...>...n.uLf*....h .C..Sh..S..r.G....l..(.i..d.8....T'C...J(V...%..R./......a.0e.B...^..../.......a..a+....WV_)....e.ue9....+..".._b.. R.D...V.(.xl.l.2X..#...Y6>.C...4..5M.i..3......j..P0>)ca...ci........".....h..."...#.Z>.3...j!..s.....'.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12533
                                        Entropy (8bit):7.9856278740183315
                                        Encrypted:false
                                        SSDEEP:192:jcsm8OZ0+SkHz+44/6lp+eShtQ8W4cHXwrk4Ud0Nrfsxi4DEYqLfYwqg:DkFS2z+WlpohCTHQk4OgjLwg
                                        MD5:5B1488DFDDF1CA9E18FADB89E37FC70B
                                        SHA1:0AF456DCD74442F83397AE7875B3D89F9A3A1FA1
                                        SHA-256:EA94393B511364D05E4F1034C825F44313ED036A8BE1ADC8EC77CC941970C48D
                                        SHA-512:ECAA22AD93D2A943D8F0EBB57971A5B084EA98B1F4BEAB840E2C115F843F34E981A234E06BD7641A7473E4ECB7100DBA3C8BCC5776ED4F22664E06A8AC7DDD3C
                                        Malicious:false
                                        Preview:.NCP.....@l...-.~.i.w.a...V.^....5...BE.a.././...C..*j4._Iv$._.G..+...5{c2...[..R...v}....i....Q.......6u....C...^.[.^E`..(c\U.8a..7.`.k..}.o.!.<8..6.]O.Hm..^.pQ....3...=..VR.Q ..$-...]3.o.3.....Nk..X......F..Ca......r........L...0a....c...Hox.,.;tm..\...hpQ..".V..I.I.9..od.X.s..y"...d.+.4I..3.9!...$..M..5.]...f....:....V._.;9.]......5...j.....5x..(.m.%.......n..A.E......4-k.PT.).s........;.a.....jzErE..'.r.........m^m...}....g..]...........g.x\N.q.l.T....DQ.K.E...@N.>..2...KV..&q|($.;..; $.....['9._rQ_x.S...{.Tz.Oa.n...>q.X.8....O0..kc).\Z.\I..~P....7..l.#.b..(K...........^.EJ...}...M..5.k.lVs"....B.L...B....@.@..$2..k}.H...........c.m.........*...B....X$:.-..J.BQc.....z.sv8tG"HC..y...!.{.r"$...f.m.Bt...K...&......_..@l.m....@..>.\.h..(...f...E......{7...*..<.{.#..'..2.(z....S........O........5..........&....Pp....sue..-M...=...5.V....,......Fwu......4r...V..E..y.....fM..}!...`3.M..+M.m..9....Y.#K..s.Y.H..j....ByQ....,...$.p..B.b.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):842
                                        Entropy (8bit):7.780666944044847
                                        Encrypted:false
                                        SSDEEP:24:yTMiFMXmsCcf5A/JFCmxo44QOHsMX2oT7:yTdYCgAyMl4QOMMXv
                                        MD5:971D96BDC89629349BAAB05216068C50
                                        SHA1:AFB4D927A8F38A49823074F47B23C22325A47BD4
                                        SHA-256:5E7CE34B24189D87E1E95F929CFD45CBAF730510EE4927210BB12245EC15E0E8
                                        SHA-512:27507957561AF9BA3911452EF71DE9984CC9DA313DF84798E8B27BCB14364C7DF6018FC8C80B192911B2BFF01D67B3C75DEC81F5F7F9D5CA5642CCBD57582B18
                                        Malicious:false
                                        Preview:.g.EM#.aWF+i.j.G.r.+...78...\.@..TN.FM..2S...^s.../..n...F`..0.....T.O......F.]....k.....T.8"a...2...5(W.6..%.0..&/..<$./b`....xM....!.A..p.bu...C.q.8.S.1.F".E....u*...[..i.(VK...8...q9[An.?.?..+.u..w.9..Y..5.eN.cX./......Suo)..X.2.4..F...s.....Zum=....?.;...Z.......... ....lXO.>|....D.:0.k.{....Z.......(..:....|)|A...=!.6..Q....[.[3~......OF...v.:.U..Xh....=%..K....L.+RtN.....`P...j..B..._..X...l.d......`W\ytl..M.t-..... s........aM.^H.i.....:..[oG.@P..ZHj&....1m..NzS...=..h.!O...4.N..sa...`.)$K^v.n./.z..J.Y......[.....X}.Rp.k".?..|R.+Z6.OX./.<.~{.....u.G.XC3L$..[.\{M.e}._.J..z...>.,......MQ.k$YQ.LD.....1It2.=.;.H.....@S.|.r...l.i._7....!#p":.U..?z.....g9n.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8424
                                        Entropy (8bit):7.979478805050058
                                        Encrypted:false
                                        SSDEEP:192:foKfrqeTGogURebQ6/vYTiY8juRWFVlNqRXzQo:foKuALebQ6/aiY8jlH+Qo
                                        MD5:986B1AE4EDE8869800550E9B6F23132A
                                        SHA1:B446DCAD239670D21D8BC80F4782AB9283495EB7
                                        SHA-256:10FFEC3D6C9CBA0F5226320492FF225B8532C5B68BD33D90635BC7CB291B7F61
                                        SHA-512:49D2F50206ED48C0251409636476F3D860824138A2AEDA7A779F6B91D886ED0C38A821E9C835022DCAA227FE725D117248EEA593EE901682A5258932FC8545A2
                                        Malicious:false
                                        Preview:..=-.....h.......K..?f...b.P.....Vz...=")..Z?.T.(X6 .:?K.zO......9i..........M.W...Ny.2......t..rL..1X....{."_{..5..7...n.3......Q.....0.h....Z.I.y.*x....%....4.........Q...+(.1.....h.TQ..g.7.d....k.w...c......6>....N.>......."'.."W1..*.....0UmE.........wl.|......x@.N.........i...jpvf....g.i/.%...vy..........(....._.z&F.X..wK,.E...+..L.y.....C..`.J]..:.*........(.....I^..._i.....[.i..T.@f....4.+[x..c`3".".......z.6.o...Xr..^o .Bsc..T..d.....`...S.Gn.a.s.X.D ..5...._..L.2;]..Zh...>w.kS.$..(n....I\&>v.`gVO..Sf..p.I..I#..,..j^....p..q...f.....7_.4o..#...9.E....|..n........U.c.,........g.N\..f..!....o5...)..Qsr~k....sY...xhg.V.Fc.@DL.!.IX}.......D...Q.K...=e...Vk..A.]}#.r..F{.t........~.+o..7.&A.x...=A...58.yx..^P.sB..........qW...U.\X.#0.[.d.A.J}..D..\......Oj..~n...7`..A....}M".H`?...tUr}..=u....8.~....|....]..o...AC...7....0.o6..e....4v...v.S.............^.Jkc..b....L(eLR..7T..6....;.1k.-.d......a....e..~b..2s.h... ..&..'..".=.....U.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):3145960
                                        Entropy (8bit):2.4499358663350406
                                        Encrypted:false
                                        SSDEEP:12288:BXA0LOOetOxKiT+PP/QKLiURxvZhxGvvCfbo3j7QZv2Z:5Aae0hioKhEvvmGXs8
                                        MD5:CBD60DB98C71BFE539E1D2293F11F4F3
                                        SHA1:3B62CE5D83653689D11E3FC0D47D161DED3B807D
                                        SHA-256:9863E6985AF18C68C9E049AB682AF9F10E0E1D5A1A9D6D69C79077C2EEA0D641
                                        SHA-512:AA29F06DC33393139C1EE8D79BA73BED93B15BF6C1C21A891500462D3F671B98630AE16608F04459FF137B6E25692B9ADADDB600EC3A7BFA006592439411281B
                                        Malicious:false
                                        Preview:C9.X..7.H.8<....sA.?.........y..<.........o.v.....[..#..Y.........{.A.+I.....^K...<.'k;..e.@..l.-t.FD.t](%....n.....$.kX..`....D.aa....T..LE.h.m.M..>D+..z..C_9...{.w.s'..*\...[....M.-6.....d.....j..QGL...F....P.{./...........~B=h..r..t..".^.s..I._.L...}O....dU.M...$..D.=..v...UF.V.k.B.o~..v.5..I{o^...l...q.$t...n.B.........>..Y+.5:...[..........].w.}z.^...C.(^'gs.....Luq.[..T... ...r.2.b.P..D........fYx...w...U..VB....gjp.... ....$.'.'w.;(...9.3.x......X2Z^1 .\f....4..s|p.{.].1.....cQAz........9*o.A...h.j.W.TZ.-...%..y..!.....v...gHj==T.b0.....P...~"..49B..r.aZ.{.}....l.$.]..1`]"7&J.9oe.2xu..~~..........$..6..xl6XQ~..( `.;..1...%}.B4YH...r....9..*`N....A.y.a.r..w../.C....cvc....4B.y.......$..`.^.N.1.........)5;.HP|..v..5wT$/q......M..T...F.~....E;i.....O.e~)..i:z+....\.{.a.z.s....SBI..b.m..S.\...o.....r%`o....h...).7.@.?.i..{...u......am..*:-..EG..........^.@..!A......36.....1..`.......h...!6....O...];....2.^r..5.r..V.9?F..x
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):3145968
                                        Entropy (8bit):1.9763696019219654
                                        Encrypted:false
                                        SSDEEP:12288:JxWY6XnvtqG8nnmFibtKtvg3r/CFotyaEykvQ6BolUEihpxkx:6YgRfFi8GrGol4pBkFiRw
                                        MD5:6ACD914A48A2E08702FC3B20E1CF2F4C
                                        SHA1:6BC5F8510B8FD9E68FD5CE0C3717371B28D8870A
                                        SHA-256:5E437D651198990646C3865DA006ACE9D8D12A1D27E3985E4D624136A4EA8AA8
                                        SHA-512:C2B3C409F7B4ABF0BCE6CB0E6166F19BE9507B6B12C7783F216E4BE31672E39F7DA824F4DF7E01DC97AA0EA71D683B54731EA18C8382FE1663CCF1C947FAABF2
                                        Malicious:false
                                        Preview:...........@.V..?..9....N...KhC...3.....P.,.!...}.t..7.{.J.1V..7...4#.nM...M.b M..[.....v...Bc....[.#o.l<...n.E.OhTv.->...V......>Y.J.....\...(...1..A H%...\.....2.....*.3.F/6.....`m"7..m;.lX......,e.....v;`...........X.,...U.....g0A..z.l.L.%.p...|.5.....+.q...{C&..u..m...+...?...\J..4.]S,I.l....PM,...i.~....].M...5..pyz....|.n..G&.....Z...!.A....=...".9q..fQO...V..I.+....G..aNz.].C..Z......%...z..^.l&.{A...A.D.2..G"Hn...s0!..*.0.}.b..n7....X.....fA....1.'.{.n.P&[...:2..wqJ.L..T...E.ZcQ%zd.).4..[..a..Aa.~%p)...zO.p.x\._$...A...PA*...FGz&.n.%M.+. .<t..................2B...Sa....V.9.<B.......?..9......w...Ie......~p.i.t.<...........z%...P..zf.5..;4d.U~.!...-...I....~.!..+*2..*d...q...JY.y.....k....}...... ].....o.:.[......e.n.....A....3....8.......M.....b.O.h.@.>&....^.%..d..........]*.... ...<.n.."..'....Y.)........= ...[,#-.....C}"p......[2.gi.w.d.njT.K.WK..X(..G.t(.8......>l.2@'..h.......w..$.z...*.9..S6.jm..Mm.6.r.R*....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):3145968
                                        Entropy (8bit):1.9762763860409047
                                        Encrypted:false
                                        SSDEEP:12288:ojAYRMoMsEzTxN51McdaDYHfziA4qj6R3:kCoM1h9dacLwIG3
                                        MD5:54674984C5AE37EF2F57BC8CC2F8C436
                                        SHA1:0AA64E4688301619570ADFDB123AD10D0BDC0343
                                        SHA-256:A711493E52C4E2CEE1E27CD815340C110A7BD79D84EFEFAF6F27C6D94688901D
                                        SHA-512:34E2343CCE9EF5E6C982BAD95DF067FC2F7D7BD8E67ED132F6B8FF16F7CCD87F4472D47B578F0DD6782B7F52D5BCBBB0719EC9CB7BDADE076AA8DC4035DE2DBE
                                        Malicious:false
                                        Preview:n!..1..d...q.....pi..eFr>q.v .IHC\..dI..y. .K.y..G.|<..1.i.~.7..".M.T0.3..4...L.o...W.|8S.qj.I/.ga.EDU.'...d.i..6.|.."../i.L.6.[...x8..1.....%*[e..4.#>.&w.0AO...S%D-........8.....K.@8.f......8..2........"y:b."[TNm.'.|^......./.P ...b.t<..e.+E..b......'./...J.ru.D.ez....}..u+lMS.w..cEa.'.J..;.$.T.l....7.v+.#.Y ..a........._Biuk...KtHU.O...OH.G.%..).).k|O.]...7..XX....0.eO.]./...y...&..!q...."....F.r.Y.d.b.W~d....rb...~&..t..p.?C.s..Zw 7aV....-. .T..R....e..y.A..#.....ri>.$...~S......`..o...53.$.......2X.....]...^,....|..zB..kD....`.y..|.Wv..k.W.GJKIV....|d.3.....sT.]........:R....s..H......K.g.^..B...L.0o..`S.(..o.g..Z.Z1h&TG^e......L&A.n...m.fn.8...$(.:.S...{.,t#.3......2.7ey...p...?..Z.^!.O.J.3{r8y.=.B.`..v..rK.Q...G...?.iP..m3...Q...t.G{.}G ........\.uP.Q5.+!,(J.'t..[n...$..}.u>...-..).>......xm.BY....p...'S...#.Tk..prr...+.HJ`h9. ...B.".47f....._.....M...2K....~..5..ev.M.j@O....Y.F.Lo.5.I.v..... ..y........B.GC..;..T..]G.}.p.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):3145964
                                        Entropy (8bit):1.9762620011572707
                                        Encrypted:false
                                        SSDEEP:24576:QBc4TgYujaNGz4mmI/fXpa45e+pZOokp3t:QBc8gHjmGLH/f55e+2p3t
                                        MD5:333AFF37498F1857AB3A63BADF0F188D
                                        SHA1:DEC0E138BC0C70FE483289ACDA81105EC2E1D0E6
                                        SHA-256:F06BBE3F82EF8B46B4D42394ADC2BF3CBDBDD223DEDACB5FA032686C404818BD
                                        SHA-512:7AFA38E5672F1982E80E5F0C9780CF9615B20ADA6CC125E41F06CE60738830FECDD9EC247C1FA75E41B8C27A14A6794CEE86157637EC3DCF711700E3424EF073
                                        Malicious:false
                                        Preview:T..`v........?.......x.P...y.#"..F?...p.v.+..*.Q=K.,g..fD...*5...F...^.v.lb#X......!u.G,........D..&s:...]G..Y..k...m.\i/..}6...Rf3.M_s..R..bk...........\z*......2..g:S[,..6..@.w.7..<..\[j..dx.I]&..cg...D..C.V.+_....m.D..~...r......e...`....v...5..... U...!4=.s^]....{......D#..T,...c.. ..V.Rtg.m.[....T.$d..A....)4...y9.....j...@`.{).Xr.....7...f,`.Z].mo..(....; f.\.......L......I...#.LOCbG.&|..?=u...A..=..........M.....|v..$.w..S.%I...6[.u._..0....R D^.~.'O\.m..w.Gv.......f..K..5.P.[..X...g,l..;e..)p.....b.[$B.`..v.).....r.br....s0.$.U..C.......>.[....>j.N.'.....V.CAK*\....9y.....;....&..,3.Y.`...{xA1.LzKQk3h...wU...O.......0...#a....R...G~..H..Ma....JE...}/.$.......hX.q...*.H..I,[..Y+.as].8.....l....D.E..y.d..e.2.<c.#...v...\..Z#3..n..{4..l.f.R..U../....<.:.XA....Sgd0..Yt...Ri.f...Q....[C..r.8.f.1..k.]Sm.c...@]M.......=..v.........1...}..&l..e.#...*(.....-..._..#@.@.......a...h.(|.>U~...(..<...Y.d....Xen..%.;>m....Q_....<..\.....;...2G..M..v..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:COM executable for DOS
                                        Category:dropped
                                        Size (bytes):16621
                                        Entropy (8bit):7.990587019991224
                                        Encrypted:true
                                        SSDEEP:192:sHhacljaXj1UFQlvEU+To2pYKK86JNwWNIWqmg+EnLgHcsof+39jTRYvybsLfUo:s0IjE1U2s2iYqmgDMpe+NjdYvyboUo
                                        MD5:F96EE01640A4A1E2EB85EC4EACD85C11
                                        SHA1:D3DADF9A5C5EA7441FED4537C6F5AF1B72F3C14F
                                        SHA-256:A2CB91CB2135B50E44422BDD7175DA852795438B5617529D16E041E154B6CAFB
                                        SHA-512:83FB5752E3DA04309EEF64CE6B1ECA41644A78B68FAC045C4C17F67C7F5E899FD8D479B6494B4F6ED54D065FBB8E58DB8C7FD35CCF56DF6EFE2E30E94AD6CEA7
                                        Malicious:true
                                        Preview:...+.Q..s.....>G..|D.D..N..f%.j.._?.,........Q`....o..E4..|j3B.v8....;..}g..?/.. J...n..>A)..[.Y....Kl8zZ.iM..n.......0...!*...h..0.).P.......LX.e.oV.....`%.}1zvo.OVla..(..#.i.k........Eo.2/x.&.......^....rN...(.....?.J.-e....m_...~X8u.!.@.=l.O..a.Q50+..H.;,5.j...N...48.....y.Q.d..Mf[/AR......_N...>.7%F.2.}..,......SS.9.`ph.*..*)....q.TK7.<e.%..X......i....2.'h.B.S....G..g...w..#.0.w....5. R..e..... .d.....X.......eD..6.R.Z....y.^..'...Y.%c.t.t@.^N$J.K..J.4X..h8@...4...#*V.6...*_..&..x.....c.!...E0u..b4..w=R.m..;....4.....~..F.u....j..Qu...Vw .".....)>..1%.asC._Lz..#K....M,.$......."...X..y..obC...F....PU6.I^!?...e.Yw1..v..7u.m.._.N......M.....%~..r..........~.[.T..x.g...^..O<u......qK..cF..-....d&.R.[..N}.Xl.v),2.l....}(4.w.+Z#.....3w.r....\.<yD....-.t..3......w\;.).o.......O1..8.)....14......v.E;..,.x..<3Bb.i.=.yb.....&h.;..P.6....8\../..[y....LP....6..2....4{V ..F...pt..h..cm....;8..r..&......6...F..i|..mL...<..V0FB....ti.e.........\...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):5767404
                                        Entropy (8bit):1.3966835575440022
                                        Encrypted:false
                                        SSDEEP:12288:N2SmsFLbChUZ75FSWBGuzsIh/B1gHsMgOcarttCMCzjRdb07:N2RsWU3fBVp1MgOVttCMqRO
                                        MD5:88C9B75F5A8AB30A4F050756357C4F14
                                        SHA1:D6D94AFBBCCDBAB0299EE2722787D06265080799
                                        SHA-256:D4E5BC35526D68CA67A7CE147941793E9F9DDDCF1CC98C698BC68771BF601462
                                        SHA-512:B0B6DFCA6E83AF462D98AB784FD1FCE9EEA5E96BF644A8376B9889D1D1821956C401DF516DA8AF285292CB268531D60E8E3BC4A7DBE026E433EFF22FACA7E925
                                        Malicious:false
                                        Preview:.-.B..g~.[.*...R..-...aV..=?[w..c.~.m..>!.S...+J...T..7....."~....8HZ.!..|.9E.E..o..Hr..a$.G.'...)...k.\ol].q..<..86l..l..._Lb7...).7Z...h^.1.~..#.<M7...Ke.q..o#..qB(...4w.o.......FZmV....J:.!.Ii.U.gK....$.../v...'.&M^...p..c....c]s$.......i.aT...i....A.2..y.:.E.x.O...>.....3...d.g............),..e...Nv.6l+..<M.W. .h......a....E$...vC^...U&....5...gx{..5...g.Dd6.Z~X..+.s.{i...R.C..........;..E..`4.]......4.........]m....&.....:s..4(8.....DtG....?...1.....O...j9_.wQ):.<...>.%zdA~....0.qUm>.g..30!BF.....L%...]........|.....u-..~ka..xv..X.....n=..D...C.0....L.R(_...3...L.....Kb.....n........]Z.....g.\ak...y..=..........".....w.P.-Hx...|.....@|...6fJ@=.."u.`....;[E<..4....^Q...u..1...Z.v.....#Y.....q.(`9.H.h..`...Lg-~A...c....q......d.....}.....m.veg.....[bi.P....,.....w.....E.q..1..R....oI.......%Z...@./S..........2...5...9...].}..E.~c.".]]7^>.....G......R. .....(...<U.#..1e....7.... ..5.+....ZN`.k.bokkU.T.+..D.K.o..O.@..Vz..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):248
                                        Entropy (8bit):7.141341572326627
                                        Encrypted:false
                                        SSDEEP:6:k/ApABskCfY/TTjQQihje952lItGIUCKcpqKsM:k4pABsk4Y/TAcX220IAuTsM
                                        MD5:4774AB35A1F40EE31E785BDF42A47D49
                                        SHA1:A212630FA7A18DEAC97076F2FA949062210ACDE5
                                        SHA-256:2CB78892261A0871C57C5C5F12821A9388EDF19188718FDF394DE4D0F7A436BB
                                        SHA-512:3DB31C8F79EBC042EA23B2F4C83DC43EDC177D5A27C01D911A3332B5E0F1E861A1966040B5D4012B3638C621A3A3D147BEEEC424EAE555D0B58106EAADA932A2
                                        Malicious:false
                                        Preview:,1Wo.u.i..F7O&..`..+...S.(..z...>.,......MQ.k$Y.(.......z..zP...%G.n.#I.56Vd.$.....A4....r+.......vbA..rPNn.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):5121
                                        Entropy (8bit):7.964917859516797
                                        Encrypted:false
                                        SSDEEP:96:+HOvwRKWvHQPgqCIqE7qZIUb25Rxi5WVaeWLhKKgrir+yyM+TkR:+uYwWvHegRgiIUKw4ehBeryIkR
                                        MD5:F69A751672BFF8937E43A8AF9466D5ED
                                        SHA1:EA1DE5A4CF08D0D3DC81EBE73AEC8E1B7ED28928
                                        SHA-256:C52089FE3CED29B80A1E596E845647D282EBD8787F2A3A1B63A9A47225187724
                                        SHA-512:74CBF463B5C22E1F2EAE6F89334A81D0238CDC37936FC3F9DC56ED223ED04F460FBFA4C8EEE72455E8870A34BE4986BACAC68F0F96995369438B6717D8BDB9D8
                                        Malicious:false
                                        Preview:..yX.H.n.A.M.....I.{6y.......l4...x..(..r@$.h.#.^+..'N........=.hYu..Br...c..4.;.ED..d).A.....B-t..?........>...4..A.c..-..q.D.L......Qur~..1^+Z..U...ww2.....$..../..X._.5.2-...kf)eH..4v.....@.".j. ..e<......[...(.N..3...........I....]nJ..hn.O......{..1...!\.0...n..p..Ej.?I..;...2e.`N.T.....+]n..N.Ou9..D.tw9.......I....,.D4.0|b..c.........Dh..'.dL1"+?S.......;....V...|......Bg.y.R.^H...;.......%..^...TV......dy.....{......H.......($Q...r.iB2..@.%nu..Y.....Z...Rj*....1..T....".{@Y.*8..Y4.$<....".)&#.........J.M....=.$..V..../X..G..4X...?......?..y#.g.$Br!H.C.~...0.....3.....mS....u'...d.]..!.....$...gF".k....90.@*.(....2P2.....[=(.}........N.y....,....Y"../PN7.e....Y.&.+.........-}.".......Q........2.....8..Z.#n........[.a.tg..d._.N....@&.qt.....{..a..].]6F.4.P.......sE.y.@.8.?c..}..y.{e....w..^...q..".....m...+>6eJ...]....,N).\+..-.:i}.z./...X..0....5.wNvr..6x..j-.....m..(....Hc.,._..^..+.t.r..Vlv.@..}e..g...._.i.......x...........
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):933
                                        Entropy (8bit):7.782470361385554
                                        Encrypted:false
                                        SSDEEP:24:FhF20zMjPVKqkE8/eQBkkebYvhcNU9OmpIi3n2RX2oT7:TzMjPVBkmyjCNU9OdsneXv
                                        MD5:1611F7944771110760775E9723DE9879
                                        SHA1:5F1C036E84367A117EDDD19DA4CA16BAF6DDD988
                                        SHA-256:6C6D4F4166B91D61588769D955FF48DBC34EDB02E7A48D3E0326CA1A81E4E021
                                        SHA-512:BBC4DAA29A7FDC1CBD26CE0EECCC2CE277CAFE5FF3058BEC7902A99622D8282102ECBDF11BF897AA7530A365D27C4E75F4335766388350D7805017EDFF68C5E0
                                        Malicious:false
                                        Preview:.Q.iU.s+.u4.X.aB...+.zW.....~...)i..G..Qf..~Q....8::.Z..7..cd{..(\.Sr....EH!..Il7...K..W...H......}X.J,.uD.C.RKC......~..y....2.Udm....3..l.>.L.Pj.......d.m..}x....&/I.e..9.\I.......c....A.K......D.ev....6T,....:r4,..)oeV..e.r5U.]|.......r._{.af[.6.....E....U...K0.Q.d..E..........;I(e....N]..=..Y.4...*d..Y..r..A.%.C.A-.E;1/..2./.......h.*e.~)...y}..\.a...p.......j...}4.X.0D.....!...u.+..:D..V.. ...STP1...o..{.Ux....k......o..=.|...,I....e:..E.N....?.%~\..:............A8...u....n.:K.O...9.!..:...: .3...eYe,.....R....C.%...I...g..yv.0....0.....e..?...qy.Q.."Wu.=.-L...g+m.T*..s$....Lh..X...U.....x...E.d..t.7..u.G.XO7L$..X..j..K..!... ..D.R6....oc..u.|0:.zK.kd..9.w..<M{..f..D..fT._I.E..^.r.......=.G..q`{`..G..m...=..Q.5.&..: .......|..............^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1211
                                        Entropy (8bit):7.843963905257527
                                        Encrypted:false
                                        SSDEEP:24:n+p+ObGukd2jzFfMDvD4vfCip34gqgl9jhEgU/WTWVtn0+8BBYtlxaX2oT7:no+cGu/BfM7DifCZa99TEn0RYtloXv
                                        MD5:3862B1AD81A0F89007BBCF9C54C99F7B
                                        SHA1:619AE65E1B91763E98156F651E00F1BCB420BFFA
                                        SHA-256:F4900DEC356D1E5D260E315BF54BE9172062791B9BFA23509928FC979BB5376A
                                        SHA-512:21873FAED2652F9C8D6D2134012CAE82C44EAD79B2D6E138EA1918EE7291C87BA628AC3BB312E4AE57AEAD5B077C324ACD1E3AAE85C012AB7446405B297FB869
                                        Malicious:false
                                        Preview:jd[. .+e@.<..@>.>p..y.Gj....je.....YV..g8={w.S.....qE....O..I.`U.WW5....l.%HV....k..$...T...C..;(....$..i..{-.}..q<......b...+_....7".....B.l.$u.?....7&K.-.:w.-.;.c.i|/.1!....5....&...=.w..d{..ZC.#..7!.`...L.r.iZ5c.+=..W....P..^...or.....pO`.b0.....b.K.t....J..;R..6.y....L.a.F}..aET.....&......./.?...+7."...}.).#vm 2U...f.9AR.........\...FzX..cs..x../QH@..|..U.z.N|M.fb"...T...mpI....5F.%!.mD...k..D...\Q....+.y...2.!!3..&....h5.....{......r/d.kN......@YM......z..PqV%.m<..}[.9..e..oR.M.aD.m....ns..X.At..).u.`X......,.a...tbQ..Xw..s....K...!s..vl>..%.G..X4$..:C...iVc..yT.`.Q.....r.j....|.l=....Z%.f.H.&.4..'......f)..nH.=....\.6.N..|.k..dq..xSt.2S...tS...S....+...iG.....M(Z...N...Q..}yRV5n<.,...4....s...`.O..f.X.R.u._%....g:Sp3...U?.. ....l.AE.v..r.....n.I.z..I..3N...\.7.JxcT.=...h.S;..S...A.{..Yp*... <.P...Y..0....n...W........./!.k....}..v....d6.oi..(...P..u.....3..H....!x0...RJ.Ku.'.....$X..hG9.<|.N....1..=.Kf.u.G.v&.$.u{;.#.U.us\.<.0b...l
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):306
                                        Entropy (8bit):7.326971533811264
                                        Encrypted:false
                                        SSDEEP:6:/669EkFwzRUFXdvpz6OBZQ8E43xL4hs7hje952lItGIUCKcpqKsM:/JEkgUFhpzvZ/gFX220IAuTsM
                                        MD5:8E77B6DD4ADE721F12A10E04E7408932
                                        SHA1:A38BB030440A25FA3363514613215335D7AD1B6A
                                        SHA-256:32CA657F4B1F6E424EAEA8AEED357789FED545691F00B74D5F7E8DE8B45F0086
                                        SHA-512:032D9733B962EF354984FF092684BB424150D519AA8ACEFC5B5ED620F96D9B3338F35774A89C7E76D1E73170B6D2805F15F1E2E532E375D3A3D971AA4180FB39
                                        Malicious:false
                                        Preview:d..:b.-x....;....qt7}EZ.....}.........V.TF....T=.Vt.gC.u.G.v&.$.u{;.#.U.us\.L.U..a5+.g.......Q.k$Y{\ R)BW<hR.......e..U\...Sr.'Q./M..`..^^.+.".V8]..O.]..^i1Xu(.l]....J.v.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):33022
                                        Entropy (8bit):7.993671436023138
                                        Encrypted:true
                                        SSDEEP:768:ZvrPumjQaq4iIU9kFXKLe5ibeAlEkQtqeLXFFR1NUb8Jl:ZvrPVjdq4iz1LQAfQFvv+bG
                                        MD5:AA07F421CBA56FA1125EAC3065F07333
                                        SHA1:9887D87D624CE4A23CEE3E8013A70BF04A90A8F6
                                        SHA-256:7863E2A56AF10F17053D679E1D27D9780A7EDBF67964BEE6691DA00B72D7A3FD
                                        SHA-512:E54E024433537BB2E0CAB08228726F3E81C2D51D2CC537A7119C2A3241E7E7E4AA96E9DD245E2F690F69ADBC546B7A8A608F171458EA4E187CACC525676292CD
                                        Malicious:true
                                        Preview:.....5~X^.x}....kd+L..+.x..B.T........><.....<.6.h....s.!+.$.h..M.| ..^.&..*..c....k..n...x.[...s.U...B..Ct.../...I.....O..pv.sP!.Th.<.....@...h@(.....$4Q...3~.n.c&.<]6q.b.*..04<.y......2.4..S...x.T..p...H....W.9d7.3......z-.M.....<:51...r..HA..`...."-..Gw.B-3o<.$x...i./w....*.l'..{...$o..g.........,..X.r.Z....0.iu....|.(..p+...v......Mld.j9o....X..".D....[.eh...z....v:.".aD..i...D(z....N]..E5..K.><N..I.N..YU.2......;K.........W......~..Li.jiJa.p.8.c.q...,.....EB.$.|c.....x..G."C2k.}.y.24..".$...f0)..[.........W...m.pq6..A.C...i|..By.$..j.{..(.....r....n........XW.4..^u....d>./8`.(S^.+tL-l...[.a.f....Z..n.e:.j..........&#.._{y.ygI.LTq..,.(tHF..Kq#.... ...@l].a...?....7N%e..L.....KW..q.PP= z...C.^6.z....]....g6@[J.....+V......3\.{:./..t..<o.;..+6......).ZMER......G.k....<...e.$.r....Y.]|...X.{..U..^G.7R.Jg..~Y."...b.0.]....z...:......wz.....\..1={(.{..I.].....8......K...yJb.}..._.P..US.d/K]...z..710.{X.(...O..C;cw..}....-R..J.....[
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Secret Key
                                        Category:dropped
                                        Size (bytes):255
                                        Entropy (8bit):7.112655054361696
                                        Encrypted:false
                                        SSDEEP:6:WTA3NEi6I1eJthlChFLzThje952lItGIUCKcpqKsM:WTcNELgfcX220IAuTsM
                                        MD5:D9875B8FB2C678EF2B7A966731392DFC
                                        SHA1:55967AD31D6E47C3A56D94C203AA68D324AED322
                                        SHA-256:43703D89AA7BBAD54063A2BC969FF843DF31BED738041D575DFF6A8A6EB7B495
                                        SHA-512:3720A7653D82C833660EC06148E1E676A9FC9A3DBB93F7EACFFBACB0F55F4FBCB8C8CB8A1035EE4C0C627A502D9FBDCC31783F62F33984928F00D1FCBC17ABDB
                                        Malicious:false
                                        Preview:.u.G.v#.4...m.h9p.pPD.'6...v;.....l...MQ.9$Yx\ Q*BW?.T0..,..b......H.m. .....b:..Df...f..f.ij.X.m..c.O..T.li)v.a..y.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1048824
                                        Entropy (8bit):4.982581769669212
                                        Encrypted:false
                                        SSDEEP:12288:BUCgHyBCgY1BWO3mITZD3xA9iQTB8Xjga4C:B9lYBNWKCwQUb
                                        MD5:6A053B9427863101D46E97CA8E1EC898
                                        SHA1:DF03AB6E4D1E78A02DC0590655B142AC1122FA8C
                                        SHA-256:5688A94B7EBE1ED62CEBA6510A5C9476FA789D8A97A6FA0D916247275AB13CCC
                                        SHA-512:2DE5691F32DE5BBCE76096DFAF2AC882AC2E8F8C3A5E4B0434F5E7EF3E9917CF9CFCE872EBA89DFCBAAF6D72245B2513F1B198336BC38E3848CC2687F97147F2
                                        Malicious:false
                                        Preview:.....(;..L......6u.)Csz-st+ml....#C..}.v.".p.Z&F...so,.y.........a+..,....O..P.I#.>..8|..:.XZU^jT..j."...#B/..j]...|a.....U.J.\.i...,..^,J..9tw|...h........:.....z....&....<Tc...._.@....d.......Rp.....}cD.-3+.c0'....j.......\..t.-..v)...6%.....C..Q....qdSJ...*'.._...~Ztu.Y...q...5._rq>.Q..!R>..Tt.8...;..T...u~..$....L..T.p..M..../mr>9xc...$....i.c.P..J.M.fK'.`.Y.8..|0..Z}.....#).h.........@.\.L...H.;..5bV%.9.b+....N.'....7(.N.%..`Zm..#.|Md~.*...}.........``...}-<M...-A2.~f.H.tc......w(......~nfj.c......o...k.Y..W`........b..k..o.Nz.a,.\H1$..&.$-..fN5.<.6........./n........h/.{....3Eq.'....\.%.D.$$..`...K..C.....xk.L+.r#...K?2..H.U.*L.7...<_.,..{2?.....Q... .Mb...t.....sQ.]Fp...[U' '.#K.X..=.r*;Ht.........9.~.....L`...,P.T...y...F...q........M>./.H,@...i0.N.....$#.c..L...Mf.m C....I/...y.....r.@9Me.R...Sb.G.O......<.R.?g0.r@&...o...r......a.P..f.Esr...y.B$%X..N..:..J..._g..,!.W.P.w..z6e..@...%%....o:n.v<yz..J....L.+........).q.%.G...s..I....q.....tM..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):65536
                                        Entropy (8bit):0.29192356072456005
                                        Encrypted:false
                                        SSDEEP:24:w/g/603PaZnzaeNSvAfENU7FMHaOHy3aYwk5pH1Fwy2+X2oT:qjMPaZzaeNsyENaMHacglwk/LJ2+X
                                        MD5:487265A1E06B655415F92058A0BD25E6
                                        SHA1:E633771D0B75B260DA4B77E032B6579B8539AFED
                                        SHA-256:9858CA24AA3CBC734835D36B240C286966EC9EA3FD6C4CFC30BC7A628E5AD452
                                        SHA-512:AA971E16C8815C7E71FD4B7F06D004E0691281D32DD82C96103AE76C33ABC4A07483EC32309F6E9F70CD5427E985BDE1E208F071612DB23DFDFD309BCB1C2385
                                        Malicious:false
                                        Preview:Hm.>...^..e!.h...1.....U....!...#....G...9.......![eM!NL..i..:BW...N..r.5...=..{....t.32.....D.......M...|)..0.B..R.u.#.e7......~..u.....O...J=..S."Ee,.G..t.;.......J.$.:eE).[f..Q....RG...B?a..T........g.\...r..)X....u.;....K..a.+zWT..`)\.fwnom......xx.../G...6.......wq..(.ui.s.Nh...G04e..r.K.M!....|gX.N....... .~.d...yE.dxl..Ul...(o...s..Z..'...}>.x.......9%.....z-.o..........r#'...=...26(..E>..=......'w........u.....'x.........t..Wx..uC..3..t...........u[..d..Z.`.....T...r.C.F..P.0..;.9...V8{..hy...Y*.A.i41.;.D.....L.=r....S..........4.......F..UM9....{.`.....V....[q2...M..w....t>..9.m....iUpL$;.t.U. Z...3W:..$di..`...OU....mW7.`..9.h>e...u.......0.L..T.........*%.\oW.i.....r....#..0.(..k].X.:.YJ&..._%9p......!..5.)..3h{...e..".....M........ZX..ev.~.+>.W+.2<.......).. .h.5*.%...`.62{e....z.W.6.c@(...../...?........j.r.T..'.z\...J.y".9...f.y.&......"a........y........zc^.2.*.Mc.OO......."66....QM?...o.....rJA.hx..3B..n.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4194576
                                        Entropy (8bit):1.5382369537163674
                                        Encrypted:false
                                        SSDEEP:12288:GBXG4VXcowPdZZMKbv4EnvVu7IgNOkoHJ/u0R5Vyr:GBXGcX2d3873N5oHJma5e
                                        MD5:9A17CA07A3C534DAB2CD89C065D47D66
                                        SHA1:9E6BA2ED5693EA3020D97E656AC97F2F3B073B46
                                        SHA-256:6517F02B01E0997B0E47DF16B8C2C19330754B63E296BA76942BA56FD33FC798
                                        SHA-512:9CBCA24949538AEDEAAD5B03A3805554F115417B602490F224A63D740B83887B74CBE7483F9CA570916029ED4414AA55F972EEF41DC685414D1D705C91CAE334
                                        Malicious:false
                                        Preview:l...............s....8H..:..T..Z.q..b+N?%F.....`..rw(..3..8.w^..@....*........UE./S.v../...l[6.jR....Qe....~.........oD.2I.g.....W.K.D.Vg..by.=.n.V...Z8B.@..U.......|..n..`.:K..]1.$\.iWL%.1`...l...-.Q..NP8..7.d...,..>.DI..w.....k..ux.C..j.`......IDW....f....e.:...5.G.....<$C+A.U.Xfr.|..f...` z...rd...e..R[Tx6Ip.J.0s..C...-..:.....}/Q......_.KYHO.PB....RIa.`.gw....].4.KC.Hh...$%._. ..0.+\...#.P.L.......:@..B....6.D...?....W....mq...u;PPk .'....O..Y<z#a.q[.m.a.y...Ltm.....-f^.fi.q.E.y.....1.9.....II.6d.4.oJ......6O.)I./.gcZ.$.F#...12..W..1;/../.9`;..]$._....@3...^...>x.r.........R.....L1.....j?>..+.D............R..........l..J..I.N...T.}.}..u................(.d........ .....yi.....IS.....I.2...?.P...1..F..,.)....h.:.....G.q......:..M.|7R..u/.....V..9)..e.HG.j......<.9..K.....^...>.t...'q.KP........G......^.'...(..'..h6...QR.j..O...l.......Z)....../6. c.i..I..Bq.]...{...Rq..*.5...)A={K|.7.0`.kR..).7...zs..\..z..\.....g...........J...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):279
                                        Entropy (8bit):7.244686141399939
                                        Encrypted:false
                                        SSDEEP:6:WqSXxMDGdCSJpCiHdJ4aQAXZeivCXihje952lItGIUCKcpqKsM:WqSBSGdRTrHdzwivCXVX220IAuTsM
                                        MD5:FD72438EE628E73826755C731CF9B200
                                        SHA1:A0561870949DE2B4787F9D011D190B593A4B0BAA
                                        SHA-256:CB90370471A6D7005B98DDB41F4B40BFF5445BE1C5799F5A520B5A46D7551E97
                                        SHA-512:13174934D477BEBE3F3B680B1D4250A5E16AE56436FC8EE0B4CE1A5BFCA19587960200BF854DE003885C2A7A5F068F1B54CEC94C712E2918C8E0A1E3F9699767
                                        Malicious:false
                                        Preview:.[.V\....'.yUh./.B.4M-......pn..0Vh.....u.G.XO;L)..Lm~.,d.\..).0x...>.~......Mj...{?..a:."mzV.6;....Ir......F".\..t.R.;.......v.,...,.VIxi.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8422
                                        Entropy (8bit):7.976664686443478
                                        Encrypted:false
                                        SSDEEP:96:s8KIK1H2rp8g+C6X93AblmMYU1aVOCQk9fBd2FU4EMMgtyjAf5jYNlbphol+zZwf:SE+CUslmMYSGrp9fQhykglbpubW+0JTK
                                        MD5:6224AB82E36C00366F18ED0EF20364A7
                                        SHA1:90760E0EDC8D5F554A2FEB074187FE22AD4A26A2
                                        SHA-256:D34A3E90960C11913B189DC4978A110BB85BABFAB87A10969964E57DCF53E043
                                        SHA-512:EBB65A923247DF7E17BC38F8478AABD29B8BBB9618F6B88462B8B3BF848E0D01EFDD7BA2976E3FB6C5C29540B6ECD718965A43E9A5E61CF6079CD2C2C8D8678A
                                        Malicious:false
                                        Preview:!bw...u.&!..........`.q7....i..K. ......2.......0..z:t.e|........}.......}....w..a.Cg.)/O.2.G).Nb.47Z...,..,2j.;r..._.....|3.....O......uRv....N;..s..t[.a.|].f...;.._.....ke.(`'.!......G.......%.xhe?..Jo....#l...=-..K.H.YAL&}..j`.8.==...-.dh6.9....M...b...H.......e.r(.ccWO..Z9.J@..C..`h...NU<..i.$....w.]4.{....Ef..YN;...!.!4.wF.I(.v.......OYi....:-`....>..@.11v.|.XR.Wl.i....-......2IN...F.]?> ..C0.a.3.;B.s.x[..w>e#(.3........}.j....].:|F!Q.W..N?.R<%D..P....}...N.....G..._#.E.W..R.....!..[........".i.S.. ..v.0.......6........{+m...Yjm....up~<.....[..<..D..............d...E.%.H>...3......5.b.`..I,..x....*.....F,q.em...5.B.f|.C`."p)...5...6@..A..=.._........;.D..r.F.`.mY.I.(.....B..;.....N..Q.AB.....1......R.o...= N.(..P.~y(...R...[.........$...'.....\U..8...a.6......D>.oD..../...K:.U.M.x../..S}l.Q.. ....%.@.%..4V.xb....P%d6..t...^.6wO?..<\....h.dD...X"....]t.v>@..m...e.=...K.H..|...QX.1..xf......R1..u...`....B|-..p.).@......1......."
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):262741
                                        Entropy (8bit):7.999250803056213
                                        Encrypted:true
                                        SSDEEP:6144:BZlL3lxCKxwruvUSK4nqrn60tUen2ZxiCCJL8VVRbYrOoD:1xx0GKbrp6/TiCCJL8VVRbmOoD
                                        MD5:FE67A0ACB75574B5E3295794D40C86E2
                                        SHA1:5876157AB3909AACE494AD39A8FFDB7E1C4B082F
                                        SHA-256:501A9C4963DE55595E4A50C462E786EFE77AC3F6437F54E4DE0943782562139C
                                        SHA-512:00B19018407EA087DB5AA665D3F1E688967F6CD27039DA965B4CC0CAA86BE0ADCD8C09542A461E08F0F2CCA643917BF17601347C464FB02E43AD6A43530E3F04
                                        Malicious:true
                                        Preview:o.n.x....lP...h3~...e..B..sE!f....[<=B.:..~`......7~cb.:.E.WKgY."q.:.s....t..".21..k...N....t.e..<...\m3v..5.:(n_.+.#..@.C.....1..'p...>.2..l.......<6M.z.0.@............f.<....|.P...{`d....^.....2.....B.n&Q....n.,w...A.CY..z.P...h8m....u..2..o[.P..P....0... \.,\=y...nR...c.!.'...g.D.7.s.%.7m..E.N(K?8...C.j.tG.F.!.8.........\7.....v...........`..?.....O......)...J..3(m...^....U......b.8R&;%............8I!..D.+.XN..Q:C.........`..y".k.g...mj.~.5.$V.A.......GTP.FmG.]:,...............rVH...9......l9=.Q*....^.N..4D.a.|;j........m.... .w.N....xl3L.7...f.....c......(.l.D.....4`6.@..L......Y.....X...a.-...okd..8...(t}.~$4..&.....0..b.Y..~...s...'..x....1...v....X.&..6-...... ...0.P.g..b..@s.W..9...N..vS.-....x..Q...u."8a.M%.9<......*.%#.......Q.C.1..e4[Y..C....Q7...[(..k.....:6...0.S......L`h.#.!A.C...y...U.)..A..!...`.6c..+........P.`'K.....Si..iO.=...Z.t&...Y...z.vA .[....y;..i?c......|...I.8..-.Pi...i..d....]:.6..Z..m6...X.......Q~O
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8422
                                        Entropy (8bit):7.9797827345231696
                                        Encrypted:false
                                        SSDEEP:192:sZfVUw3awkZ3g4e1uUf6KBX9agmL317ytuotJLOFMFo8mC3tiTMflJM:8VUs7kNteXX9cetuoTOj8mCdKCG
                                        MD5:4A5D72E66AB6E7849117AF8FE679000C
                                        SHA1:CAFE5194536FDB4F0A049A9FE7A5F47932E0637C
                                        SHA-256:05C13B7D2EF80F2392261CB8DF0E745E05D1EDAABE07C2CA2C06CED9CA7049A6
                                        SHA-512:707E363037358DD402F66D669875AE833566938FB9456CA9EA63158EC374FAADF1CEA5533CE2633933FE9B45DA47E8F8BAC5C6A98ACF58BC239D323E6BC01121
                                        Malicious:false
                                        Preview:.'x.5.h|.`Y..&.6.. ...jLOt....S.&....)i+D...m.n...ZX.!.G..hb.%D0.K33.D..k..I.[.u#.,..RK7.)4.x`.2.:....9....[-.mr.g...j.......a.G..+.(.n.nn.wR.....-R7.S....#...*f,.q.... S....[.1K.........{..n...si.t.......... ....G_]R.W_...a..^.N...R..}.L..*....@.....%;...ec.~.=.6...|.e)...........r.....w..9.f...`../,....?... F...&.+.4.......s.../W...J..&h#C.4.T.m........W^....P<....@#..u..ZQ..3B......hz.... ..^n0!....\.....r$.j.Y..g,..P.....,.4#.Et4..9.f...C..R......)....V.im..O.9 ...;..Q.>(...?.Vw.eSF....uRZ...1..c@.2.../j~)W.]$......xw..ZI...HQ...e...z.Wu...dz.z._p...D. .....@.u.n..\#..bT..).v.d.t...&YeVt.B...dhZi.g.+n.......U.?w~...q.......PM..md.l.Y.T.L.%...,..H...S\..)Ib~..d.5...;..N9eY5..O~y=.`.C.A......z...:t..0i....;....5..+...t.Y.B.fk.......a...].u....v.g..{....J{~.1-....~.(!yh.(.7V..,.E....c9......8.km...sZ...:.x..P.k....w...M.G ..LAt.5hj;.ZP..+.:.v...n...z]..7e.....h...f........2.R.(..E...;*..c.8..o.<wV...g..Q;yE....Y...@..:...g.g.....e
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):270566
                                        Entropy (8bit):7.999269822190713
                                        Encrypted:true
                                        SSDEEP:6144:6fNyl5TXVjhWoOPepuWAPWbsEoYPTuHwY2noTMQB9p17alSTRQ52:E2jh3OPeptAPFx06HwLnog+31oqQc
                                        MD5:EC6226B729028435454124C3AD32582F
                                        SHA1:8767E8DF3D193A44253E526181E32B68E89D2E33
                                        SHA-256:D8B37B54FEB30B60556ABA8CC17C6F8D012EEFF24E6F53E8A2FF9A28156B19AF
                                        SHA-512:559D7EC0DD4A92D30FDA8923B8438B6651A8F67CBB1C4A23CD8F0A928C0DF9A9E608ABCA2F54F56FB7FC510806DEE634E0CDC9EB94F4C0B4E16F7CA4445692D4
                                        Malicious:true
                                        Preview:bPz..K`.>..C.....^.P.b.m.d.|....y....)q.............S,......5..&.rz...q.<.....H...6M$}u^...HD.C.9.Km6...Z:..o..^...._%|...B..{..2.3I/.O....G...q.h.....V.C....+.0.2]U.(..h..7..V3^hv7.J....3/..1.,....A.x..M....S..*.[..9......+.)..!....vv..BHA.3p.bQ..U.=.=@......._qPhq...H....cmZ.G.s.]`......Il..5...HN4.h....`....$.....+.6...Lk.b3M.$..!1.0..arz7.v...u..Q../.....b9........Yt...<.......u.gS....@G-.9K..:..2......Qp...`.}....v.lB.....i&a>.-..I..1..e..0}P....<.).T....).*.x(,Y|..._.-..m......I...y.D.~..f.NfR.W.4x...v.I...$>....".(.RC.A.g....[A.......9..T.<.o]..%...W<.pa.S+...z.2f.......:o...*....pA*o...-...=.:.L..5k.Xz...+.b...*.....X......u.5....M.......T&......H..n.!.|.d...*m......A..,..4.q#..=...V...d....C..k.v!.F;..!..K.qf|.]9.+..x3K...M.../.g...x...Ymt.q..|.uf.:..(.e....X.N..o.B...~....k...T.w4..N\...68T.....<"L...F..+..YJ..4...IFn..^.o..q...O.Y'tp.+..3(!K!5..T.[...0W/..F...A....w.:..X.M\........=G..,Am.N..G...J.(...x..(U^.\....q.n
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8422
                                        Entropy (8bit):7.978672350314401
                                        Encrypted:false
                                        SSDEEP:192:6COO82Nbn9TprXLdjSNS/hIVCxOhSiVPaJIfIO/3YKjohJrd4:6C58Wb9Tp3gM/iCxKVPauAO/3JUXS
                                        MD5:FCB16D3130481DDA40174ABAF0F5529B
                                        SHA1:0EEC0A69F4AFBEC6D8256638E01D98B048AA1BA7
                                        SHA-256:5B3065EFCA8D8486A20945D5C2180D38091A2BDA919B43FFB73BF5C74C5F2D36
                                        SHA-512:3FCBD63AC8C314F9F0C2A0B81343C0B914E47B353EB2DB7AC5790ADE3650175CFD8CE756EA1E7E2CD611978EB3207DFCE25611BA7F1F00765D95AB41ED3EE2E6
                                        Malicious:false
                                        Preview:R.....5.U.z........H..W.FO.....D.Jj..r...R#<-.;...p.J...../{]Qx_I9Y.....`w...T....y....n.........M..`..0...+......s.....@+<...:..+.U..+Um..I.i+*........~.8\.m...]:wn..os.7#.{,`...lF..>..Q.......Z.K.k+5....b..8....A.....v;.H.XGoK..%.X.....N..'..I(....].rpK.*.U=.=..M..U6..z........V..C9..z.2Y.Q...7.4x...."8..4..R.6...f7....x..?........,cf{^..6.(.\..D..z...P.I.[.t..2......QQ...-N..".....4<.lu.......N....V4Iv.......k.B.z o.{wV......-O.....J...!..'t.....<..w/.......T..R.a..{..I.*../.lI.&.~.....0....Ok..K.t.t....m.........~.F..=6.COj. ....N.J..sY...!i.....yL.e......Y..@.....7..";{.@&.GI0.u....L.w'/l.. ..n=.....#.....3R......H.A".\..../.(.........C.6..X...LY.MS....Q..r..../....R=...G..-...j~..L.\m....v+3{s.=..b..2.=.....0BR..eE.8[..4*1........._......M....S.?.p.....M...z?../._.}..f`i@.$.%&BPNb...j.\%...}...}..<...^.g...a]..L..Lnd.....u.H.&.....k.....z..T.Z...p..3..../.XE;m-..&..@......V...5...s.;E..P."..R.Ou..m..+...im#....ZF.R#.{
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8422
                                        Entropy (8bit):7.976787483165644
                                        Encrypted:false
                                        SSDEEP:192:6oJsWa/7e2GiG6KcKVLyNNSyrf/C4EeGlsc+EyZ:6oJoTMR6fKZYZ/dEeSsc8Z
                                        MD5:1AF0BFD08807EDAF76376E3915940D99
                                        SHA1:8E53A43F6225C27FEF4B202D0B6701CCACA7DD3E
                                        SHA-256:CC6F956631F062B3AFEEC419203282A44350CCC6D4B0A6E87892A72B8241728F
                                        SHA-512:1B31BA11E88192F78265D4190DA1E4BE8B1AE6D6F101130CB62AA527ECB6376100BB435CD0E88C33D1F50C1D88C997AE0A06C8B8FF86236FDC73D2F82CAF7AE6
                                        Malicious:false
                                        Preview:.".......yd.RfSwPC.Q.C.........jj0{tb.C.fr.../.).......P..+Z..|..+.c(Z....Ua.59..Y.F......[.#..b....(.j.....%....Oy|.y.{%...;9N..z.z^s...H.c......w.....>_...b..;..x...%.=.-..J.v...%: .|~6...E.b...6d]%...r...n.j@?.)...K.Zu.W.3.M@#..+...<..w.i..}.9.nb....O@....R....(....o]......7P..).R<....x15T...<.....Z..>...d8..Jex..`..w{..C`...2Z6.-..).t(g.(.-...0...y&....+....*..k._...,.Qf@.+c{.........=.#.Y.*s..... ....O;..-....b.PQSt....i...4..S3"_..B..`....."#".r...../Jy.q`#..)J.~.&........5~../.b.<.3..^.........Q....(.}y.KG..b..t.GW.8...kf..cC..!.Nn...5...@V.N&.I.)....k......r..UV..C.nMd...%e.".s.p~/.0..D..q..N4.....n`.e.,....C.....j|x...*....H.rh{Bi.<..KV}..(-/P-x..9.c"..6.....SH9b.F.hlHY.IlP5z..4....v.|...I.......<7..9..m..'.f..w..S.....3..^9.7.5..[5...+..R.r.c.<\...u..zl.R..u.d..aI}..8i...8.......!e.0N........c.6......2KV.0..=!..(O....1..M.r.i...'.=.ZP4...]>U.-.'.l/...L5..g..*.&..i).hw2...U......>..A..>.....T>...E...m..]..;O;...?.y..r0..H
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):262741
                                        Entropy (8bit):7.9992178967217615
                                        Encrypted:true
                                        SSDEEP:6144:f8dwO7/Etj4SE87FtSTHJg5jI7mWNEYiuaFIaYPLDeJ92CsoG:fJO7/E14Sx7FQi5BWhiuaFjYPnIK
                                        MD5:04AD0672BA9AB996B155BCB5C05945B4
                                        SHA1:6C21BCC7DC81FD1BD3ADED4C5B119555F4CAB878
                                        SHA-256:C45180343C61C7A007B17C11DA1965F65B454C3860D975EB4AC8A7D086ADE1D5
                                        SHA-512:BBFF8E148AC1EF4A338C4684D0E05165849BF90EE9A524FE1DB746BC1F3DE1607F2B73565F4E29AA6682343C1DC3388860D5FD096DB531ACFCE793B6A7811768
                                        Malicious:true
                                        Preview:.[#..J....Y...:..O..%b...!.v...]....%.. ../.Gwp....A...W4.J..(D-...#'..&9.JQ.$..e.....;.....~J..)8.|.#YkG..-.~....d.....]*...5."(.^....[.n...M"....m.r..?...#.S....m..[...9.......1..y..#..k.Q)..Y....d.'.-(.....=o.yTs.,T.-........^..p.3tl.;Z...i.u9.|..!.BSp........#*e../.'..4D.c..JV....$+wn...f..D......Z.%..Tn.]..g....:.'........aI$w..-g...........u...=.....3...nP....=..D..2...uzv.......g........0..M_...z.....d...dN#..%u?..f...\...<...U...v...O...$..l?.,hbr....]0.zHuS...........i@js...nR.Zb.t[.z0..-..H..1...4H|3k.o...^[Yb..R3t.M.Q.....*.._t....]...G0,..{o.6....*T..\we..'..).e.].....hJ..7F../.(4.9=.H....,.....!m6P.r....n..n)...........yY..~.....S......p|8...rTQ..`...t.....+...i.>V3.$a.i!2... .:F......E...LP"'..Y.!..`...2$.3_..S.;...H.tUE.m\.&.|...~...%.....c...[.| ..k...U..;..../....o...[!...-..EZ.x...&..,-.+...r.....#.....z=c.:.*&o...;H...z.i...i...Ee.QQ:.x$F...-.'.>..lr.ha.n..Sw..p.G..%2..&.e.C..a.....NRR.n.......$...qH....q.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):175399
                                        Entropy (8bit):5.2881511035307796
                                        Encrypted:false
                                        SSDEEP:1536:4i2JfRAqcbH41gwEOLe7HW4M/o//MRcAZl1p5ihs7EXXmEAD2OdaB:Jce7HW4M/o/7XDk2
                                        MD5:992F46DD8CC7653E5B2B42E62FC17C02
                                        SHA1:87653D93D81147727260E8CEFA562BFED421A48C
                                        SHA-256:D414B365D420C8700A98B4B5165BB8AB1935F8297F8A5FCDE2FC2D655A5D4E24
                                        SHA-512:FA99E3BD2DB72BAE14CB9B1D7F983322EA8D373127B256421B158C9034364D9CB6CFA3A03A70CEF44431FABDE67A1F834363BBF261FF73188F3324B7213A2706
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-07-30T17:31:49">.. Build: 16.0.17902.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):0.09216609452072291
                                        Encrypted:false
                                        SSDEEP:3:lSWFN3l/klslpF/4llfll:l9F8E0/
                                        MD5:F138A66469C10D5761C6CBB36F2163C3
                                        SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
                                        SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
                                        SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
                                        Malicious:false
                                        Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:SQLite Rollback Journal
                                        Category:dropped
                                        Size (bytes):4616
                                        Entropy (8bit):0.13700485453793962
                                        Encrypted:false
                                        SSDEEP:3:7FEG2l+Hc/all/FllkpMRgSWbNFl/sl+ltlslVlllfllHcn:7+/lVIg9bNFlEs1EP/3cn
                                        MD5:B6E2C1162A5F3BC579A6CD585BF7CFB5
                                        SHA1:93B8300E93104D25252A9E6059CE636673FF60B8
                                        SHA-256:242EDF94D055EE9A0F6DE4AFE48F146CC7921ACFC4064CC194E62E757E1B6B32
                                        SHA-512:BCBF31D522E20B63A241DC63FF965D6E45B740E4E0F7AEDEAA36E14850D6CC8E4AEA9B235C523F9EB793C3A95F440ABDB7ED2579841A2E3A28B4DF528C7839FA
                                        Malicious:false
                                        Preview:.... .c......v......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):32768
                                        Entropy (8bit):0.04470641479249482
                                        Encrypted:false
                                        SSDEEP:6:G4l2DJVVoWoCl2DJVVoOEL9XXPH4l942U:l2VYWom2VYOE5A0
                                        MD5:0DB3813A70989A484950228D18F8DA23
                                        SHA1:3479763220785369AC7FBE913EE8E2280B5AEC11
                                        SHA-256:2EB882969754529654DBBAE476B138595D6D5E81E7C52CE4DE491A1AF2A6E1DD
                                        SHA-512:D70B96B0FB260F2E55F1C271CD80CC69B6DE66D29BF6312537210F69B59F2A5DA5B52280CE84E8D83115C7C456D3920646504233CA1D2AD95F3E4DB7D979E7EE
                                        Malicious:false
                                        Preview:..-.....................QA..U'#.'...#..F.[........-.....................QA..U'#.'...#..F.[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:SQLite Write-Ahead Log, version 3007000
                                        Category:dropped
                                        Size (bytes):45352
                                        Entropy (8bit):0.3948870920328053
                                        Encrypted:false
                                        SSDEEP:24:KQ6uJtpVQ3zRDSb8Ull7DBtDi4kZERDjFvzqt8VtbDBtDi4kZERDO:dPpVQ1C8Ull7DYMlzO8VFDYMi
                                        MD5:DEB930F7B23BD1F8B5AA27009D6E8229
                                        SHA1:091699609FCFEBDF1E2F4BB173E59ED5251CE9AE
                                        SHA-256:2F0F71F2B2D10F3E0D4BDBC2BE84421616A9C2EF817B05A58D14E9A35D51D2DD
                                        SHA-512:E7716FAA953817477B838466E9D22FDCAC8433CE70534340933F4ED27D797F3E794846B34864581DDCEA9E5DE495F9DB844820394F3BEDDA5AD083DB29A293B4
                                        Malicious:false
                                        Preview:7....-..........'...#..F.q.:.I#.........'...#..F..^....HSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):49152
                                        Entropy (8bit):4.868734763341532
                                        Encrypted:false
                                        SSDEEP:768:NnkvGcdX9lE6pvupK876gT67Q6czTVxUSqjuv/IUxqcRhr2yyP:pEXjaT67Q6czUSqj8QUxRZ2
                                        MD5:A7E768591B425BB6DC71DF12148D7DA5
                                        SHA1:08DB0E735C26C7BD7623FA67F7160CB116DD68D2
                                        SHA-256:8BA26A9184F06154E2D41C68585E03AFDA4E89BB24059F70F011D7FE7C228BA4
                                        SHA-512:B28AD1B1F642034E319F45F6EA0392F0F5ADD16D7B84303AF9BA7BBC99831E490DB1F8DC1EE2743CF35E43438CD7EFA9608B2977B0B956C081E01ED4E7EE9900
                                        Malicious:false
                                        Preview:l.....\.".7............#....c..S...#..............0......@....................#....c..S...#..............8...0...8... ...H".........................?..?.........?...?.........................?..........?............................................~.................H3..89...h..............@...................?...........?.......................................................................................?.............................................~..........$...7...... ...H"......x..................?............?...?.........................?..........?............................................~.....|.......{q.s.....,..18i.n.......~...|......@........8=.W...c............0...8... ...H"..?......................?.....?......................................................................................................................................................................................................................................x..................?..?.........?.?.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):0.04401584019170665
                                        Encrypted:false
                                        SSDEEP:3:RRk//:Lk
                                        MD5:CD74ABACE8A00B17BD8107BC5982C21E
                                        SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                                        SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                                        SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                                        Malicious:false
                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):0.4945136704264069
                                        Encrypted:false
                                        SSDEEP:3:vldawlAuil8xt/l2l7BPFUt/gBOr6FuBkdfQlsxl/ll2hliJw5YfICiXvyllaclH:NTcFPyYQr6zwsj//GwJdXifZw1EVBs5
                                        MD5:2F8D33D8EC36D7D6907200530B2698A1
                                        SHA1:770AEB94C7D0E5DDA259966AFD4A5546F329DF34
                                        SHA-256:D396B19B3F7471CA5064D570244666110813958C3AE545DDB82B34FCC3EDFE39
                                        SHA-512:11A732E7AEC20D2481FB060DD2A43F4BB89EBDF80FAD5792305AFA584FBCED9A3DF5E76614A05F2A5B113D0044601D34E9FD4D88A375DA94A95CFC5267A679EB
                                        Malicious:false
                                        Preview:2...>...........~.......................................................................................................................................................................................:.......:..4.NTF....x..f........................:..4.NTF....x..f:....................................................:...........................................................:..P..............................................................................5........m;.H....7.5N..........Z..........$.62.k.N...`..k-....N...^...........................................................................................................$.62.k.N...`..k-............................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.738345541190342
                                        Encrypted:false
                                        SSDEEP:96:O+8K3jduSQxjzExyLk3s3gL8FttECxuEwFK732xtQhTX:O+8KTduSOjg8Lkc3gLsKCx7wFK732xtq
                                        MD5:BCA07CF1C51BA13D5E0CD6B4EB4E7305
                                        SHA1:C9540AE3E732D8841C3B3BC69124743FB3CBA868
                                        SHA-256:79703B7EB311E476C368DB488BF0F57DB3EB6897B362E29D428953483052E6D3
                                        SHA-512:20329057898DEC58FB8D0A6765251E8E0A18D57AAEAF077728578AEA7161F5224442C66E09BA2C92D7D1A792BCA7E3CBD7E03EFCAEBB185FA3CC60FC8414A57F
                                        Malicious:false
                                        Preview:j.......`.......L..................................................................?....................................................................j...............L...............................{q......{q.s.....,..18i.A.......A..)b....X#.N...........$!..."s.....A..)b....X#.N...A...{q.s.....,..18i.{q...........A.......A...................................................w5......w5....C.54...F].Q9......Q9=..GA..b..1..2...^...................,.......{q...Q9.Z.T.....J...<+............w5T.N...Q9T%m..Z.TT$.....]T&...J..T.:..A....5..A...."..A....h......J.......{q...c..,0...e...B4.$..........C@RQ.H..B......Y....................Z.T.....Z.T{...A..v..m.}........................<+.3T...?..y...<+...Q9=..GA..b..1...Q9..w5....C.54...F].w5.....>...............A..)b....X#.N....Q9=..GA..b..1...w5....C.54...F.................$!..."s.J.......J..Q...N.8jE..\.......Q9..........c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):4.743715879166226
                                        Encrypted:false
                                        SSDEEP:192:bs3wr7y85oVnXOYWRiBI3GONwJgL9i98/M0:A4eVXLWRiQ809q8/M
                                        MD5:37B0BA27935F5DDE309EA8A27F8A1482
                                        SHA1:E13F15B17685E13C6A096055F8F9866EDE9321C3
                                        SHA-256:1A59DB76DDAB9300445FF20597FBEC8680CC3A617AF4FCFA7B25F2C6B5026991
                                        SHA-512:503708D5D617501DACE823B426A7B274F0166989094D5E26D09464986D25F2A9DBAD2D5729AE786982AF2C1C66A2E4D05081B10B00486F6EB1D48091290D9127
                                        Malicious:false
                                        Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ..n.4.....n7R...;.. .....n7R...;.. .....n..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............v....9.....}..^....N...^...............LPr..l.L..... .............>...............................$....I.qk..B.....LZ............v....9.....}..^........v....9.....}..^...........n.......n.......n...........................................nj......nT%;....n.......n..W....nH......n..+....n..S....n..........Z4...........................................4../4......p...............C.a.l.i.b.r.i....................n:..nk..n..z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):40884
                                        Entropy (8bit):7.545929039957292
                                        Encrypted:false
                                        SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                        MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                        SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                        SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                        SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):4.371218751069372
                                        Encrypted:false
                                        SSDEEP:192:86sD/CHqJsomXMYDF8L2M0Kd8wp9n6RhVQIXSpRkT8WE22Nmuj9zUFCc:UD6K2oHYJ42MHvp9shVfSpRkTe22Txh
                                        MD5:483D93D6AE85EDAA2F700FA02C956038
                                        SHA1:2EE3D002484E6EB3B6F26549D6BDCCCE3133896C
                                        SHA-256:C32E738CD5171DEAAC3CEF1CFB3C31F9CE53B7E2F5F69717B10792FB1D207963
                                        SHA-512:EE98B5BBAD27CCE6574D373DC2C8A0A0B0DB42D263917817BEE7E5B68E652076249137DA52DE72911C50C8C24AFBA1AEC9369884EACD301833C1B1CC75E278DF
                                        Malicious:false
                                        Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZm7e.H...m7e~.l.....'$..m7e~.l.....'$..m7e..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............kH....P..mf.9....N...^.................]..&.B..$L.-............................................."....I.qk..B.....LZ..............kH....P..mf.9.................................m7e.....m7e.....m7e.........................................m7ej."..m7eT....m7e.....m7e..T..m7e.....m7e .A..m7e.....m7e ........m7e3m7e:m7e8m7e..z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                        Category:dropped
                                        Size (bytes):24268
                                        Entropy (8bit):6.946124661664625
                                        Encrypted:false
                                        SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                        MD5:3CD906D179F59DDFA112510C7E996351
                                        SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                        SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                        SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):4.592661791461898
                                        Encrypted:false
                                        SSDEEP:192:vslMIO8MynVEbGGeX9hjfe0mvw4/r7i7+/P7xGLXLTTRp3bKO9Jh6fgAxL9XD0Zn:kWmMyn1tnjm0oj7LHFGjLTTRpJhUgAxE
                                        MD5:7AAEC34FF987A25C5034F52BBAAF5029
                                        SHA1:78DC52963D8C98512A6D1D01DB8CAC13A0C32F6D
                                        SHA-256:CC497AC382F43B6B7981F0F59ED5AEE3A9CF29483432F4F2ED2A50A4D7316BF3
                                        SHA-512:E6859D3114768D26718122DB0FF74B13D5644F0B9C330539B7FB0C1E610C8A2D36C383B9CA7D4881038F81BD166905AC4C05376646D2BFF15E0B310D16C330D7
                                        Malicious:false
                                        Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZr...N...r.........h.A.%Nr.........h.A.%Nr....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............6.,..i.1..".......N...^............... ...*.N.B.B-..a............P....................................I.qk..B.....LZ.............6.,..i.1.."....................................r.......r.......r...........................................r..j.9..r..T....r.......r...s..r..H....r....0..r....`.&r..........r..3r..:r..Ar..8r....z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):39010
                                        Entropy (8bit):7.362726513389497
                                        Encrypted:false
                                        SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                        MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                        SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                        SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                        SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.9036201054293698
                                        Encrypted:false
                                        SSDEEP:192:Dst9jagJmH1aZURe+ABCevfL0Lkr183wRE4wjXQYcSyjEzXYRh:4vjrsHuURebZ0Lkr1WwRE5jXQnS06O
                                        MD5:98E1A8ABDA29943851741E450ADAC8CD
                                        SHA1:1444095EEDE36D3663E21055A41E41F0C719E074
                                        SHA-256:C855B359752936BB14671C7E6ABAF416BF2BB1FB0A1C0C3EE7F33711FB54D7D3
                                        SHA-512:E3BAFE1B469E6668F9AF6598F3F8C4991DDCBC0CD070473AF04665E516737022FE7ABFD4D51DF009F3B531E070AF3E0CF16DCE034C8C15CFBC5CBBFDCDF7D1D2
                                        Malicious:false
                                        Preview:....>......."...v.......8 ..."......>.......r...v...>...@....!...........................................................................................................................................I.......I.qk..B.....LZz.......z...=~..(.]I.N....&..*......P._...&.z...=~..(.]I.N..z....I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'............../....i.?.W...ot....N...^...................VT.@..H..k.............(...............................z....I.qk..B.....LZ............./....i.?.W...ot.................................z.......z.......z............................................&.8.....&..*......P._.z.......z...=~..(.]I.N..2................................I.................................&H......&.......&..d....&.......& ......&$.7....&.......& ..........&!..&..z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):59707
                                        Entropy (8bit):7.858445368171059
                                        Encrypted:false
                                        SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                        MD5:47ADB0DF6FDA756920225A099B722322
                                        SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                        SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                        SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.855894093934613
                                        Encrypted:false
                                        SSDEEP:192:Esr8WEkWjjZhSeUTpCXRzRlhcmJCUvwvS9NM2Ujoa:ZoC+ZMeUl8RzRlhCxSNH
                                        MD5:4BB89B392709CB9D2DD56CEDA39C1C1B
                                        SHA1:126D3D40E2B49FE2805C5C7422D4D42F560401CD
                                        SHA-256:DE051B155F75FB4494D9453397EEC0C91AA89CEC2C995D931B6FBD78F4342C25
                                        SHA-512:06229AD6F618A3C93DFA668E0C509FF25D1D3EF24705D5A8FCC6672D8003DB553DC301D0AAD83C118E009CD72D29C1A4E3B2C5A4897DC1547FFE2609ED2E2AE3
                                        Malicious:false
                                        Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZs...<...s..8....0k...".s..8....0k...".s....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............0....)....vb."......N...^................!Qw...B.V.I9Y..............................................D....I.qk..B.....LZ............0....)....vb."...................................s.......s.......s...........................................s..j....s..T.T..s.......s..|..s....;..s....h..s.......s.. .W.....'s..2s....z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y........................s..3s..8s....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9.............s..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                        Category:dropped
                                        Size (bytes):27862
                                        Entropy (8bit):7.238903610770013
                                        Encrypted:false
                                        SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                        MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                        SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                        SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                        SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):5.369670358923896
                                        Encrypted:false
                                        SSDEEP:384:WP7T5MX9E8syNmx/rdt/d2Zb6oAoOycY+vCPmM98MiDWVwdgQyEDr/XXg:dc9v6ZOQjU
                                        MD5:280645A60A1D4649B4651C02986402E0
                                        SHA1:C5E2DE55F1B1F9D496461D1F42DD7A5C1B8A93ED
                                        SHA-256:C5ED4CF2A744A09F9D29ECFED84912839E5AE9FEFD27E41603EF91FF8557ED91
                                        SHA-512:FCA6F216171F00235586019D27EB02DE51ED6CF88AF79080AE15DA3028D16F5A6A04010769AAAC12B268A768CDA5C9DD839E059D0A3F8E4E03E261A966F0FC45
                                        Malicious:false
                                        Preview:...@|...h................@..P .. M.........@|...................`K..P ...K.................................................................................@|...0................K..P ..@L..........................x.eK.k.X~.............=....................5.^6.p.)....0.....M........]0...........8=.W...c............................................................................T.a..}..T...."..T#P.............X.................I...................0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e....i.......i.... C.)P...!..<.......<...0.C....S..2...h...............8...............}........<..z.......r.................0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.1067720016393325
                                        Encrypted:false
                                        SSDEEP:96:Nus1yq/6S/IjkIEaueXK9sxDkTNRLOXRV:Nus1yC6Swjk1aueXK96Y5RLOX
                                        MD5:6A64EECE89FA61ACB344E92FF340DC52
                                        SHA1:8F00EA300BD1B68243C4CF06A994F1E0712C13A9
                                        SHA-256:BA4777135372C2FBB3D3300817E76D3F5382808433838CEFE70AA8D37B179BDD
                                        SHA-512:96BEFFC75784396601C9A126CA84D038CFB9D597D14FDA4CF0E3FB37940E3B8B038CB9E0A7E67BF8D72CF8BE48B979068D1FF178CC49897D8F6540C0F67B6703
                                        Malicious:false
                                        Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZ.a.......a.[.....(X...d.a.[.....(X...d.a...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............9...Z..|.j-I......N...^...............Y.8T:..E..............f........................................I.qk..B.....LZ..............9...Z..|.j-I............9...Z..|.j-I............a.......a.......a...........................................a.j.....a.T.]...a.......a...B...a.H.....a...B...a...>.).a...J...................;........4...4...4.."...............a...a...a...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........a.......a.....#.a.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.055808202188051
                                        Encrypted:false
                                        SSDEEP:48:m0s1MisaF6t5V/lNBt8EfmrXI9QTVscToirdqrtEIzdXRqkjfsa:dsejaF6P5lN78E8XI9QTVscTTRyzaes
                                        MD5:152DEADD0DED3106E0B860E6E3177C53
                                        SHA1:AC51F4F894388E85C7B0C128C9A56F9D15BD11EB
                                        SHA-256:EA9349FB8EF217FC73F2591889599358D6862A7C122B2829509532535DEB526F
                                        SHA-512:6A2D847796A7219A621E4920F94425481F55D6780A17B38F2234DF50637AD34C431654CD24A41E68ABF23F010F0626B1B149B8BDBCEE64A876DE30BC925DABCC
                                        Malicious:false
                                        Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ.t]......t].....#..B./G.t].....#..B./G.t]..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............}.......\=.......N...^................>..p.$D....2...........f........................................I.qk..B.....LZ.............}.......\=............}.......\=.............t]......t]......t]..........................................t]j.....t]T.]...t]......t]..B...t]H.....t]..B...t]..>.).t]..J...................;........4...4...4.."...............t]..t]..t]..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........t]......t]....#.t]............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.051794836325931
                                        Encrypted:false
                                        SSDEEP:48:5smesJat8wE3pmXs9BKrTo+rd6r+eIdVdXJfDzi04g:5sSJaLE3IXs9BKrTnRich4
                                        MD5:1D669030F4054EE9B1AE1BAFC70AC447
                                        SHA1:08C17BA5258FCD7A26F478D2FD6B91B4D6300B09
                                        SHA-256:35BFFBFAF7F77BA4611FF626DD5987D6B119B4CEA2688A6D9B418856CBEA442B
                                        SHA-512:4CEEF015808EB15D8013AB52574E783707847B9C9FE2E6D627A6C4F1D45DF4578DD1EB332AFA0E5925FAC66804F9F152D2E2B49D075BFBEE38605DC4712C3D09
                                        Malicious:false
                                        Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ.?.......?...+..'.C.'i.c.?...+..'.C.'i.c.?...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............1.zZ.j..-..Ew......N...^..................G#.yJ...]S.*.........f........................................I.qk..B.....LZ.............1.zZ.j..-..Ew...........1.zZ.j..-..Ew............?.......?.......?...........................................?.j.....?.T.]...?.......?...B...?.H.....?...B...?...>.).?...J...................;........4...4...4.."...............?...?...?...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........?.......?.....#.?.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.068405247455166
                                        Encrypted:false
                                        SSDEEP:48:UfksQKML9ne5ZqtXYwElxXm19yz5ToErdnrO3Ip7dX3Dj22cg:Ufkske5ZqFVETXm19yz5TJRrOw77c
                                        MD5:B2C624F4938A20CDB2CF9C058B92D5C9
                                        SHA1:ABF807D441D90C1E3729EACA695655A2BF9B9EC1
                                        SHA-256:AD77E12F3736C3CC20C0F3AF710D5A42D329B78A4D187E493B16C41972F3F8F6
                                        SHA-512:FD449CE01FC3EE4401542A5FD007CBD1DEA45A6225B8F13BA839C7A3B12C6ED186847B118ABFB6D31BB7E0E1043472C570869DAA3217AD26634C5895AC85961F
                                        Malicious:false
                                        Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ/>....../>...m;.<....M/>...m;.<....M/>...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Dh2Xcz~..td-5.......N...^...............YH.....A.....P.........f........................................I.qk..B.....LZ............Dh2Xcz~..td-5...........Dh2Xcz~..td-5............/>....../>....../>........................................../>.j..../>.T.]../>....../>...B../>.H..../>...B../>...>.)/>...J...................;........4...4...4.."............../>../>../>...z...y.. x.. ...........$........4......7...7........................;........4...4...4........./>....../>.....#/>.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.076057376881498
                                        Encrypted:false
                                        SSDEEP:96:1stTeUqC3EHaXE9ItCTIxRydYVeDpP1mpob:1sVq9HaXE9IUGRydYh
                                        MD5:D931918D1C421C5F1708AACA0DCF4BBC
                                        SHA1:8A227B85ED7DB6C6AAA27B297460B2EC01227931
                                        SHA-256:14203E26396369EFD043C4BA4E74561064C04C8E99BB9E196343312E607F9E2E
                                        SHA-512:351B44C61388172B3B472A3A32C8AC2A2A573FEC1227CC6E8E0B48CEE8D5CEE373E85AFCD95C95F7DDD3729D93E47E398A8F8CEF40C8FF851272EB11C09AF89F
                                        Malicious:false
                                        Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ.$W......$Wgb.../g......$Wgb.../g......$W..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............n.O.(m..&D.........N...^.................'.I.pF....~.s........f........................................I.qk..B.....LZ............n.O.(m..&D.............n.O.(m..&D...............$W......$W......$W..........................................$Wj.....$WT.]...$W......$W..B...$WH.....$W..B...$W..>.).$W..J...................;........4...4...4.."...............$W..$W..$W..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........$W......$W....#.$W............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.0942099024749385
                                        Encrypted:false
                                        SSDEEP:96:usYdeJGMfYVqdLSEaXA9lv+TERPLG7e3xzR1:usg8YAdL/aXA9V+IRPS
                                        MD5:E8DCDB0EEFAFF7873ED5E11F53258BEE
                                        SHA1:9B2C7CEF4A36EECD31DD132D03A4027724455D64
                                        SHA-256:CE22AD0D6EE509B42B70C827B79D32A512CC4B1419D70CF0C4B38B8D91B7E927
                                        SHA-512:FD2779E3C8551005F074367A5275185D7C48B6D9F15DFFB7B22F1A1396ACFADD647BC8F76609A582523CC41DFC1FF967D90AC6AE30A9640030AA4F4F341C5C57
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ..c.......cZ.....A`......cZ.....A`......c..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............._....!..72^..m......N...^...............K'..HC..{+%.A.........f........................................I.qk..B.....LZ............_....!..72^..m.........._....!..72^..m.............c.......c.......c...........................................cj......cT.]....c.......c..B....cH......c..B....c..>.)..c..J...................;........4...4...4.."................c...c...c..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........c.......c....#..c............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.069003498778496
                                        Encrypted:false
                                        SSDEEP:48:YpbsGRmzh7deuS5ftG1uO6EYw+X49UY3To2rdmrRhIBpdXxlRG78OqGL81:4bsHel5fAgEY7X49UY3TLR2ypcI
                                        MD5:43D77CEAB9C2F7C133C051CC162FBEA8
                                        SHA1:9A79367D3A7FA0FFD473DE1081920542C04D8159
                                        SHA-256:CF9AF1E80786C0DA36B6846293BB98F1D075B20DD0969E8DD2F30C90CD06ADF1
                                        SHA-512:A5D7F00EBC941D2833AD8B22CD6FBF34FFBEF890649DEA5E5163D11581388EA2F41EC2D7CE65678358246980353C93D56D41CB512585A0B09F0D147060AE3A47
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZy......y..A.a."..0.\.Jy..A.a."..0.\.Jy...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................]..u]q....N...^...............2.4....B..-r._.........f........................................I.qk..B.....LZ......................]..u]q..................]..u]q.........y......y......y..........................................y.j....y.T.]..y......y..B..y.H....y...B..y...>.)y...J...................;........4...4...4.."..............y..y..y...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........y......y.....#y.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.090410189535527
                                        Encrypted:false
                                        SSDEEP:48:YIi8i9srb8rN/1U1jVtqGEn6rFXSh9dzKTolrdvlxrEIBwdXKlRhxd:yN9sUNNU1jVfEYXk9dzKTMRHk6
                                        MD5:2155497090A350BB38DA6C7D8CBC7AC5
                                        SHA1:18E575F1533D04A295B2F99DE1FBE33BE768F6B8
                                        SHA-256:ADE1B0EE1F3F2FF1B5FA4F831D0698F4D4D6669D73C4437300528E989B5F7A24
                                        SHA-512:3E466D2B2AD882E0E5BF99F8DEF696785B36DCC614F837C0F1059B34A1FD8E8EBBCB5F1D2E7CC2B3F4B2B8DF1B22732AFE622C0BC22A18FA1ED3144478B079B1
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZM.......M....2F. ...-/.BM....2F. ...-/.BM....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................Q...,..G..;J....N...^...............~...=..H.=..[..........f........................................I.qk..B.....LZ...............Q...,..G..;J...........Q...,..G..;J.........M.......M.......M...........................................M..j....M..T.]..M.......M....B..M..H....M....B..M....>.)M....J...................;........4...4...4.."..............M...M...M....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........M.......M......#M..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.084140552572893
                                        Encrypted:false
                                        SSDEEP:96:KsQ5CkHzq3D8vEXgiXs9xPGTQRjT+6k/M3pnK:KsYgDfXgiXs9xPGcRjT
                                        MD5:1FEC51786534A8E5D40724AD868D042B
                                        SHA1:B2732EE55A13B827210ED45E8FFB03BBA069B8C6
                                        SHA-256:58F98441D11FA62D9F5A37EAA74FA212D9C23CD87939B02EEC7D6D4705E1F02C
                                        SHA-512:69EC658199D578D64425047ED716C8C5D50EB56D4DA210C7AC280B54A95E1EF3B348C4C1EBFF7698688399A87DBEC750B7F7A4570DCF24B887E74ED5203D5AD8
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ..........F;P.......[....F;P.......[.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............<r..[l..=.V.U..N....N...^...............~.~].^C....?..c........f........................................I.qk..B.....LZ............<r..[l..=.V.U..N........<r..[l..=.V.U..N....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.086480976264342
                                        Encrypted:false
                                        SSDEEP:96:qsqQe78HLE7Xg9dMTORIuPjcpVjGSpVnWVY:qsqQeT7Xg9dMCRIoIpVjGSpVWVY
                                        MD5:38CDDA3F27E3D8D0A47C6DEE5A2982FF
                                        SHA1:E32BA3F6CCDBF8D31307D507E5D01DC4D7BC1395
                                        SHA-256:D18E800E430723AA92E5A8A47E356BB01E9841E5BA72FA8D303C0F6124146DDB
                                        SHA-512:FB27734D697BECAEC736E95D30EDC1E168BCDC75AF9CAB51E9C19C794DCA0EBBAC36F08CF36CB2EDEC4ACFAED283551F4A2AF8B2CAFC7EBC85D34B86B6E34240
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZAm......Am...l..:.......Am...l..:.......Am...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............1..1..&D.#.H.]....N...^....................0L.M-8.9$S........f........................................I.qk..B.....LZ..............1..1..&D.#.H.]..........1..1..&D.#.H.].........Am......Am......Am..........................................Am.j....Am.T.]..Am......Am...B..Am.H....Am...B..Am...>.)Am...J...................;........4...4...4.."..............Am..Am..Am...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Am......Am.....#Am.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.077972801894362
                                        Encrypted:false
                                        SSDEEP:96:P72sSWdJAg8Sl+jEfZXE9dkTyRfOHJIcMOA:asn4ZSjxXE9dkuRfO
                                        MD5:E84774DFC07EFA3EA724E49E78A03A77
                                        SHA1:14165A37CE3ED61FA2ABF974F2144863641C7B24
                                        SHA-256:5BC5D68DC13E1FF83A27567072F34AE84DCB3589A5060DF9C29568EECE41265E
                                        SHA-512:420868E47D97FF2F32A19185894A0D3A8F4177D8490AD612034325B62476618E8A80BC3C643BD1F142DB370C68B83A86BCED67BD6AEF6BF1F53E77C3B3C15415
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.a......ao.V?./.w:(....ao.V?./.w:(....a..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............2.%e.3..4-X.TQ.....N...^................o..i0G.fu...).........f........................................I.qk..B.....LZ............2.%e.3..4-X.TQ.........2.%e.3..4-X.TQ...........a......a......a..........................................aj.....aT.]...a......a..B...aH.....a..B...a..>.).a..J...................;........4...4...4.."...............a..a..a..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........a......a....#.a............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.068147457442855
                                        Encrypted:false
                                        SSDEEP:48:Y+wBstKMNX7EXltc22FhGEFnoXg935a82ToVrd2tr4IydXylRuMlR:iBsHr0lOiEFoXg9U82ToRegGl
                                        MD5:4A66FAA710DEED5FB5C2C5DACCA36BB4
                                        SHA1:B91D28B76A17506E37506F91C761C8284BD459C5
                                        SHA-256:F8E6F33EF2E659CF9F54FD703FFBEA35752F3AD30A8180B9430054C4AC7FE63B
                                        SHA-512:EBAF9982FEE72269CE99861989B14E7735150454F9EBB5444FD399175A16B3715408CDB1D083C45EBAE64D1FD4366F3E89296D4206BD3FFE2AE02F345359610B
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZl]......l]...4...o.C..Zdl]...4...o.C..Zdl]...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............v.......%...)a......N...^...............V":...I@.3j_.f..........f........................................I.qk..B.....LZ............v.......%...)a..........v.......%...)a...........l]......l]......l]..........................................l].j....l].T.]..l]......l]..B..l].H....l]...B..l]...>.)l]...J...................;........4...4...4.."..............l]..l]..l]...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........l]......l].....#l].............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.078931485181804
                                        Encrypted:false
                                        SSDEEP:48:IKUX2U+srkgKdqZltRjtxiEt9X/Q96MTozrdfokr9IYdXW5akxQY8a:BJ5sAqZlVgEXXY96MTaRfHpF+8
                                        MD5:130C61B1F726812215E45FC83774A411
                                        SHA1:03DAF7F6D67634462B17E59A781C85977F4134BB
                                        SHA-256:354C5E1FFCCCC95D9460E881BF77B7861E36F06CC16AC2B4E0DF4E57F402A432
                                        SHA-512:57A7F74BE0902BEAA74738EC80A8C90E751F72D17401B8EC6D16B946CC47300FD0BEB851D6D5322D25407EB675E766D0F45101DBBD52225BD9529AB4F8FA23A0
                                        Malicious:false
                                        Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ............7.T...nb........7.T...nb.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............b. ....!K..Q.....N...^................L..a..N.Z...d;t........f........................................I.qk..B.....LZ.............b. ....!K..Q..........b. ....!K..Q.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.033245185344536
                                        Encrypted:false
                                        SSDEEP:48:BstEpY6ct0Qt8Eno3CX4B9ZsVNToErdlrEZIZdX3GkI+0a:BsSY6cSC8EVXI9ZANTlRpEAga0
                                        MD5:E1CCEC397AC9877055025475F7CC9BB3
                                        SHA1:B0E6F6C348A9041BE917BBACE44C0D427BAB8675
                                        SHA-256:EBBE1766099DA786551EA7385D3D9242E032D1BE73283D4C5FA797923DDDCAC5
                                        SHA-512:7901E147FFF33F3168C262097A56F1F5DFA4E95E7D50863F3DC3FB627756FB3D587AC4B5DBF3AE6B171ACE1E8DA4E06D5DC3A2BD84CEBF343027ACEBD3FC9041
                                        Malicious:false
                                        Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ. "...... "..7$...d.3.]. "..7$...d.3.]. "..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............1...@./.m.@......N...^...................>CM..+.............f........................................I.qk..B.....LZ..............1...@./.m.@............1...@./.m.@............ "...... "...... ".......................................... "j..... "T.]... "...... "..B... "H..... "..B... "..>.). "..J...................;........4...4...4.."............... ".. ".. "..z...y.. x.. ...........$........4......7...7........................;........4...4...4.......... "...... "....#. "............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.078327358986024
                                        Encrypted:false
                                        SSDEEP:48:Rs+pU8pQMomtzeB079tMEdLXM9wNT+5TotrddrDIOdXKdqtkp/5lrqoON1a:RsWeMom8B0TMEZXM9wNTCTcRR9Heg
                                        MD5:97B55B5E389DC605745AE03F20513057
                                        SHA1:AC8DA28C2E25FD70915060B40FE21EDCFF026AD3
                                        SHA-256:E512E095D3DE545D0C70C08BABEC646D630B5B4C9C0A0F335309AC1C598AD725
                                        SHA-512:283084BF4B060A5867EE463187FA9466E4A01EA48C4DE749772BC57C0CCA43BC4643DA85C9A55C75D4D1DD2F79EE9AEF4C2DB8D956A60D160EF91230936BC582
                                        Malicious:false
                                        Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZN.6.....N.6....4.md.b.,N.6....4.md.b.,N.6..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............%2@.j../..I.6.....N...^................5.pK..G.%-$..-.........f........................................I.qk..B.....LZ.............%2@.j../..I.6..........%2@.j../..I.6..........N.6.....N.6.....N.6.........................................N.6j....N.6T.]..N.6.....N.6..B..N.6H....N.6..B..N.6..>.)N.6..J...................;........4...4...4.."..............N.6.N.6.N.6..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........N.6.....N.6....#N.6............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.173712062646338
                                        Encrypted:false
                                        SSDEEP:96:eskTPPsy/A0lcEKXYP99pTdRvxYPy0mhl:escH/AC5KXYP99pJRvx
                                        MD5:F4E500BE956A46E3C43B1897C5865F72
                                        SHA1:F53BC96C1A18E7F077204A5B3F8625D895E5887E
                                        SHA-256:2631FF3CB7FD4B07B61E61D45540D5FE3B7C12D0D0DDFDE0E7B6939BA7D82DC0
                                        SHA-512:9C4E32DCB841FCA738FB441BCA8FD05C5B2334EF4906E6770DAA8E227CC9C5AAAB0604B0EBDAA0B07EEC1B2AC951AB0EDC7A545C390926EE109857B75BD09D87
                                        Malicious:false
                                        Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ..8.......8.HV..,.,.......8.HV..,.,.......8..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............3.X.-.G.*L.|......N...^...............B....M...g.-..........f........................................I.qk..B.....LZ............3.X.-.G.*L.|..........3.X.-.G.*L.|.............8.......8.......8...........................................8j......8T.]....8.......8..B....8H......8..B....8..>.)..8..J...................;........4...4...4.."................8...8...8..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........8.......8....#..8............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.158798621542166
                                        Encrypted:false
                                        SSDEEP:96:0DsmBCYpdEr5MEPIXw9DMcTTaRIpy/CpPxHK4:6sypdq5pwXw9DMcTmRIpyR
                                        MD5:626F51245CECC7F9D19D3F0C388BECE3
                                        SHA1:4166D0DA936F1B70EE9DAB186AD499C2354278F1
                                        SHA-256:A237A3BA56AB827ED7E49F0A03B998432F4C805B151A12E5D46CEF31481ECCA6
                                        SHA-512:73562128B3F6A1FCC24048550FD307F062EE0A12DFC12FC6A0D0E1C2FFBED25F1B3FC3F1CBA222F47EF9BE0B5A4F096BF12DAF996A76FA94E036E52D1EEDF544
                                        Malicious:false
                                        Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ.o......of......f(.M...of......f(.M...o..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Rs..d U.-{A{Wm$6....N...^................HE...F................f........................................I.qk..B.....LZ............Rs..d U.-{A{Wm$6........Rs..d U.-{A{Wm$6..........o......o......o..........................................oj.....oT.]...o......o..B...oH.....o..B...o..>.).o..J...................;........4...4...4.."...............o..o..o..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........o......o....#.o............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.125872313063504
                                        Encrypted:false
                                        SSDEEP:48:7mesax6aD5Md9tWKhY+EBAC+r6Xw9XDjvqBToFrdSroIKdXCuMsD1V:pssLMd9EwEBA7uXw9zzqBTwRKIqsJ
                                        MD5:B355433F0F0C276D04FA77E9D7ADB4A2
                                        SHA1:E0CD3F42BEEB1BF3A1A8AD025B4E76E47ED4F441
                                        SHA-256:D4AB7E8C5ED5C806F6737FCA12251528BCD227DE2792B55FCECF2EA7FBEA5CA5
                                        SHA-512:2031810C982AB09F47E28DCE55F9501EA615BB4F4D4D5487BF6A6FDB7BB63DB076798EB0798D381A309D51E7089DBC4611E480DD287DEC0AE1E1A6880402BF66
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZu.j.....u.jv.Q..7.m...=u.jv.Q..7.m...=u.j..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>.+....(.?.U.......N...^...................].O.9q..N..........f........................................I.qk..B.....LZ.............>.+....(.?.U............>.+....(.?.U............u.j.....u.j.....u.j.........................................u.jj....u.jT.]..u.j.....u.j..B..u.jH....u.j..B..u.j..>.)u.j..J...................;........4...4...4.."..............u.j.u.j.u.j..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........u.j.....u.j....#u.j............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.098647584219779
                                        Encrypted:false
                                        SSDEEP:96:S0sCvTz2pTJ4mI7E78cXrc91TXRKmGnMkrzqhtik8NkDTb:1sCvTz21JjI4IcXrc91DRKPMkrzqhtiA
                                        MD5:1DB1F99F671EC9326C5E555917F1F0C9
                                        SHA1:C3ABC7993B071EB74B39EADC9CB4B723180BD5C8
                                        SHA-256:495F9FF31D2D738376D726DB6D89016082CBB5214CF07297D7B428498A79992A
                                        SHA-512:628C1171BA752BF9EC99468F4FCBD7C39422AC085D397B223E75B54C7A82B4F0BB30B52717F623DE0D80C058F3565FFF5FA38BAE808340E3CE0ED7B1279A4B9B
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................8.......8.*.b}....X?.)..I.......I.qk..B.....LZ.8.*.b}....X?.).8...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............G..........O....N...^................1...x.N.ZL...lo........f........................................I.qk..B.....LZ..............G..........O..........G..........O..........8.......8.......8...........................................8.j.....8.T.]...8.......8...B...8.H.....8...B...8...>.).8...J...................;........4...4...4.."...............8...8...8...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........8.......8.....#.8.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.131841932144553
                                        Encrypted:false
                                        SSDEEP:96:VsEchlve/zVesEEYXI9w96TlRKmVnC1l:Vs9XvqQRXI9w96RRKmV
                                        MD5:B94184AF9EA279FFE27D8722B8EAF721
                                        SHA1:6DFB73B68A84DEF492BCA4308BD72F324F134B57
                                        SHA-256:F1E10102B688FD4D8FAF9029DAF38F9F7B6FFE00661CA3977AEFE3CB185BDD5B
                                        SHA-512:B986BAB6C7337A162EB7320686251C5E82DB311FA50757C3BF16CD31A195A6A8CE542AFA3611224886707110C2D54022263D6EDE9680C77A34B2D7E0128B2615
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.D.......D..v.L.+.jw..iZ.D..v.L.+.jw..iZ.D...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Y.thA..6...I.......N...^...............x.F.a..C.....M..........f........................................I.qk..B.....LZ.............Y.thA..6...I............Y.thA..6...I.............D.......D.......D...........................................D.j.....D.T.]...D.......D...B...D.H.....D...B...D...>.).D...J...................;........4...4...4.."...............D...D...D...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........D.......D.....#.D.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.102101253846096
                                        Encrypted:false
                                        SSDEEP:48:E0BsI7Zbw1k071Qt8yE2CH8XAB9rzLTo4rdSrimmIRdXH2gw1Ggtr1Dx:9srv7a1E2RXg9rPT1RKp0D
                                        MD5:1CAFE32A9F9085A00EBEF9BDB8FD2229
                                        SHA1:EF45DA0276497529EAE82575E7A63867B365CBEE
                                        SHA-256:2789E8279F68EAF43D89EAFC9D7DB6F248572BB4C902D53C91DECDAC2B4DEB5C
                                        SHA-512:10A5CF9E642EF8DCBC9BB5EA03DE821E93553730D284A1344C66B79607B6E782535D34DF03DE61E8BADE2DE284D929C56067EE7BC3D82136A88DA94652CEF5DC
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZq.......q..i.>....b8ED.q..i.>....b8ED.q....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................u,....|..V.......N...^...............i.....uA..Z...].........f........................................I.qk..B.....LZ...............u,....|..V..............u,....|..V............q.......q.......q...........................................q..j....q..T.]..q.......q...B..q..H....q....B..q....>.)q....J...................;........4...4...4.."..............q...q...q....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........q.......q......#q..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.095832645166951
                                        Encrypted:false
                                        SSDEEP:48:Fs8XiINGSQNtL0KFEG9CCZjXo9LTOGTomrdSr1IHdXFWNKuZ:FsLINGRN1EiTXo9tT3RK+gJ
                                        MD5:D3422FC7561E29FA2AC7AD1E63D4D32D
                                        SHA1:6645EA4B6D486B8560ED4FCFCF5D2A87094F6D4E
                                        SHA-256:98F4D5E7C1DD7DDAE029D55FD442657CC0D8D697A399C3357A30FE2FE53DF448
                                        SHA-512:329801C1F124CD1C83F5045E04DA637F081A97C58A9A2876816D2C186E46F510041F342185AAF19E8504826B8FD09392A8499C2090C776EA17603AA747F6A1BF
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZA.J.....A.J-.....73....A.J-.....73....A.J..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|c.9?...w...._.....N...^...............0..]m.J.A.............f........................................I.qk..B.....LZ.............|c.9?...w...._..........|c.9?...w...._..........A.J.....A.J.....A.J.........................................A.Jj....A.JT.]..A.J.....A.J..B..A.JH....A.J..B..A.J..>.)A.J..J...................;........4...4...4.."..............A.J.A.J.A.J..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........A.J.....A.J....#A.J............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.096451769598394
                                        Encrypted:false
                                        SSDEEP:48:ZsMf6OBAYgGQ5tQuEnpDCZPSX09YI5x8TovrdSrFIT4dXcW0a0C5:ZsIHgGQ51E1xX09YI4TmRKZ6W5
                                        MD5:B5EB8EA564FE36742D88AD896F8DBB5C
                                        SHA1:EABB580D119744FAC1CBE2EFDF95101E07778D8E
                                        SHA-256:E33DEF31240CDEF5FD09ED9209B8ABC9E2B47D2B753E687F8960E63B1FC50C38
                                        SHA-512:E119F18978BD6539BA9249346D71FED8D8D8C05DAEA4365E2D3DA5B34BB854F24CCBDCA3898A07EF8BB7D5FEAA6C09BDB2D0605AFC91F08815CDA984666092F9
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.P2......P2Y.[g.........P2Y.[g.........P2..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............e.$....'.........N...^...............0....0.C.....j+.........f........................................I.qk..B.....LZ..............e.$....'...............e.$....'...............P2......P2......P2..........................................P2j.....P2T.]...P2......P2..B...P2H.....P2..B...P2..>.).P2..J...................;........4...4...4.."...............P2..P2..P2..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........P2......P2....#.P2............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.128300819256392
                                        Encrypted:false
                                        SSDEEP:48:Zs6qQNNnP1T2DS3FNtDM6EmCKZXI9WTMyToLrdSr0IZKdX4hAyLCQyMGTN:ZsydT2DS3LdnEm3XI9mvTaRKjKEk
                                        MD5:164B38B13DD945980D0A85B4F450A8A8
                                        SHA1:7B436EA21D1173E9EF8AAD366A0C4A1340CE9098
                                        SHA-256:DDB5699B7A26DD0890F650920E4EA2075EC913430226A752CEBDC1546E306C69
                                        SHA-512:699A05776EBDA8EEC40C7F29987B73E529C5CE4D2FF47A2233E44A3B937A3307A03F6421AFD7B4ACAFD7E2B12F99CE46B560759F1AF11A54F129702ED499D613
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.k.......k...u....P/(...k...u....P/(...k...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............../...L..8A.Rn.......N...^................/.^j..D.t.....4........f........................................I.qk..B.....LZ............./...L..8A.Rn............/...L..8A.Rn.............k.......k.......k...........................................k.j.....k.T.]...k.......k..B...k.H.....k...B...k...>.).k...J...................;........4...4...4.."...............k...k...k...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........k.......k.....#.k.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.128042689297395
                                        Encrypted:false
                                        SSDEEP:48:KcsfflBcL/Ot6zsElCC5gX09am/ODToIrdSr+IFdXTl0Q0GGft:KcscL/O1ElCbX09UTNRK1g
                                        MD5:1FF7810DBD0BEF2CA4622C34D30ED3D2
                                        SHA1:866FEE4945F8492438E653074E737CA5AABDFB0D
                                        SHA-256:960A4961C9BDAB0F19FD3343E59C26A71DD198E7968EBD5C455C2D37BA3BCB7B
                                        SHA-512:26BA80F32646636D78D224128825A400CCEEEFB74CA1015D8AFEA34EF3B6897B403679569F4C2D1D85B30B4F1CD8B2D49A1F6EC641A2E709C5B0E8C8D53C07B1
                                        Malicious:false
                                        Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ].......].......gP5F..].......gP5F..]....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............V..b..|.4..&.....N...^.................;...8O...;<..........f........................................I.qk..B.....LZ..............V..b..|.4..&...........V..b..|.4..&..........].......].......]...........................................]..j....]..T.]..].......]...B..]..H....]....B..]....>.)]....J...................;........4...4...4.."..............]...]...]....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........].......]......#]..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.102335939821532
                                        Encrypted:false
                                        SSDEEP:48:KXAhsyLclbZWfUEte0E6tiC+GPXA19DaqTonrdSrDIha7dXozLt0Q4wWPHR:KEsHH+hlE6c7IXA19DdTORKTQgXH
                                        MD5:8A8EE06908F67C8011B06D1D903A5C4F
                                        SHA1:458E90BF9B26ED6EF95EAF6742C2A4A08B08D907
                                        SHA-256:771563303A16DB7A8D45842F8ADE2D937E9C16EA24C1D703497026AA9B34DA9C
                                        SHA-512:9C96E109AA2A099A918BDE8CD82CF3468FB7E19A7B7B7290D1C1B413D4AE44F506CECF696FE60A89651B628BD861997EBCB0DDE4AEB6CEBB7323BEC6F8FCAE24
                                        Malicious:false
                                        Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ.<.......<....B.-e.y^E...<....B.-e.y^E...<...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............@/p....^..Ik5.....N...^................z..:..E.B..$...........f........................................I.qk..B.....LZ..............@/p....^..Ik5...........@/p....^..Ik5...........<.......<.......<...........................................<.j.....<.T.]...<.......<...B...<.H.....<...B...<...>.).<...J...................;........4...4...4.."...............<...<...<...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........<.......<.....#.<.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.143951692653315
                                        Encrypted:false
                                        SSDEEP:48:QuesHNYEcS8IBKtbfTqEIWCCY6Xs9HcBToWrdSreI/dXB35SRil5r5l:QTs/BKdqEPhXs9HQTvRKvX
                                        MD5:76A32175D81D3A0FDBEF46E4757A847E
                                        SHA1:19179442A9EDAC50B598A3F7E5F2DAB470E60398
                                        SHA-256:797E25760AC4D367951CFBC87E09817DCF6223A42D056516A61CF6233C5D5F6F
                                        SHA-512:51CF42BB04F84886774AEA57C4FDB01BB371EF8B1F12ACDD619C5DBE57EFF1246F258AACE50F3FFB7635D412989845DC9893BDD5BFDCA7D09A7EFF903A3747AD
                                        Malicious:false
                                        Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZN.X.....N.X.t.W......w..N.X.t.W......w..N.X..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............f]...\...%.lQ.r.....N...^...............q...N=.G...b[Ccb........f........................................I.qk..B.....LZ............f]...\...%.lQ.r.........f]...\...%.lQ.r..........N.X.....N.X.....N.X.........................................N.Xj....N.XT.]..N.X.....N.X..B..N.XH....N.X..B..N.X..>.)N.X..J...................;........4...4...4.."..............N.X.N.X.N.X..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........N.X.....N.X....#N.X............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.126236507055654
                                        Encrypted:false
                                        SSDEEP:96:5s44DjH0jJEVEXM9ETkRKezfiGrEfOVu:5sfH0qmXM9EIRKe
                                        MD5:D7FDFC7D5CE062534EFA188F9B99052D
                                        SHA1:4C3AFA5D004BDEB65E306C18D4FCDC8F79CAA096
                                        SHA-256:734ADF22214154B3FDF6DB9EC542CC8F8C0CCDB89B5786967AC8C44357022092
                                        SHA-512:ADBF5356AED12C85CC89C9F42939A90AD0535563916E13B500DD19EE6468034435C8B7DBF1F464FD0E29E08C72061A7176A520CA74D6DDB6C9FF7473E21DF2FF
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.>.......>...HF.>q.......>...HF.>q.......>...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............f..v}....Lb{eQ......N...^...............=uX.FV.M..|..n&]........f........................................I.qk..B.....LZ............f..v}....Lb{eQ..........f..v}....Lb{eQ............>.......>.......>...........................................>.j.....>.T.]...>.......>...B...>.H.....>...B...>...>.).>...J...................;........4...4...4.."...............>...>...>...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........>.......>.....#.>.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.135071304220647
                                        Encrypted:false
                                        SSDEEP:48:uSss/pfeC7ftNNDU6dEsWCjt4X09jh3mYP6ToJxrdSr9IEdXoqMud:9sAeC7fl9dEsWMyX09066TeRK53
                                        MD5:6EA5EEA7274E0A0B897E13B7AF165458
                                        SHA1:6727D8EBFA41DEE4433C9BD0B56E3A7925A1F959
                                        SHA-256:AACCEDD6F346075F78FCE945E3F8D60BF70DA3791518D01FE0890F352CF01507
                                        SHA-512:29510E99AFAF85A0EA9EA8FB4B3CD1FF608B7EED061228B042E2E9F2448C1A045C58D6EBE070321FBCBB53194ECEB7238FA54657125CFBF321E9AD8A291E52A5
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.............,}..:...H.......,}..:...H.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............8.X.....l.+........N...^.................|.8SlC..T".X........f........................................I.qk..B.....LZ............8.X.....l.+............8.X.....l.+............................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.11017319039304
                                        Encrypted:false
                                        SSDEEP:48:3psydC7YifSLqtP4vqER35uCAZ0XM98ZSi4JTo+rdSrGIndXJKl2kZV:Zs4CYifSLqMqER3cqXM98z8T3RKPkZ
                                        MD5:49505EAE2FCAD585AD89C36CE4BE38B5
                                        SHA1:270A369877B696B37DEE5903E2485E82D1593518
                                        SHA-256:2CF8EF823A7FBC91838D367D7A59F2C6948707F47CEB1A539A5CF66471DBEA57
                                        SHA-512:50173C0DF8F11B995C596B56799F6012AF2FB850EF1CCFFA094C89196EE029435BE698A1EB23C7BF1C82C9F95C2290DE8C4845DED12D171D99491F4A0C462D59
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ>S......>S.c.z....T^..Qk>S.c.z....T^..Qk>S...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............l...J;. C._Y.......N...^...............M8.l.dcJ..C`.|i.........f........................................I.qk..B.....LZ............l...J;. C._Y...........l...J;. C._Y............>S......>S......>S..........................................>S.j....>S.T.]..>S......>S...B..>S.H....>S...B..>S...>.)>S...J...................;........4...4...4.."..............>S..>S..>S...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........>S......>S.....#>S.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.119705309370674
                                        Encrypted:false
                                        SSDEEP:48:E05sdUs2K0ds3m0tHd0M3GSENAIWCp2h9XY9ZlvToGxrdSrsIIR7dXDGV0VVlvSZ:E05s8s3rD731ENA1s2TXY9XTBRKs32
                                        MD5:F79C36B5806BF4F3647C67ACBC35A1E6
                                        SHA1:160E0DEB8B653C023E22BBFB24A86C50AC351A3B
                                        SHA-256:902E87F4428660350DC0E95C5A2E142C34E3281157E70754706667781E02C2E5
                                        SHA-512:E0BEC816A16E84AB6AC4DDF5646FF44E259F5ADD72903B406ED519580F6D33A4EF11135EE9AC81DB0A38528412920580B33A5B1E6EC843E53342410396D33942
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.R.......R....W.-:.).d...R....W.-:.).d...R...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............F..Kg.......'......N...^...................1.9L....Ii9.........f........................................I.qk..B.....LZ.............F..Kg.......'...........F..Kg.......'............R.......R.......R...........................................R.j.....R.T.]...R.......R..B...R.H.....R...B...R...>.).R...J...................;........4...4...4.."...............R...R...R...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........R.......R.....#.R.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.153247531483543
                                        Encrypted:false
                                        SSDEEP:48:K4BskuAR09ztZ8MEyrCQmXk9SBTo90rdSrVI3dXBypy0QR97qLqpObIe:KQsP9z1EyrWXk9iT+0RK+xI
                                        MD5:A0DFCC464CDFAE1C0CA73091062383B0
                                        SHA1:554ADF64CC30351F5C6CEDA327C0B3E5A4FB6C71
                                        SHA-256:A7B5383DF8CEFA59F4727C49AB8B237254B42203762A7D5E8817ABBB21E36814
                                        SHA-512:FFEFEBEDE6D05EF54BCCDEF62B3278A7D1FA9DBFF7987E92C2101D5472CF6EDBBFEB66BE1768E20E32FEDD86DD870381F780D6F562A12528738FF7A7810267A8
                                        Malicious:false
                                        Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZS!......S!...Z.......|1S!...Z.......|1S!...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............]*.2~.c.......*.....N...^................<.uj.A.X-.l.b.........f........................................I.qk..B.....LZ............]*.2~.c.......*.........]*.2~.c.......*..........S!......S!......S!..........................................S!.j....S!.T.]..S!......S!...B..S!.H....S!...B..S!...>.)S!...J...................;........4...4...4.."..............S!..S!..S!...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........S!......S!.....#S!.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.152502327934496
                                        Encrypted:false
                                        SSDEEP:96:kmsvD4MYa/F+7yEXlXC9IfTZxRK+hLyyYbWEjT5FgLZ0ab:nsr5/FC1XC9IFxRK+o
                                        MD5:D0C54719B78B0D117131DC1FCA4F90B5
                                        SHA1:19BD09EE70F5F5B459480E85884A4AFD72AD92D9
                                        SHA-256:FF39E4B0A0F784446A68EA58C686972252D36BD9629687B288791768D8EC1441
                                        SHA-512:21D93764BEB981275F5315AC2CC9E4ED4CD747734411655AD6193B722542199ADFF81A4C7993A5C905D9F65DEF11D79C6AECDF007047B9D41064BA04ED36516B
                                        Malicious:false
                                        Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZ."o......"o%$.`...q....."o%$.`...q....."o..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............u].[...6.l.........N...^...............{..&r4.F....8..&........f........................................I.qk..B.....LZ............u].[...6.l.............u].[...6.l..............."o......"o......"o.........................................."oj....."oT.]..."o......"o..B..."oH....."o..B..."o..>.)."o..J...................;........4...4...4.."..............."o.."o.."o..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........."o......"o....#."o............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):3.591485610750949
                                        Encrypted:false
                                        SSDEEP:96:teo1u7fGypoYo9LCpEqBdnFQYEG4IYwEWNKZT2Gmic4IdtAH4IQZ31:0o8Gwto9VqBdFQFOYNDFU/AX01
                                        MD5:48F83D100EAFC33C3A277F6052F1D9D5
                                        SHA1:2874B4DB5C9C988F9D093FE2D7CAB7F5FC9B55F8
                                        SHA-256:5EECA78ADACEC8D54F4D5E94C2120B8BB4318D2E9687D5561E5EFDE458E41BD9
                                        SHA-512:4D610C967043B5B26516FCB971B64AEFFB1A75E838DEB5465E98191D0096B1A1C5BF65EC4216A869018F34710047762254C171945309336A124DFA68BC51DB10
                                        Malicious:false
                                        Preview:\...L...............................................................................................?...................................................\...L...............,............................%.......%.{_J.......|p..4......4..I..3.Ke...i.sq..........vi.s.X...\..-./...$.X....4..I..3.Ke....4...........4......4................................................AJ@.....AJ@...L..T.c..Ci:b.....i:b.jsB...$T...2... ...^...@....................%...4.AJ@.i.s.=...C...x..........T)....4......4X.....4..G...4......4.."...x.T)...Dp.T.r......X.......i.s..c..,0...e...B4.$...........GP..A..}.....J....................=......=.Y_|tH..I..XE>X.......X..S...B..~P....C..G........c..C...%.{_J.......|p..%..i:b.jsB...$T..0i:b.....>...........0...X...\..-./...$..4..I..3.Ke...i:b.jsB...$T.............0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):4.5903504526276855
                                        Encrypted:false
                                        SSDEEP:384:Ml6vRw4o1L4oYrzTfHjIcWRtDHYBCuAu7iAqHjnw77K2jKNMbOC1RuQLre6o/:Ml6vO4o1L4oYrzTfDIcWRZHYIZuGAqHD
                                        MD5:0BE81DB58519B950E823B380D0138826
                                        SHA1:19229331380157D8E735F3827A7C91678CC7F5F6
                                        SHA-256:CD5CAE0778BC20AEACED24B9E66DA364FD30E85854107856D9AD531863C8A4AF
                                        SHA-512:5554252BE1949415B3E4F2BEF455C6A3175520AA995E4E77C2135BF4E7FBE7768303A704552F6D45876D4E4D60E2FD27B14E28389360A8F3CA5E07AC47CB0A2B
                                        Malicious:false
                                        Preview:....>...........v.......P@..` ...I..........>...T.......v.......PH..` ...H..................................................................................>...`.......v........H..` ...I...............I.......I.qk..B.....LZL:f.....L:fq....3.G.9 .N....%C.+.M...i.N...L:fq....3.G.9 .L:f..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'...............z.(/:...6}......N...^...............m(.PU.jK..'.|R[.............J....................................I.qk..B.....LZ..............z.(/:...6}...................................L:f.....L:f.....L:f.........................................L:fj....L:fT.<..L:f.....L:f..S..L:fH.`..L:f....&L:f....'L:f..8......L:f3L:f8L:f..z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                        Category:dropped
                                        Size (bytes):22203
                                        Entropy (8bit):6.977175130747846
                                        Encrypted:false
                                        SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                        MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                        SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                        SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                        SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):3.961484477346544
                                        Encrypted:false
                                        SSDEEP:96:40sESvUpdU9X7VaTR/EQyvyDeOdWEwn992kkXXSPkk/y7mG:40sESvUpdMX5aTR/EYlpw992RXXMROm
                                        MD5:9A051E0549931F1A8D7DF1048C37B766
                                        SHA1:5D3BFADC21115E6FF8EA3CEA830CF941F1689B62
                                        SHA-256:9D49487640E0A4108C53E2E563854FA6D276B904E540A85F2A3883998F448294
                                        SHA-512:8563D11F1C16E2AAB945D9AD14D4E0E9FA7AD2BE93D10E17DD5474FD562EDD43BF8BE0BA43BDA2172AD8BFF934E902B8860C08AA090C9093DCE3131F45234775
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZK...)...K...b......-5?.K...b......-5?.K....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............O..]$..?..ZC.].....N...^..................wZ?K.T3..|.".................................................I.qk..B.....LZ.............O..]$..?..ZC.]..........O..]$..?..ZC.]..........K.......K.......K...........................................K..j.h..K..T)...K.......K...L..K..H.]..K.......K....H..K....}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i..................K...K...K....z...y.. x.. ...........$........4...!..7!..7...............K..:K..FK..GK....z...y.. x.. ...........$..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):52945
                                        Entropy (8bit):7.6490972666456765
                                        Encrypted:false
                                        SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                        MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                        SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                        SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                        SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.5397459835840572
                                        Encrypted:false
                                        SSDEEP:192:TSsB9jg/11GcoHHPH5HwIX9p0HMGH6RtMvG/HXzHKUIm10AdAHm79cH5HHNsHVaS:7wec8H/pwSHwH6RtMoLj1zdkmpopH6/X
                                        MD5:714EFCC0224A1236E202C9F78A67880F
                                        SHA1:2A227289E0E39D9B6667C04F7A4F30AC91D8DE73
                                        SHA-256:C3C1DDF9A1FD3F5F2F3B682C0D9F5C4713873A640F465F2FE6779BA8E1AC3266
                                        SHA-512:08219857FF294A4D01FB7C09B1CEA3228D0D8C13736622922DE92E223BD02727254F9AB16BF5665433F489FE7AFA8CB6402A06DD9196CA9E9C925CDCBEA47795
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZWF..9...WF.IJ:A...}8f1.WF.IJ:A...}8f1.WF...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i..FV...?%.].......N...^..................M..FN..M.9K..............................................r....I.qk..B.....LZ............i..FV...?%.]...........i..FV...?%.]............WF......WF......WF..........................................WF.j....WF.T.H..WF......WF...\..WF.H....WF...3..WF...O..WF...........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................WF..WF..WF...z...y.. x.. ...........$........4...!..7!..7...............WF.:WF.FWF...z...y.. x.. ...........$......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):25622
                                        Entropy (8bit):7.058784902089801
                                        Encrypted:false
                                        SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                        MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                        SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                        SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                        SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):3.1796662043353847
                                        Encrypted:false
                                        SSDEEP:384:Oo8d5R1IeO+ci3yJfOJYqCPkeRSPXOsrhzrmVKu+FD7:Oo8dP1IwckyJf3qykeREesrhzcKuWD7
                                        MD5:F1BC54427B7022347AC629B5A316FFEB
                                        SHA1:5A930A34FD3A7557208B94082674B6CC750CA757
                                        SHA-256:F8646D6B6A0C8E082973B305D2691E605141F78FDEA4E810F517DEE1650643F8
                                        SHA-512:CABA736E8A90C9C28851A13A74F577815DBB9D2F44CE6A136F917CE6A9282A9BE3B78C9647E8514E6320F1C390B42D5057ED46E6B25603B940D478B4FFC55D66
                                        Malicious:false
                                        Preview:2...>...........v.......0 .../......P...j.9.&V..+..........P...j.9.&V..+.......I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8...................]a..T...]a...H..6.h;..,..I.......I.qk..B.....LZ]a...H..6.h;..,.]a...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............P...j.9.&V..+......N...^...............P..<V..J.h..............................P...j.9.&V..+..........P..<V..J.h..................P...j.9.&V..+...................................]a......]a......]a..........................................]a.j.e..]a.T....]a......]a......]a...a..]a......]a......]a. .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................]a...z... ..$..............
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):15740
                                        Entropy (8bit):6.0674556182683945
                                        Encrypted:false
                                        SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                        MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                        SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                        SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                        SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.790301025075798
                                        Encrypted:false
                                        SSDEEP:192:hsyRy/0reDQWHaXworrrRtshyTWn2ReOSd+4XpdJ9d1MScT6w:2K00re7Uw2rrRtUyyn2oHXpdTd1M5
                                        MD5:9121D78500859A6C4B476D596591E5FA
                                        SHA1:9E66AA004DF7C6121E22BDED2C4CC925BE7EEE00
                                        SHA-256:B5C3444F9D8093B728A94944033597D971B2C4268295BF577F4584ECFD7C8C94
                                        SHA-512:750E820574773236D1AE14305FA1AEEA4FF7627C59CF14FD08186237E672541612A69D82EBCA3730D1637E5E5800DE84178B33826DE82D5F7335B6B0C75E924F
                                        Malicious:false
                                        Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ..g.9.....g.!0..!....)J...g.!0..!....)J...g..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'....................9.y/A.......N...^................G`...O..a......................................................I.qk..B.....LZ...................9.y/A......................................g.......g.......g...........................................gj......gT.Q....g.......g..n....gH......g..9....g..V....g..........Z4...........................................4../4......p...............C.a.l.i.b.r.i....................g...g...g..z...y.. x.. ...........$........4...!..7!..7..............'..g%..g...g..z...,4. ...........$>........4
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):55804
                                        Entropy (8bit):7.433623355028275
                                        Encrypted:false
                                        SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                        MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                        SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                        SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                        SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):4.721110064121988
                                        Encrypted:false
                                        SSDEEP:192:FAsAcBNafG4BZQJN4jPwqoGcAnG8Hb3/SXzoOrP/RtgMYjBPZrGhHs9uC:bA8NafG4zQQwqoG/9bPsRRtRYVPdGhH6
                                        MD5:143CC0A511E9EB0E84165CCC97DE2975
                                        SHA1:3D648008718D0C525D33006CDC67526D46E53072
                                        SHA-256:B4BA53E2F9FED395356986355D0070E0CAAEF03B90D4CF0D929B7791D66D8B59
                                        SHA-512:B0685F5A5C2A403B7D827468B1EFC7D6D8D58ADBE7699C0ED410F7B4841441843F1E125A1DC831BAE42F5E967720CE139DA43C4F00CA40E38005BD56B7B9D80F
                                        Malicious:false
                                        Preview:....>.......^...v...2...0 ...+......>...........v...z...@....*..............................................................................................................................................O.........4_....0.I.......I.qk..B.....L.......4_....0.....I.qk..B.....LZ.I..=."z...O...i<F..=."...........I.......I...................................................I.t.....I................................................................4..'...'.............T.w...B...$.Y......N...^..................JE.M......V.................................................I.qk..B.....LZ............T.w...B...$.Y..................................................................................................j.N.....T)................f............. .<............. .......'...8.....z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):41893
                                        Entropy (8bit):7.52654558351485
                                        Encrypted:false
                                        SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                        MD5:F25427EFECFEE786D5A9F630726DD140
                                        SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                        SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                        SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):4.5551599435902075
                                        Encrypted:false
                                        SSDEEP:192:Hsl5oDjmKMGHTjXtF9R5U/iDoSsdUhGvUlST4aPCNeH2sX067AS/oQEGRt0buOFi:MMlHTjXtH8/iDyUheFPCNOtjnRtUFhRC
                                        MD5:3748722FFBD9C967F8CB262ECE7B0440
                                        SHA1:0FC3DDA832093019EBA176079E7E07DE3D28D733
                                        SHA-256:706CE99AD3EC4F8B8B3D2BD495395B0AC5B563130048256597EAD49B7166AEAD
                                        SHA-512:159126547DCD51B9F2EBC134D42A6CC396B6CD79CA60DD566765D146F0490779B3F259B6581538CBD8EE52A6BAB03312644FC750BED76B070EC42D03E2C0A29A
                                        Malicious:false
                                        Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*...........................................................................................................................................I.......I.qk..B.....LZ8...G...8........WpN....8........WpN....8....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............=2>_..............N...^...............:..6. .J.....n^........V...x....................................I.qk..B.....LZ.............=2>_...........................................8.......8.......8...........................................8..j.A..8..T....8.......8....r..8.......8.. .7..8.......8.. .........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................8...8...8....z...y.. x.. ...........$........4...!..7!..7...............8..;8...8....z...y.. x.. ...........$......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):14177
                                        Entropy (8bit):5.705782002886174
                                        Encrypted:false
                                        SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                        MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                        SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                        SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                        SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):49152
                                        Entropy (8bit):4.66650848512984
                                        Encrypted:false
                                        SSDEEP:768:adN7bCNwj++f/4F763AvuYaZg3SBGk+x/C2Y:KPCay+HE7eZg3SBGk+Q
                                        MD5:73D7AA0A07394D92E2ABE119B9CBCDF5
                                        SHA1:FE9FC82833A34CA0E81152A022BE5CB82755842D
                                        SHA-256:C0EC941D9CC37BADA78579A8190A01F974A55D8B65B85986380D8A9D790EA411
                                        SHA-512:E842EEF28FD690F8DF5BDE4C78CF34441BEA7DA03192F576AE2A031E62E8338DF6833887D608176D8C67474762E292796551454E31FF962EFAE612C317AE0F91
                                        Malicious:false
                                        Preview:t........&......v%..2&....... ..8@.. `.........t........%......v%..N&..(.... ..8@.. `..................................................................t........%......v%........... ..8@.. `..........cU......cU..VT......~..............8.@O.c.F.Sh...N.F...0m..x............R..p".?...............D.h................0.......0.....................................................T....2..T.......T....C..T.......T.Y...V.T.....Y T"[.....T#E...........0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.........C.......C...7..O.c."...............7tL.l...{.'2...J...j...R...................cU..........2...........d........................c..,0...e...B4.$........{p.....G...^...?@kO...................:[4.....:[4.......}.\....!B......!B.-3.I..........x..I.:....~D......V..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.375673900828685
                                        Encrypted:false
                                        SSDEEP:48:LQsyy7EUXADxXYtWp9/E8oPXv9iuzcXrdhSrYRtXZI9ANkV:0sZBQDxoQFE8SXv9BziRA4j+
                                        MD5:95F9BFA1255D2811A47793A0E0A68794
                                        SHA1:4C8800C67071F8501A5BE3303501AB9A70D718A1
                                        SHA-256:7B27D4B9643EDAC65CFEF138F195A43CECA231C8028C5174703530AB0FCC6096
                                        SHA-512:31B50A81B5321AF5C726DCA118430B39673BC07A9DD3E5DD48F2D08C496DAAE48447DB02F31BFA91726852D1A98E5FAF3A3D235CB81458453F97562D34D39B16
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.R.......R.hu....o...-..R.hu....o...-..R...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'....................h....as....N...^..................A.~.C.~LT7.97........f........................................I.qk..B.....LZ...................h....as...............h....as..........R.......R.......R...........................................R.j.....R.T.]...R.......R...B...R.H.....R...B...R...>.).R...J...................;........4...4...4.."...............R...R...R...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........R.......R.....#.R.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                        Category:dropped
                                        Size (bytes):12654
                                        Entropy (8bit):7.745439197485533
                                        Encrypted:false
                                        SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                        MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                        SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                        SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                        SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.312536122767789
                                        Encrypted:false
                                        SSDEEP:96:UsR3txD2pNEpkXM9x3YRAGXeGWvperTz:UsFH2IpkXM9x3YRAGXebvpefz
                                        MD5:27463C768D62717F69618A5F788E433F
                                        SHA1:71B15B56B101AB4668EAE8B31BE19E3488504C74
                                        SHA-256:EB392D78AEFBA77913DB0C1802960E1BF75F43B78717179EF83A351245DE4078
                                        SHA-512:D62E26E48A630946ADF9254358FF6B2DA20E2EECADA9F76E8BD8D4062CEFA830EAEDF0AE38EE6FF1004845FA7D942C9C815CD882D3FB8FE974666880E49B00ED
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.M'......M'.A9.....p.Z..M'.A9.....p.Z..M'..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............UD...4_.W.+......N...^.................;zxCyC....j...........f........................................I.qk..B.....LZ..............UD...4_.W.+............UD...4_.W.+............M'......M'......M'..........................................M'j.....M'T.]...M'......M'..B...M'H.....M'..B...M'..>.).M'..J...................;........4...4...4.."...............M'..M'..M'..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........M'......M'....#.M'............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                        Category:dropped
                                        Size (bytes):2695
                                        Entropy (8bit):7.434963358385164
                                        Encrypted:false
                                        SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                        MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                        SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                        SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                        SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.330198273553403
                                        Encrypted:false
                                        SSDEEP:96:Mszd6MbaecUjE/FKXtu9B7q7RACq/fzdOd9dpdXdOdBYid5d:MsZ6Ma//FKXw9B7q7RA7xAT/tA3v
                                        MD5:6EE84858732ACEC311D377FB7A258A11
                                        SHA1:E047EAA4A4AA5AF1B36D6FB652F49EC93CB0388D
                                        SHA-256:C44FE7BFA38872A033EC0E4BAFDDA7715F8457A48B13F047BA7E5AA9F9AFDEDB
                                        SHA-512:FAEBB84C3542EECC7C09132806094EB273B60804D6FE728136CAB5DCF9EB669B5FFF045C40B9986F2AF99FE1CF5F1D6AC819E990254F14E0B7FF85F6B7437A95
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZZx......Zx..P.@...S.gV.oZx..P.@...S.gV.oZx...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............$Y....3F.........N...^...............k.}.b.uH...?.5.?........f........................................I.qk..B.....LZ..............$Y....3F...............$Y....3F..............Zx......Zx......Zx..........................................Zx.j....Zx.T.]..Zx......Zx...B..Zx.H....Zx...B..Zx...>.)Zx...J...................;........4...4...4.."..............Zx..Zx..Zx...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........Zx......Zx.....#Zx.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                        Category:dropped
                                        Size (bytes):11040
                                        Entropy (8bit):7.929583162638891
                                        Encrypted:false
                                        SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                        MD5:02775A1E41CF53AC771D820003903913
                                        SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                        SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                        SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.474241737573426
                                        Encrypted:false
                                        SSDEEP:48:isRZEDslp3z9ltUEP3F7dXi9UXnLq6c4ErdHrbwtXRP7k7zsZn:isIsl9zbWEP3FZXi9UXnLq6ERLMms
                                        MD5:517BD5D7A807282CB40DDF3D770F7E17
                                        SHA1:ED383AA862C74484ABB56DC25149FD0D9B902E0A
                                        SHA-256:8170B14086DD17C41362E5A7F81EECCB1F25750007C7AA773D1A8395BD46845F
                                        SHA-512:B6A07E46B617243B5057926FFBF67C0E12EDFCDFC1C9FA91B4672DB36A300BA64B738597FCB2652C12085676F1221490212DB6552D7C62BF40F2915D40C40E05
                                        Malicious:false
                                        Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZU,......U,.[@....I....O.U,.[@....I....O.U,...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............@.".ZG..:X.m........N...^...............3.jU.*.G..8.vX.B........Z................................... ....I.qk..B.....LZ............@.".ZG..:X.m............@.".ZG..:X.m.............U,......U,......U,..........................................U,.j....U,.T%c..U,......U,...G..U,...H..U,...>..U,......U,. .3...................;........4...4...4.."..............U,..U,..U,...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........U,......U,.....#U,.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                        Category:dropped
                                        Size (bytes):2268
                                        Entropy (8bit):7.384274251000273
                                        Encrypted:false
                                        SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                        MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                        SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                        SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                        SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                        Category:dropped
                                        Size (bytes):784
                                        Entropy (8bit):6.962539208465222
                                        Encrypted:false
                                        SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                        MD5:14105A831FE32590E52C2E2E41879624
                                        SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                        SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                        SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):2.7104742166085263
                                        Encrypted:false
                                        SSDEEP:96:5s5WgHVkBVs7SGyWEHsUXMU93QMnRQ5IKDK:5s5WgC3GSnHsUXMU9AMnRCPD
                                        MD5:F58FADFCD990405688F3E4A38A455841
                                        SHA1:CA8AFB7167359E18B9924F51FEE7A86050A99688
                                        SHA-256:F29E4E4C653085522EE56F6EA4C27E7B9E8A2D06F20843B01DC0D27A30EA2C7B
                                        SHA-512:BABB856F6EB340F6CC630574CE6291EBD60E081D9441D0872F215DD6F5590A630A16A7A83E509C4A9386200E5AC2C42CCA092D6C402BBFDDB4D4AE1F7C05A0C4
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZb.......b..]~#..: |<6T..b..]~#..: |<6T..b....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............w..P..(..v.C.....N...^................x.%..FA.U4..>a6............................................^....I.qk..B.....LZ.............w..P..(..v.C..........w..P..(..v.C..........b.......b.......b...........................................b..j....b..T.l..b.......b....Q..b....Q..b....>..b.......b.. .3...................;........4...4...4.."..............b...b...b....z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........b.......b......#b..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                        Category:dropped
                                        Size (bytes):3009
                                        Entropy (8bit):7.493528353751471
                                        Encrypted:false
                                        SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                        MD5:D9BD80D40B458EDB2A318F639561579A
                                        SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                        SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                        SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                        Category:dropped
                                        Size (bytes):2266
                                        Entropy (8bit):5.563021222358941
                                        Encrypted:false
                                        SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                        MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                        SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                        SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                        SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.323826890459674
                                        Encrypted:false
                                        SSDEEP:48:YuCsV1KN215ityVXEgIWXBW9SRo1rdQqryz+2BXBuylt4JqB:YVsp15iIXEQX89SRERQyGyctAq
                                        MD5:43DF3C5D42C9C1A715D775C1A26CCCCB
                                        SHA1:0B656D9A94C85749E8FEA1145B773BD5AEDA07F1
                                        SHA-256:8860BB6801CDC56473AD249776C6EFCB9F2BF4A1330344189EBC8F5008C5A3B7
                                        SHA-512:B9F39BBF75F5F66FF567E693F618127B0F572DE004CDCE0E3ED2A133825801A3D2D9764C0C8C3215FBA5C4BE075C4C5D242554399EFC5AFD04D48321A95588C8
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..........q...-...u^MZ...q...-...u^MZ....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................R....o...)D....N...^...............S..gs..L..=..5.........f........................................I.qk..B.....LZ.................R....o...)D.............R....o...)D....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):99293
                                        Entropy (8bit):7.9690121496708555
                                        Encrypted:false
                                        SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                        MD5:EA45266A770EEA27A24A5BB3BE688B14
                                        SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                        SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                        SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                        Malicious:false
                                        Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.350183508314882
                                        Encrypted:false
                                        SSDEEP:48:YuF5Z5Gs77Zt+tNPohEVpyKXNPu90ze2oNrdQqr2vdBXpJU1Sx:YKHGs5t+3PAEP9XNPu90ze2cRQyIdAS
                                        MD5:FC421513F69191F649276DD320E1EC05
                                        SHA1:92B28BFA524B512DD24232F36EDF5AE7FDE1DE1E
                                        SHA-256:83D56012BA887E565126B2AB86E3285D2B9AF59122D292C0F792D2C2C00BB646
                                        SHA-512:9790D7D4B3E1B5272D7E0A0A842859FC193CB2E18B5B59CCEB020FEBE99A8B8A495C36F26596938CED690F88815631A5F0029C50C53CC1602FA769C6436F1990
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZc.......c....#..4s......c....#..4s......c....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................../. ,Q....N....N...^................1p...>L.V.}7+$.........f........................................I.qk..B.....LZ................./. ,Q....N............./. ,Q....N.........c.......c.......c...........................................c..j....c..T.]..c.......c...B..c..H....c....B..c....>.)c....J...................;........4...4...4.."..............c...c...c....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........c.......c......#c..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                        Category:dropped
                                        Size (bytes):2898
                                        Entropy (8bit):7.551512280854713
                                        Encrypted:false
                                        SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                        MD5:7C7D9922101488124D2E4666709198AC
                                        SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                        SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                        SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.318667216250849
                                        Encrypted:false
                                        SSDEEP:96:m3VsUyRB8ODgEShSXhEav9YkcRQyRprpeITSFFhTSNDZq:esUkB8oBXWo9VcRJRVpeIQ
                                        MD5:8E35AC5648693104B2B04EDC1FE5DA67
                                        SHA1:F8CC2BCF65FAFC3F55C94AFEA885C0F6E68A98D5
                                        SHA-256:46CF38142EC09A003E3448AC5CF450E0AFCBF9A681A24CAD0F6D9C7F3D88CAD7
                                        SHA-512:6D074F2078B60EC58A042A5BA9CE637D6C2277318C2F31BFEEF24168F02435FC41140B438C76BB3353830BD0C35EBD629435DFB13012889E7A6D71E3E8203F38
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ............8....t.2C~.o....8....t.2C~.o.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............r....p...z'3(t.....N...^....................P.G.p..~.c.........f........................................I.qk..B.....LZ.............r....p...z'3(t..........r....p...z'3(t.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                        Category:dropped
                                        Size (bytes):29187
                                        Entropy (8bit):7.971308326749753
                                        Encrypted:false
                                        SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                        MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                        SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                        SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                        SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.362318654007514
                                        Encrypted:false
                                        SSDEEP:48:7Ih1sgRzGxxzv+tn2nEYYOt7Q1XtZM9qNFotrdQqrITV7NBXT1q9bD1:7Ih1s0wzv+KEYY6kX7M9qPMRQywV7NM
                                        MD5:3D9B61772251AE5FDAB2AF0EBE6D3215
                                        SHA1:224D3C102FD480E9757F5560F0AE1752F6AAA15F
                                        SHA-256:674D65281DB1C0CA271D95A5348463AAD0A7A27735B80549A62EA2E0C51049A2
                                        SHA-512:61895D4768A11D6DE2C14EA1FE1E75E1CF23F369A6EB9FEA4D618114D57A4E063BD4BF66F50688DDBF7AC37393D67D88FE6A1D5FA41C142D807F8C295D1D6435
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.........H..W.3soc.....H..W.3soc.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h..r....M(9../.....N...^................Ed.S..B.._x.a........f........................................I.qk..B.....LZ............h..r....M(9../.........h..r....M(9../.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                        Category:dropped
                                        Size (bytes):4819
                                        Entropy (8bit):7.874649683222419
                                        Encrypted:false
                                        SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                        MD5:5D6C1F361BC04403555BE945E28E53FC
                                        SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                        SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                        SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.357201675707043
                                        Encrypted:false
                                        SSDEEP:48:isP59BSH04gz7UmtBpYOEnV5PJXHV9mbo17rdQqraI0BX1TA0kxQN2FAEk9/8:isxiUtzwmTEV1JX19Eu7RQygjIpk
                                        MD5:CFB920999E999BA6BAA21F7BA531BA0F
                                        SHA1:2CC87463F6FD8FF65205AE37AD017D1EC132E015
                                        SHA-256:76134B286602B5B87C53ECF99A716D34BD0DD88D5352AE58E6FD43A30916AC07
                                        SHA-512:57CB65116CC974955C0193D1DAF46BF7981ED32876743CF1FEC037901FAB917B3CD729AA3A1423EDF1A2DA94E3051287585CC03A6E8DC9E8E1F958C493F3AA2B
                                        Malicious:false
                                        Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ..N.......NM~T..1c.!F..(..NM~T..1c.!F..(..N..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............4U..5.+...z......N...^............... .q?.YN...{Fs.y........f........................................I.qk..B.....LZ..............4U..5.+...z............4U..5.+...z.............N.......N.......N...........................................Nj......NT.]....N.......N..B....NH......N..B....N..>.)..N..J...................;........4...4...4.."................N...N...N..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........N.......N....#..N............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                        Category:dropped
                                        Size (bytes):1717
                                        Entropy (8bit):7.154087739587035
                                        Encrypted:false
                                        SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                        MD5:943371B39CA847674998535110462220
                                        SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                        SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                        SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.361363320538416
                                        Encrypted:false
                                        SSDEEP:96:FGtsG69Wu/6XEKd5jX7p9LsRQyUXk6Pw:ysGMW6jKXX7p9LsRJUXk
                                        MD5:F9CAD91A482A133E93D34BC6606BD7B2
                                        SHA1:136C9FCA5052C731D858C5C4D4A44B87F226A60F
                                        SHA-256:42D38FF1D2CDE2F3B6B3997A58E3B26E3F3EC02BBAA30E6EDAE688E32021C94C
                                        SHA-512:99193E44D4BCD594CFEA4B9D6F4C83A1526B9075C242CFC7FE011BE79C4C06D95DCA9076FFBD3C4FCAAAF891DDAF9EA2A0E5EC80FF03EE9A5746B3E61838D4EA
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZC......C.TQu..8hSL...IC.TQu..8hSL...IC...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............W...Yjr..t.@..0....N...^................T.....M.r.%=..*........f........................................I.qk..B.....LZ............W...Yjr..t.@..0........W...Yjr..t.@..0.........C......C......C..........................................C.j....C.T.]..C......C...B..C.H....C...B..C...>.)C...J...................;........4...4...4.."..............C..C..C...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........C......C.....#C.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                        Category:dropped
                                        Size (bytes):3555
                                        Entropy (8bit):7.686253071499049
                                        Encrypted:false
                                        SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                        MD5:8A5444524F467A45A5A10245F89C855A
                                        SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                        SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                        SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.358152873978549
                                        Encrypted:false
                                        SSDEEP:96:q1siYytH1JZehxMENXCh19UX0RQyEZHU6Ihy1bdVx1d:q1siYytH1JZApNXCL9UERJEHU3y1bdVx
                                        MD5:89598EC08876852CCB3B343E0FC81CBF
                                        SHA1:F2BA8CCF5DD5DB47494E050B34C32321A7240272
                                        SHA-256:576DF54D01B07D8775E4E7062C7C7799658D6CFF951E6D99CC424686671C1361
                                        SHA-512:8E2BE323956F8778DF8E9A31E5D7FE1C2647356D6A7BC148D56927F3F50B5DE1B22438609037E4A7AAA1F2F54EBA1EB4BA6A16D5C03ED93F9B007208EFBBC541
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZS.......S../.Qj.......S../.Qj.......S....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............MJ?.z..,t.MR.^....N...^..................L..M..t.Z.O.........f........................................I.qk..B.....LZ.............MJ?.z..,t.MR.^.........MJ?.z..,t.MR.^.........S.......S.......S...........................................S..j....S..T.]..S.......S....B..S..H....S....B..S....>.)S....J...................;........4...4...4.."..............S...S...S....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........S.......S......#S..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                        Category:dropped
                                        Size (bytes):3428
                                        Entropy (8bit):7.766473352510893
                                        Encrypted:false
                                        SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                        MD5:EE9E2DF458733B61333E8A82F7A2613D
                                        SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                        SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                        SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.358566067898559
                                        Encrypted:false
                                        SSDEEP:48:gsOo+xWtytmqEXNrx7k8XgZ92uoRrdQqrlm62BX8NE9gOd:gsCxgyzEXNrxHXk9RwRQyyek
                                        MD5:02CCD8940DD462E271D60CC3E57C3AD0
                                        SHA1:82B4F94F95A23DDE5936DF5ED6984DFCC1C0AF02
                                        SHA-256:0D0BF03CC1149AE52C4C959B64BB5F5E77F9A932EAE27D69066BBBC16B26B4BC
                                        SHA-512:7E767806C3259D9E045A9360562AA52E144704A94852518E35FFF3FC5525917B137BFE42C8302F4628D3A347FC352EBEEBB8B1A9BE3EC56FE04BD99D313947AB
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..].......]..q...@..?....]..q...@..?....]..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............c.\.......p .6.....N...^.................A...M...n............f........................................I.qk..B.....LZ.............c.\.......p .6..........c.\.......p .6............].......].......]...........................................]j......]T.]....].......]..B....]H......]..B....]..>.)..]..J...................;........4...4...4.."................]...]...]..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........].......]....#..]............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):65589
                                        Entropy (8bit):7.960181939300061
                                        Encrypted:false
                                        SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                        MD5:8B48DA9F89264D14B83FF9969F869577
                                        SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                        SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                        SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                        Malicious:false
                                        Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.388867524066096
                                        Encrypted:false
                                        SSDEEP:48:vRks4it1t57t9tVxbREmdPyXft9m3o7lrdQqrwoyBX5vkstG9+wqkrt:vRksR7t9T/Emd6Xft98OlRQy/y/G
                                        MD5:685B5EEFD3BFF6E9B8BA9EF20B57546A
                                        SHA1:75EECBDC1B32BB0758A501336006F9B5D5E40EFE
                                        SHA-256:918B18075B2B5A07E008AA1A91CC1D26C223165C1F10F60620F60D927CE93BE6
                                        SHA-512:3F4C3DCDCEA8D7453E238439FAC6A27832ACFCE651DC00F1374BF0C582F85DBAC3EFECA9171A888444EF732038BA3AB245CB74D9FB3AA47C1E3F5F4A722981E0
                                        Malicious:false
                                        Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ.{5......{5..>..1!"..a.(.{5..>..1!"..a.(.{5..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Z.T....+..]sg[.....N...^...............O..!nH=I..l.Q.h........f........................................I.qk..B.....LZ.............Z.T....+..]sg[..........Z.T....+..]sg[...........{5......{5......{5..........................................{5j.....{5T.]...{5......{5..B...{5H.....{5..B...{5..>.).{5..J...................;........4...4...4.."...............{5..{5..{5..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........{5......{5....#.{5............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                        Category:dropped
                                        Size (bytes):1873
                                        Entropy (8bit):7.534961703340853
                                        Encrypted:false
                                        SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                        MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                        SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                        SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                        SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.373155176396375
                                        Encrypted:false
                                        SSDEEP:96:CsHdFmX/IWWEDoXJo9Z89goRQ5mapmhPep3F:CseI+0Xm9ZEgoRC10
                                        MD5:EA255D8A7CEF23965655B76711C43912
                                        SHA1:53874F4D93FA178D6FD339DA840489A853DBB57F
                                        SHA-256:E5EDE57FBF5142DCD30092182D2869A00CB27C6F442FDA625463B423A70B3E5F
                                        SHA-512:C296336A0DC13430F6DE06184FA592ABF22F313BA7D589F26090CE87DDDA7053AC88352789FD6D30867BEF05C21742DFE8FDA347BA4A7ED3F6C6F652421DF42F
                                        Malicious:false
                                        Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZK.......K...v":....s...K...v":....s...K....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............q..,.O...T.Bc......N...^................=.\k.mG.n..;...........Z........................................I.qk..B.....LZ.............q..,.O...T.Bc...........q..,.O...T.Bc...........K.......K.......K...........................................K..j....K..T$c..K.......K....G..K....H..K....>..K.......K.. .3...................;........4...4...4.."..............K...K...K....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........K.......K......#K..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                        Category:dropped
                                        Size (bytes):5465
                                        Entropy (8bit):7.79401348966645
                                        Encrypted:false
                                        SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                        MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                        SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                        SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                        SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                        Category:dropped
                                        Size (bytes):3361
                                        Entropy (8bit):7.619405839796034
                                        Encrypted:false
                                        SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                        MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                        SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                        SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                        SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.357351245375293
                                        Encrypted:false
                                        SSDEEP:96:hgsMuQS379bVE9XYu9uZOlRQyPHKQ1ONAoA:msMuQA79m9Xl9uZgRJPHKQ1ONAo
                                        MD5:32D02AC14DCB31F8307979DBE243E8C5
                                        SHA1:D38AEA90BABC88CAA0C1634D86EB6F0713FABD58
                                        SHA-256:2A87C1645EBC3278004BC3A86936B89249033D87F871459B1832317654B41EBC
                                        SHA-512:174779B6CE190642B8E9F4B497B4A7420960D8712AF0E89E2151A90BDDCD910DEB296B266D0B69577E36AC656BB83ECD7B2E160A1BC903B9EDAAF597D3ED24F4
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.[u......[u..;..-.8...b#.[u..;..-.8...b#.[u..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............F2.6<.+......-....N...^................,..._.A................f........................................I.qk..B.....LZ..............F2.6<.+......-..........F2.6<.+......-..........[u......[u......[u..........................................[uj.....[uT.]...[u......[u..B...[uH.....[u..B...[u..>.).[u..J...................;........4...4...4.."...............[u..[u..[u..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........[u......[u....#.[u............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                        Category:dropped
                                        Size (bytes):140755
                                        Entropy (8bit):7.9013245181576695
                                        Encrypted:false
                                        SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                        MD5:CC087700C07D674D69AFDFDA0FA9825C
                                        SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                        SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                        SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.346861138730066
                                        Encrypted:false
                                        SSDEEP:48:YuYpJsT1aNmO1DK1cobVtybEuVLkXk9+7oBrdQqrzA1pNBXMw1l1DK1Z17r1F1sx:YlpJs8L6bV6EuVYXk9+7wRQysrNPB/0
                                        MD5:BB13C96B3A5774368DE6E84323F995FF
                                        SHA1:A095D85619B598325D96EFDE55F9A2EF7764AE5E
                                        SHA-256:5B15254BEE6B845C45E493E583490753CF04623942F049C7F61BE9F5B8EED296
                                        SHA-512:D0F4CB23272038215F3C88DF670100562A6A906997E6FD09BF48E7B91090ABD47ECF4CB1FB76772D7F0C6D4D9BB9693CA3CF7A8E848F27B1013F03E010EA61E4
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..b.......b.=...9G)H....b.=...9G)H....b..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............{'.....7..........N...^...............6..Y.ZzL.....Sub........f........................................I.qk..B.....LZ..............{'.....7................{'.....7.................b.......b.......b...........................................bj......bT.]....b.......b..B....bH......b..B....b..>.)..b..J...................;........4...4...4.."................b...b...b..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........b.......b....#..b............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                        Category:dropped
                                        Size (bytes):129887
                                        Entropy (8bit):7.8877849553452695
                                        Encrypted:false
                                        SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                        MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                        SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                        SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                        SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.303811096052157
                                        Encrypted:false
                                        SSDEEP:48:YuysQ2m11RtAEQNtEr7LMUXXFEHz9WtoNrdQqrP/osBXNl3uw9:Y9sw1R2/Er7QUXXQz9WtsRQyZT
                                        MD5:D1F64FD7795A6D88C8853A1596B76745
                                        SHA1:F3265EF70574825BABF93263B1DF74117254D8DF
                                        SHA-256:B14A8A985FBFAC4BB750FBE147019CFF4E037BF23087A115386C790CC2DC5A96
                                        SHA-512:38217B3ACD6D5FB996FDDEB2E60F86ABB4E0B87E4A4577680D34C0FCDE967B828EAAE2CB77D45206FEC2D2F304C2EC81CC557BF7DC4C62E20EF2784BB9081E69
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ/......./...F.L....|.K&./...F.L....|.K&./....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............1>..q`&.......f....N...^................T....H.1.&.=l........f........................................I.qk..B.....LZ............1>..q`&.......f........1>..q`&.......f........./......./......./.........................................../..j..../..T.]../......./....B../..H..../....B../....>.)/....J...................;........4...4...4.."............../.../.../....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........./......./......#/..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):84941
                                        Entropy (8bit):7.966881945560921
                                        Encrypted:false
                                        SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                        MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                        SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                        SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                        SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.35869950356618
                                        Encrypted:false
                                        SSDEEP:48:YuNPSLs5KFW2xrSr2WrtGR5wEe+h2MXf9dha9igxolrdQqrjxHYwF2BXgD2FsP22:Y5s02r2WrhEPfXfda9igxkRQyFL2Ef
                                        MD5:1DD6B8C94885153DD5A99235C78B7DD9
                                        SHA1:3878A3FE2439B8C7555B9F449BD5D347EA556A72
                                        SHA-256:393CF2C3C0E34DCA7E4E2FD2A21CF93FE69F41DE0F61D1F3AF2C1F7C883B4673
                                        SHA-512:9BF4B51E431341801D55DC8CBB64E054B342DC32EBB4024D3235A9D3049FE57EB6A9E55963FDE614C13DD27B9672A85A8C28A91B6D1E6EB230B08A5A7BC7FC50
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.%.......%.h%...2..b..G..%.h%...2..b..G..%...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............3|.0....8iAS.......N...^.................U..H.I.u...s........f........................................I.qk..B.....LZ............3|.0....8iAS...........3|.0....8iAS.............%.......%.......%...........................................%.j.....%.T.]...%.......%...B...%.H.....%...B...%...>.).%...J...................;........4...4...4.."...............%...%...%...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........%.......%.....#.%.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1569
                                        Entropy (8bit):7.583832946136897
                                        Encrypted:false
                                        SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                        MD5:07DB3F43DE7C1392C67802E74707DAA6
                                        SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                        SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                        SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.32129046202274
                                        Encrypted:false
                                        SSDEEP:48:WZ5sCsgyuwe/WKtmMXE+YlLmXQ9LqRwodrdQqrLnDCBXU897g0Bd:WZ5sYH1WKVXEplqXQ9WRwcRQyDWVj
                                        MD5:61DF7AC3959958375CEDBE80EB5B5C50
                                        SHA1:275E067460A1D27547664DBDCE82CFEAF8D74C28
                                        SHA-256:B86FCD9ABC9EF55167F5BBC9C53C037173060B007F338C9B33FBA9FF709B24B5
                                        SHA-512:8BE081E69B6D19E0340D6B48EFBDFCC3644DCFFA89C05BE5431005A80619827743E88C4FA6D9F145BBADCD0B2A18DA8910773E9D280C4782D848F75F081E984C
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........'C.....Tm[.Y7...'C.....Tm[.Y7.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............O.AV...1.I6........N...^................m).E...Kr.{#........f........................................I.qk..B.....LZ.............O.AV...1.I6.............O.AV...1.I6............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):40035
                                        Entropy (8bit):7.360144465307449
                                        Encrypted:false
                                        SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                        MD5:B1DDD365D87605F96D72042CB56572F6
                                        SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                        SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                        SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.598315416120695
                                        Encrypted:false
                                        SSDEEP:96:Vs63jlxXGXRE3/XXF9urERQyduD3aJueFaO4P:Vs6xxXSu3/XXF9urERJMD3aJueFaHP
                                        MD5:25A1757DEE6DD7B1F235946D2BCB7D9F
                                        SHA1:6B06FF9CB60DB756118310DB8105A056500AE929
                                        SHA-256:15F9FD19E9F5E12E2E82CDE8409FC9B3841F318442E515D04B1A198E9414B9FB
                                        SHA-512:95E11ACA3ADFCB2D7B51309A49D5E87C4CD827F03358B4745934A033E90F8AE7A274C7C10C9A76AFF19F28C9629DB649673D448CEE16C19FB9F0F9DFD9818D74
                                        Malicious:false
                                        Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZH.?.....H.?C.....2....NMH.?C.....2....NMH.?..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............)..]P..*.....8....N...^.................5..M......JC........f...................................:....I.qk..B.....LZ.............)..]P..*.....8.........)..]P..*.....8.........H.?.....H.?.....H.?.........................................H.?j....H.?T.]..H.?.....H.?..B..H.?H....H.?..B..H.?..>.)H.?..J...................;........4...4...4.."..............H.?.H.?.H.?..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........H.?.....H.?....#H.?............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                        Category:dropped
                                        Size (bytes):242903
                                        Entropy (8bit):7.944495275553473
                                        Encrypted:false
                                        SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                        MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                        SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                        SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                        SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.320880551770791
                                        Encrypted:false
                                        SSDEEP:96:Y9sO8mWNEXMRpXQ9SWYfRQyN8SkeokbAk7kmkeokNWkgk:OsO8mfXMRpXQ9SWYfRJN8SkxkMk7kmkm
                                        MD5:6473C1C200E550CA1DD1EA7BF58A0403
                                        SHA1:397A114AE9163C5E81E5552760E8ED2C30CE77EF
                                        SHA-256:20D619D3A36CA80382419229409CA191A6122FF5A1E45F8050B7B04FC00CCF78
                                        SHA-512:6DE6D210B959ECCCACF635432818204DF676B5DB52439978C1C45B1D6004BE8BD363A59C32A9B6E36593A141DE26518B3769FC1334215880D2DE4EF1196A698C
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.P>......P>ZP.I...'...*r.P>ZP.I...'...*r.P>..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............~. ..E..*/S4|.......N...^....................P.H....U..........f........................................I.qk..B.....LZ............~. ..E..*/S4|...........~. ..E..*/S4|.............P>......P>......P>..........................................P>j.....P>T.]...P>......P>..B...P>H.....P>..B...P>..>.).P>..J...................;........4...4...4.."...............P>..P>..P>..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........P>......P>....#.P>............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                        Category:dropped
                                        Size (bytes):70028
                                        Entropy (8bit):7.742089280742944
                                        Encrypted:false
                                        SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                        MD5:EC7811912ACA47F6AEB912469761D70D
                                        SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                        SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                        SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.350500311847513
                                        Encrypted:false
                                        SSDEEP:48:UJls+u3jatprE5VLP/XyfK9e/oNrdQqruAevy2BXfprZZlz:Os9jafE5VzXyfK9e/MRQy9uy2RZ
                                        MD5:D51AF4C397808EC6C5A61FB2DC1FF418
                                        SHA1:F98E5792EA7A40F39FA0953E4C01F404CCBEADB3
                                        SHA-256:AE4D201E9F41A29D265006BAE0E201945ECE6972590823587C1B38B2F3D88B49
                                        SHA-512:6779392A0CAA45E71B5664394F69CDEED47F3ECB3DF3F90B12D29FA9680D0CE95CC37D2076165EE8CDE143A730AF52F5CB638861A3EC26949FBCDA30F5F3D10E
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..-.......-<u.]./.P..9.?..-<u.]./.P..9.?..-..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............O.F......*..*....N...^...............C..J...C.=p}..M.........f........................................I.qk..B.....LZ..............O.F......*..*..........O.F......*..*...........-.......-.......-...........................................-j......-T.]....-.......-..B....-H......-..B....-..>.)..-..J...................;........4...4...4.."................-...-...-..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........-.......-....#..-............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                        Category:dropped
                                        Size (bytes):24268
                                        Entropy (8bit):6.946124661664625
                                        Encrypted:false
                                        SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                        MD5:3CD906D179F59DDFA112510C7E996351
                                        SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                        SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                        SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.30580244487992
                                        Encrypted:false
                                        SSDEEP:48:IPsxiU8yuAP6C+t6NU1wEr0xQXDDURg9qwNoXlrdQqrDhMBXwtR93IK:IPsD6bYNUiE8QXDDURg9qwN0RQyS03I
                                        MD5:37A1ED6CC4533FF76CAABE8FE00B2B96
                                        SHA1:89D9EC23FBA8E6C58280AB55BEDBCA68683C10D9
                                        SHA-256:22AF22919F27C7FED34EAC280DD344F63D3F997359791D7F14A4C29328AF8BD8
                                        SHA-512:BAC24D61385C5AB3F1FC4A1E61551FADA7AA09A43428697C6C6CA92024F4323E19BB66AB9C0EAB0ECFD80638DF2EA09EBD46F803B13AE1B97492685704C3BC19
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................\.......\..B-T.2.).S`F.I.......I.qk..B.....LZ.\..B-T.2.).S`F.\...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............4.,.."#.#......J....N...^.....................1L..&.w..q........f........................................I.qk..B.....LZ............4.,.."#.#......J........4.,.."#.#......J..........\.......\.......\...........................................\.j.....\.T.]...\.......\...B...\.H.....\...B...\...>.).\...J...................;........4...4...4.."...............\...\...\...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........\.......\.....#.\.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):47294
                                        Entropy (8bit):7.497888607667405
                                        Encrypted:false
                                        SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                        MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                        SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                        SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                        SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.483895895387769
                                        Encrypted:false
                                        SSDEEP:48:YJsBw1o4T166t88aEwLmFLNXUf9OEoprrdQqrXrSBX2Gk13J1:4sMo4Tk6uEwWXUf9OEwrRQybSa
                                        MD5:EEFCC39457813D52C298474BA69E21AB
                                        SHA1:9C3634E3E51F26A13D5522C532BC60BFDCCAFE1F
                                        SHA-256:4EF5A4F4FD42E35B7FCE72E78A5218E3681D189A8302FFDCD7F23FB8B683EAC7
                                        SHA-512:BA3A4F8400E8B891105AA3078E020D2A5289CA8610685068684BBE118C8553E4AAB21622E413FDCE7414A1BA4F9FB7CB8B7C5B31D002A313222D87674B6F6728
                                        Malicious:false
                                        Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZlX......lX...... 6.....lX...... 6.....lX...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................".?M.F.b....N...^...............\.....8F.T..hA.w........f........................................I.qk..B.....LZ....................".?M.F.b................".?M.F.b.........lX......lX......lX..........................................lX.j....lX.T.]..lX......lX..B..lX.H....lX...B..lX...>.)lX...J...................;........4...4...4.."..............lX..lX..lX...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........lX......lX.....#lX.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):347
                                        Entropy (8bit):6.85024426015615
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                        MD5:78762C169F8B104CB57DFF5A1669D2DF
                                        SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                        SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                        SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.359037095615672
                                        Encrypted:false
                                        SSDEEP:96:5DXd0skmXeU5xMsE3XGB8MP9GoCBRQy8w4Dz:VXd0skSeUfe3X7A9GoIRJ74D
                                        MD5:75400EAF65384BCF1B5825FDD36DDC28
                                        SHA1:71481C9FF0319A13D3FB04BBA04F2A55D2F45CA0
                                        SHA-256:22E58510BC2984387128A71BADB262B18B3578009DAA068508C40A1A7F82F6A5
                                        SHA-512:37BBF87F341EFE8FCFF88F371632BF2361FA116BAF9041E2D741CF638D50AB52C5865A4C7B4C564C383844E3FD47FB023FB563C880AE3432B9545BCE7082950A
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZO......O.....!Y.,~1.O.....!Y.,~1.O...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............>.. .b......>D.....N...^...............F.f...G.5.AI.rR........f........................................I.qk..B.....LZ............>.. .b......>D.........>.. .b......>D..........O......O......O..........................................O.j....O.T.]..O......O...B..O.H....O...B..O...>.)O...J...................;........4...4...4.."..............O..O..O...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........O......O.....#O.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):827
                                        Entropy (8bit):7.23139555596658
                                        Encrypted:false
                                        SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                        MD5:3E675D61F588462FB452342B14BCF9C0
                                        SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                        SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                        SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.326276229066202
                                        Encrypted:false
                                        SSDEEP:48:YHs7C2SyHNttAEX24LUWXf5kW9KyoFrdQqrsh/6xBXY7NDkBqfF:KsRSKN4EXnwWXRkW9KykRQysgxqCY
                                        MD5:E37B130A89C61E58CC286F5401907DDB
                                        SHA1:58AFAC5517E493F2BE22E7EEDEF0851A28EC9EE7
                                        SHA-256:EC05B28A54DC6A2C9305AB8849003E07BE2E6E7CCCC3AD9E89262C66F94628DA
                                        SHA-512:7B8C300F491233AFDBBC1D539E9783EC43F3A0B7517DBA49AAE82308027D6C5ACAA38F7FD42580EC2D0ACB57D8FEFD37A66E75104F4396A3F9515475A235337B
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZF@$.....F@$.H.....+..j.F@$.H.....+..j.F@$..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............T.q...>.........N...^................*D...mK.R...'?.........f........................................I.qk..B.....LZ.............T.q...>..............T.q...>..............F@$.....F@$.....F@$.........................................F@$j....F@$T.]..F@$.....F@$..B..F@$H....F@$..B..F@$..>.)F@$..J...................;........4...4...4.."..............F@$.F@$.F@$..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........F@$.....F@$....#F@$............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4410
                                        Entropy (8bit):7.857636973514526
                                        Encrypted:false
                                        SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                        MD5:2494381A1ACDC83843B912CFCDE5643B
                                        SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                        SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                        SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.358102106747063
                                        Encrypted:false
                                        SSDEEP:96:Y1skIsUXEJiEZnf0gX4e9u2VPcRQyQRkf9:WsvsUUJB0gX59u2NcRJQRkf
                                        MD5:27D107CC9A80AED0F61968226D9F549A
                                        SHA1:962E551CF62C698561A91038C88B2FCBE7B6D834
                                        SHA-256:2DF0141E1BAA5FC6890FE4F76D2E0CAA6BA12FB67C81918C9795FA06FA60AE2A
                                        SHA-512:EAA901C071C1BE39D808A5CC74CB6A90584539952F6F3CF40AE458611250DC50C48AD3B5F7AA1B390325D96986455D80E8958596DBEE5601B69FB645B7475372
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZC.......C.....r.4.7.).C.....r.4.7.).C....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............u.@cS.......0.....N...^...............F.i..i.M....*W.........f........................................I.qk..B.....LZ............u.@cS.......0.........u.@cS.......0..........C.......C.......C...........................................C..j....C..T.]..C.......C...B..C..H....C....B..C....>.)C....J...................;........4...4...4.."..............C...C...C....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........C.......C......#C..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):136726
                                        Entropy (8bit):7.973487854173386
                                        Encrypted:false
                                        SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                        MD5:4A2472AC2A9434E35701362D1C56EDDF
                                        SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                        SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                        SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.3177335223839854
                                        Encrypted:false
                                        SSDEEP:96:isg6EuScYEKHbLXzL9uVEwRQyxm4pVsfPupVAfc3:isg6EYFAbLXzL9aEwRJxm4pVsfPupV48
                                        MD5:65C8B90B6217F0EA3F37DF4F29459D78
                                        SHA1:C3B6D93BDD9DCA9ECB9A7CFCE391B47C6119A630
                                        SHA-256:FB0F960B44202D13C8B74FD6BE1CC768CD409C575B947F6453F8ED6A96D93F8F
                                        SHA-512:95ED0C94A76278C002D734CE139658DBC3F2854CE297264AB623E6E90D505FD7AE115B46F1AF90285F8E7ADC9062921E1705E6498C6B66330BD7C8D0CB04ED2E
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ>ie.....>ieB.f...qaA....>ieB.f...qaA....>ie..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............@0..p.4....S.....N...^................T..E.fE....7n..........f........................................I.qk..B.....LZ.............@0..p.4....S..........@0..p.4....S..........>ie.....>ie.....>ie.........................................>iej....>ieT.]..>ie.....>ie..B..>ieH....>ie..B..>ie..>.)>ie..J...................;........4...4...4.."..............>ie.>ie.>ie..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........>ie.....>ie....#>ie............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):5136
                                        Entropy (8bit):7.622045262603241
                                        Encrypted:false
                                        SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                        MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                        SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                        SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                        SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                        Malicious:false
                                        Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.418551600172651
                                        Encrypted:false
                                        SSDEEP:48:zWSsROvzE+pUatpJe2EBLXUD9gzAo/BrdQqr3eEwWBX+412H8uasV:ZsF+pUaVdEFXUD9gzAiBRQyX1TK8W
                                        MD5:8640FF980EA4164B8FD750015C1AB3A6
                                        SHA1:AF5DC614FA8D52291DCCFE28C7F6FCA246FFE498
                                        SHA-256:7834D2E4BF674946E8A62E142534133585E659C604BD6C7EB6D4333025E13BFD
                                        SHA-512:E0CF88F2F0BA1762DFCF5861AC4C93ABB311152449EF03C7E038F2827903B047EC06748BA06517A7A40768695FE896A188C1076A91475E5CB0DE74E9553E5A9B
                                        Malicious:false
                                        Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ..................sDK............sDK.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Y.;&s...,.gX35.k....N...^..................K7.zA.=pcc.h=........f........................................I.qk..B.....LZ............Y.;&s...,.gX35.k........Y.;&s...,.gX35.k........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):52945
                                        Entropy (8bit):7.6490972666456765
                                        Encrypted:false
                                        SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                        MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                        SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                        SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                        SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.386857482334115
                                        Encrypted:false
                                        SSDEEP:48:zWJ52sDr8RnSOtOoEbLAXXQX5B9ut3FrdqrbuTBXQY2wQB:U52s4nSOZEbLX5B9ut1RysVC
                                        MD5:DE5F6F05833D8BFFE7C64D01ABA26A6E
                                        SHA1:F4AC27C9FBA03A5DA7B813FD95469F4EBC13A5A4
                                        SHA-256:C0589B10803E053BC083273C73BEFE202773B8C048476F483766BF85D2413F1A
                                        SHA-512:E72D40F43816DFD9C8CB012B107BC6F510150E0B75E1A9D4DDC0CA8CD171B734BD263CE573B678520FA6C9DDAF89A4573A66F0B845E6ADBD4101B6ED3B7A9106
                                        Malicious:false
                                        Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZG.......G...'...=.z~..r.G...'...=.z~..r.G....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................6..l..f.!.....N...^.....................N...)L...........f........................................I.qk..B.....LZ..................6..l..f.!...............6..l..f.!..........G.......G.......G...........................................G..j....G..T.]..G.......G....B..G..H....G....B..G....>.)G....J...................;........4...4...4.."..............G...G...G....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........G.......G......#G..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):79656
                                        Entropy (8bit):7.966459570826366
                                        Encrypted:false
                                        SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                        MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                        SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                        SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                        SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.455502484835719
                                        Encrypted:false
                                        SSDEEP:48:vLksitPxBZol+tSghEWn7qlxX4we9Drolrdqr2xnRX6P5tdHJn:vLksMfol+ZhEZXI9DrERy2tsdH
                                        MD5:3619392341204FB7C243CB69FB183318
                                        SHA1:4BBD5BC27E71F7F264E1D75934E2E2C162E06508
                                        SHA-256:299751F9521F82AE5DCE16C5C18B91AF1B55B86246F990208FFEF43386FB729C
                                        SHA-512:569FF09E8785C8A5CE1CCDB59B0639AFCA295AEF4BF15553C766B9626B4C4909759D6DB625CAF2336D5EC4FBA80903CF970A4132162ADECD54E0C7AE81A3E773
                                        Malicious:false
                                        Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v...............................B.......B..0P.Q.;}..Mo`..I.......I.qk..B.....LZB..0P.Q.;}..Mo`.B....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............:.k!.al.>s#...T....N...^.................[...D.uu............f................................... ....I.qk..B.....LZ............:.k!.al.>s#...T........:.k!.al.>s#...T.........B.......B.......B...........................................B..j....B..T.]..B.......B....B..B..H....B....B..B....>.)B....J...................;........4...4...4.."..............B...B...B....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........B.......B......#B..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):40884
                                        Entropy (8bit):7.545929039957292
                                        Encrypted:false
                                        SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                        MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                        SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                        SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                        SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.335372394529703
                                        Encrypted:false
                                        SSDEEP:48:YuWs8c+kinu8gtipEfB+ZpXN4p9HyoBrdqrv2RX1VXxR:YpsknFg0EZ+PXY9HygRyuX
                                        MD5:0440A7A92823460592EBFCC5E7F221A1
                                        SHA1:B6A89FB05C73990D6180FC5D0743B479FFBFC962
                                        SHA-256:1E64A0E48DB16E4E25D16383535BF4A734499A2637445635759660E2FB656653
                                        SHA-512:841347F51690D7862191C24C75D49F16C14EA002458045E13A412399579567CA241BE1FA65E828B36ECEA63EAB11F81A45E65D0350A42FEE473D187B520CEC2B
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZI.j.....I.jZ$../..7...WI.jZ$../..7...WI.j..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............jkI..n...?l..N.....N...^...............i.~L.o.C.d....yw........f........................................I.qk..B.....LZ.............jkI..n...?l..N..........jkI..n...?l..N..........I.j.....I.j.....I.j.........................................I.jj....I.jT.]..I.j.....I.j..B..I.jH....I.j..B..I.j..>.)I.j..J...................;........4...4...4.."..............I.j.I.j.I.j..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........I.j.....I.j....#I.j............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                        Category:dropped
                                        Size (bytes):68633
                                        Entropy (8bit):7.709776384921022
                                        Encrypted:false
                                        SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                        MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                        SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                        SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                        SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.455293553008515
                                        Encrypted:false
                                        SSDEEP:96:5qsbGe0UzzhpmEg30mXxXE197U1NSRyxYDrHVXSUnCHhmI:5qsz0UhBg30mXxXg97YNSRygx
                                        MD5:B7C31632DFBD09CF19E74113F33B587C
                                        SHA1:22EA2D6B4B67F4A7F10B782DF5B992DDE78243BB
                                        SHA-256:E7E9D16B9171626EAA35940FAC03E063F47D5B45F7614BE571D846779E0B4252
                                        SHA-512:E8AB641587BCE24A2DACF0C6C299E52D652916AA84C78831416BF4788B69EED2D7F725126CADC3823D4221E8B508DF8A8F620D5704761EC40649B43BF248300E
                                        Malicious:false
                                        Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ.J]......J].S.....d..vr.J].S.....d..vr.J]..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............."*..Mo.1.}....T....N...^.....................M.......y........f...................................$....I.qk..B.....LZ............."*..Mo.1.}....T........."*..Mo.1.}....T..........J]......J]......J]..........................................J]j.....J]T.]...J]......J]..B...J]H.....J]..B...J]..>.).J]..J...................;........4...4...4.."...............J]..J]..J]..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........J]......J]....#.J]............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):11043
                                        Entropy (8bit):7.96811228801767
                                        Encrypted:false
                                        SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                        MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                        SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                        SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                        SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                        Malicious:false
                                        Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.375471538439732
                                        Encrypted:false
                                        SSDEEP:48:D/osg8udrSrVItW7JEQLUXKV9zOo9rdqrz6RXrxjFu9wrcYA+qFB:cs3VI4EQQXKV9zOsRyGNVq
                                        MD5:E00A2C8A507472C047EB55D6741CC19B
                                        SHA1:78B11434FEDBE152D3EEE580B58F95A49090235D
                                        SHA-256:BF0049CE6713AC7D1CBB8D1753C7A50A6313C4934E8957D22DDD265AFDC2B587
                                        SHA-512:A565EA77182DAB7754B36520208D1D5B4869F4BB814F6EE8E25C76CA37AC55512A997A3C27409266644616DCE957F637B857BBBD8FD04E8112EC519C2BBF0228
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ].!.....].!_]$..2p.8.g.W].!_]$..2p.8.g.W].!..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............K..V..x..D......N...^.................{...F.6_...%.........f........................................I.qk..B.....LZ..............K..V..x..D............K..V..x..D...........].!.....].!.....].!.........................................].!j....].!T.]..].!.....].!..B..].!H....].!..B..].!..>.)].!..J...................;........4...4...4.."..............].!.].!.].!..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........].!.....].!....#].!............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):647
                                        Entropy (8bit):6.854433034679255
                                        Encrypted:false
                                        SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                        MD5:DD876AA103BEC3AC83C769D768AD39FB
                                        SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                        SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                        SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                        Malicious:false
                                        Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.35703884868332
                                        Encrypted:false
                                        SSDEEP:48:esRiu2uKB+ulTNt515/EjFLqjWX1d6jW9ruoFrdqrKimnexRXtIXuXVJTJ4Qg:es6BJlTNrEjF8WXjYW9ruERyK3wcQ
                                        MD5:DA2C0F42798EAFEB5B3E3680330A5BE7
                                        SHA1:BAECC6F51A93D569E29AFA2626D7FA13E5AFB698
                                        SHA-256:9B1CFF14AC1DFC4C763383F05964C16D32682EC71A41E6A5801992BACD0D4873
                                        SHA-512:8DB7F63FE6704853C812E326D38EA063FB61943D5E2FCBCD91144D303A1C81E6E08BB5690629005F041853B1B264745A8279F1085C15D2439223983EC7D0EAC7
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..6.......6.y ..<X.K...[..6.y ..<X.K...[..6..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............(...@..#B..QJr....N...^................MT<...J...O[...........f........................................I.qk..B.....LZ............(...@..#B..QJr........(...@..#B..QJr...........6.......6.......6...........................................6j......6T.]....6.......6..B....6H......6..B....6..>.)..6..J...................;........4...4...4.."................6...6...6..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........6.......6....#..6............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                        Category:dropped
                                        Size (bytes):52912
                                        Entropy (8bit):7.679147474806877
                                        Encrypted:false
                                        SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                        MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                        SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                        SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                        SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.336846024770334
                                        Encrypted:false
                                        SSDEEP:96:ysgiIIttpbZEkIXDtJ97mERyxGEpI56hk0ky:ysgiIItt0kIXD/97mERy4EpI56hk05
                                        MD5:A7F6C37A32957E21EE27A3495E0A21E1
                                        SHA1:8D2EB64AF363CBA5351CAB58851F221DFDC5E943
                                        SHA-256:CEA3074742528020AD5284BE019F8381949CEE1F07B643F71FA3756A27093782
                                        SHA-512:C7526235B6F860ABE63407F12B6B10856C40B60DEAA029F06FCCEF90E3DED30561DD113AF36AF29882B8646D6734A3335FAA9B4EA10F4E4DE623A09A9AD70685
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ")......").O.."..[{~....").O.."..[{~....")...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............p...(....z^.W......N...^...............:..p...@...0...>........f........................................I.qk..B.....LZ............p...(....z^.W..........p...(....z^.W...........")......")......")..........................................").j....").T.]..")......")...B..").H....")...B..")...>.)")...J...................;........4...4...4.."..............")..")..")...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........")......").....#").............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                        Category:dropped
                                        Size (bytes):27862
                                        Entropy (8bit):7.238903610770013
                                        Encrypted:false
                                        SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                        MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                        SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                        SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                        SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.525037402433904
                                        Encrypted:false
                                        SSDEEP:96:Osn7LnN5E5DaXsJm9j8QRyJVbMCFvVCrTz:Os7LNm5mXsJm9j8QRyLb
                                        MD5:4F67FA38FC5C775C072A508BA7480633
                                        SHA1:567B20559056357CC840D1A209EF7F4940E98E30
                                        SHA-256:8233DA425003B73EC79CC2AA4B3F9F5ED793EA20FFFF28970999DA7A8A9838DA
                                        SHA-512:F83F29A38A8508B790650B895129E586E9E2A13884C9F384B4AD48B5C12B371C6C4BCEB345C2F6D1480B33B0A16BC24FFB46356AB14FE7C28A2E2036C888ABBD
                                        Malicious:false
                                        Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZh!B.....h!BY..B.>.~u0...h!BY..B.>.~u0...h!B..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Q}..=....\D..V8.....N...^................]/....C.J..I...........f..................................."....I.qk..B.....LZ............Q}..=....\D..V8.........Q}..=....\D..V8..........h!B.....h!B.....h!B.........................................h!Bj....h!BT.]..h!B.....h!B..B..h!BH....h!B..B..h!B..>.)h!B..J...................;........4...4...4.."..............h!B.h!B.h!B..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........h!B.....h!B....#h!B............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):977
                                        Entropy (8bit):7.231269197132181
                                        Encrypted:false
                                        SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                        MD5:B7F74C18002A81A578A4EE60C407A8D3
                                        SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                        SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                        SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.354583685165952
                                        Encrypted:false
                                        SSDEEP:48:wmesFmKJXYuYUXteCE3VpL+4OXGh9/S8oprdqrGzRX6+lr9ghQt4lARWg:wsF5YuYUX/E3TqpXg9/S8wRyoz
                                        MD5:37E67B5188D44661AA372C93EAE625AD
                                        SHA1:7BF65E4CCB12A5A714F1BF7125170A9A7616B722
                                        SHA-256:7A29368C28ADBC9F7FBC147BDDADA6040B3FB4F5F728673C6FCBF1A23249EA5F
                                        SHA-512:958CCE93C5F336CEFA4796A0B4646116DAE1656AF0BCFEEF4FA3952F8676AA83A29BE21364DAC0423812E3F73BD143EA1E99909B951419D03F75A79F7C959FF5
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................5.......5...K......A..&.I.......I.qk..B.....LZ.5...K......A..&.5...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............n...C.....w...%.....N...^.....................K.Fn.............f........................................I.qk..B.....LZ............n...C.....w...%.........n...C.....w...%...........5.......5.......5...........................................5.j.....5.T.]...5.......5...B...5.H.....5...B...5...>.).5...J...................;........4...4...4.."...............5...5...5...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........5.......5.....#.5.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):34299
                                        Entropy (8bit):7.247541176493898
                                        Encrypted:false
                                        SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                        MD5:E9C52A7381075E4EBC59296F96C79399
                                        SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                        SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                        SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.327781828943444
                                        Encrypted:false
                                        SSDEEP:48:6sWrZN2Z2b4tQYBXLEHSFLQXgVkB/9DEoFrdqr6/WjC2RXnNmt2B:6sqNc2b4jbEyFsXX/9DEERy7jC242
                                        MD5:5A511387C3D453DEC8F8CC50DCB18095
                                        SHA1:3800C62A408B916C9720485F888539361C612F37
                                        SHA-256:B4B4DDC165B4BED9C04A5DC8CC20C310D194E4BB5738AD2F2A64C2D5AEE9EF67
                                        SHA-512:85CFCEE340F9DAC73E8E6EECA199F23DFD8C59E918F8911CEE768CAB37AF4756211EF07FC85D0959637840601C2A3F0F2E1AE99BD98348B6A0A9EBEF1A44512D
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ`.......`...v`.1..l...N`...v`.1..l...N`....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............;....9.!...d2....N...^...............A.k).0.D....JV..........f........................................I.qk..B.....LZ..............;....9.!...d2..........;....9.!...d2.........`.......`.......`...........................................`..j....`..T.]..`.......`....B..`..H....`....B..`....>.)`....J...................;........4...4...4.."..............`...`...`....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........`.......`......#`..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):10056
                                        Entropy (8bit):7.956064700093514
                                        Encrypted:false
                                        SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                        MD5:E1B57A8851177DD25DC05B50B904656A
                                        SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                        SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                        SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                        Malicious:false
                                        Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.332109216963161
                                        Encrypted:false
                                        SSDEEP:48:rQNs/8DIxEInCtueyEXh2aLIXX9v/olrdqrQzfxRXrCdAIGNu9:rQNs8IyMCshEfcXX9v/kRyQVtzIou
                                        MD5:CEB45F28424A2515F36F2A4E80DE24CF
                                        SHA1:21D13A041B3F6FCD9A743AE8A70B7D0D1520497C
                                        SHA-256:69CA02C4A3BD28EFB71AEEACC03B13841131C88DFBB58505FE937CB8F9776FE6
                                        SHA-512:2AEFBCFE460F4C5A73C61E74D1EC3E53230CE272CE2FA8EF4E2BA622F689EC36B3B41061F7CB328D3D9FF27CA95E767473C89E4F783DC04914ABAFA5316A13D3
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.V\......V\..m..'.+igs7.V\..m..'.+igs7.V\..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............\X..f..&U.........N...^................d.=...I..<.1..r........f........................................I.qk..B.....LZ.............\X..f..&U..............\X..f..&U...............V\......V\......V\..........................................V\j.....V\T.]...V\......V\..B...V\H.....V\..B...V\..>.).V\..J...................;........4...4...4.."...............V\..V\..V\..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........V\......V\....#.V\............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                        Category:dropped
                                        Size (bytes):84097
                                        Entropy (8bit):7.78862495530604
                                        Encrypted:false
                                        SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                        MD5:37EED97290E8ECB46A576C84F0810568
                                        SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                        SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                        SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.351431233064563
                                        Encrypted:false
                                        SSDEEP:48:SeQMslliI6W09g7nt2gGEMx4XNs3U9XToRrdqrBIloRX+r8B3HZ:SeQMsn6W09g7nI3EPXNt9XT4Rymox
                                        MD5:FAB6A2198C267D1C54FF04C0A45158B6
                                        SHA1:25BDC38B397DA1C84E96082058A67276354C4499
                                        SHA-256:EC4738F7BEC6A1AE654AFB3C3BDC27121C8C4E066BBF8AF2BA4B5D539648FB68
                                        SHA-512:FCF3535E16D9BB00C5EB839E7A7CF33681EFA2C96FEBA46842FD796DDDE74043E22DE2FD68987082A1106C10149F380F3CFD18E867E4FF4200E6A8E9395168F8
                                        Malicious:false
                                        Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZtu......tu....*......W'.tu....*......W'.tu...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............a...i....b.n......N...^.................|Bp1!K.~.L..6.........f........................................I.qk..B.....LZ.............a...i....b.n...........a...i....b.n...........tu......tu......tu..........................................tu.j....tu.T.]..tu......tu...B..tu.H....tu...B..tu...>.)tu...J...................;........4...4...4.."..............tu..tu..tu...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........tu......tu.....#tu.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                        Category:dropped
                                        Size (bytes):64118
                                        Entropy (8bit):7.742974333356952
                                        Encrypted:false
                                        SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                        MD5:864EEA0336F8628AE4A1ED46D4406807
                                        SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                        SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                        SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.332013589505558
                                        Encrypted:false
                                        SSDEEP:48:l0N0esAqn//SOOAuLtbhEEpcDXOI9XxoLBrdqrvCh/GURXsHFk6fFaO/0ni/x:l0N0es6OOXLUEoXz9Xx2BRyv+QTKy
                                        MD5:1C21BD60A2324744EC6527A6EC68438A
                                        SHA1:5847CAFC0ECAD3207EE7BBED20CAB7FE70A7CFDE
                                        SHA-256:4F9F0BCBAA4EA3E859F3C2775CACD702BDF96CFE65990BE3D3BA70292F246099
                                        SHA-512:539743EA48870D630361AFF1402D24B634CBC156FE2B586CD7E45F2FC5BD8F09CF4CB9D1E30AE51BB393C543C2FAAE92A8F1AEF418F2DBA5FCF8D699D571F7F5
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.p.......p.......w....9.p.......w....9.p...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|g.X}Y.4...].......N...^...............+e...*.@..s...*d........f........................................I.qk..B.....LZ.............|g.X}Y.4...]............|g.X}Y.4...].............p.......p.......p...........................................p.j.....p.T.]...p.......p...B...p.H.....p...B...p...>.).p...J...................;........4...4...4.."...............p...p...p...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........p.......p.....#.p.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                        Category:dropped
                                        Size (bytes):65998
                                        Entropy (8bit):7.671031449942883
                                        Encrypted:false
                                        SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                        MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                        SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                        SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                        SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):3.239215693201694
                                        Encrypted:false
                                        SSDEEP:96:us0fzlCi+WEcEq7XlYy9/Tq5b+ZR0TqZah:us0fzlCPcFXlYy9/mbUR02a
                                        MD5:80816F82C95389353A623201F534045D
                                        SHA1:6B4BB2C00B19DD4B663D8A05B4C2E819E05EE8E5
                                        SHA-256:86C6BD88CA00994019512CDE8234726620AFF1891A2440F8A3046FB6A254F168
                                        SHA-512:69FEE33AE92ED2AE0EC86B6F67842FACAC9BA3F5A6BD184A690B5FBC09E38778215D7ABE6800DCC6165A5BC4E685818F9C7A48CB25BE7AB696B5062CE62DC9D9
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>...j.......v.............................................~...Q.{3jN.I.......I.qk..B.....LZ......~...Q.{3jN.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............g.x.r...r..c.w.....N...^............... |... 2G.=.>.K.|........&...................................>....I.qk..B.....LZ.............g.x.r...r..c.w..........g.x.r...r..c.w.........................................................................j.......T.a...............D.....H.........N.......?.#.....9...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4........................#...............................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):32656
                                        Entropy (8bit):3.9517299510231485
                                        Encrypted:false
                                        SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                        MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                        SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                        SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                        SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                        Malicious:false
                                        Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12824
                                        Entropy (8bit):7.974776104184905
                                        Encrypted:false
                                        SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                        MD5:2628353534C5AD86CBFE57B6616D46DD
                                        SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                        SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                        SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                        Malicious:false
                                        Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):32656
                                        Entropy (8bit):3.9517299510231485
                                        Encrypted:false
                                        SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                        MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                        SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                        SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                        SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                        Malicious:false
                                        Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12824
                                        Entropy (8bit):7.974776104184905
                                        Encrypted:false
                                        SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                        MD5:2628353534C5AD86CBFE57B6616D46DD
                                        SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                        SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                        SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                        Malicious:false
                                        Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):32656
                                        Entropy (8bit):3.9517299510231485
                                        Encrypted:false
                                        SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                        MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                        SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                        SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                        SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                        Malicious:false
                                        Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12824
                                        Entropy (8bit):7.974776104184905
                                        Encrypted:false
                                        SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                        MD5:2628353534C5AD86CBFE57B6616D46DD
                                        SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                        SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                        SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                        Malicious:false
                                        Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.311690133653324
                                        Encrypted:false
                                        SSDEEP:48:YuqRsoJowpBvteie3Eya7RXz069jFjdUmrd3rVxjRX3UqHyCN:YJs7wjv0ioEyaNXz069jF7Rb7J
                                        MD5:E1AE520C1FF5E26E467809869B56F779
                                        SHA1:1A24434D95183D1F538CA1E5E9BBB15BF1C3469D
                                        SHA-256:6ED61C52A13583F740E5DCC08FA6D6DFB56D6A2DA20FB72136135645FE8990D2
                                        SHA-512:CDE6ECFB1620B52DE5AB862198F115FA982F91433DF1E70A5667FB435A9C0FA2C7D78AEF5DD2A63D2C9017FD990A5693DD6305A7F58CAC5863B4D1642F51B2A1
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..7.......7.......J<.1....7.......J<.1....7..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................K #.....~A].....N...^...............!.mb.Z.G..:.C.B........f........................................I.qk..B.....LZ...............K #.....~A]............K #.....~A]............7.......7.......7...........................................7j......7T.]....7.......7..B....7H......7..B....7..>.)..7..J...................;........4...4...4.."................7...7...7..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........7.......7....#..7............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):39010
                                        Entropy (8bit):7.362726513389497
                                        Encrypted:false
                                        SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                        MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                        SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                        SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                        SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.428916779706829
                                        Encrypted:false
                                        SSDEEP:48:zWSsxq0pnne1+xtwj6Er+RdXBO9kmj41rd3rK3xtkdX2k2+6p:Jswye1+xbECdXA9kmQRbKDkXW
                                        MD5:D6CBFDC2FAF585FBB1BAD1EBE4D200D9
                                        SHA1:8A8CCEA5846155BAB9C3FCB80904FC78AD56CC66
                                        SHA-256:F93B5BF8893879E706581B4A278E6DC15725EA2120C91E83CDEB2607B817231B
                                        SHA-512:25EC5842433EC42A7ECD2BA5B92BB56770999CB2773A83564E3725D728927B2F8A673ADE664B71A351F2E16A223D82C5B3D703CFDBADB348D5A2D9B6AFE87819
                                        Malicious:false
                                        Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ.X.......X.E.........T..X.E.........T..X...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............PE.b..%q..........N...^................^.....L.j.............f........................................I.qk..B.....LZ.............PE.b..%q...............PE.b..%q................X.......X.......X...........................................X.j.....X.T.]...X.......X..B...X.H.....X...B...X...>.).X...J...................;........4...4...4.."...............X...X...X...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........X.......X.....#.X.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):25622
                                        Entropy (8bit):7.058784902089801
                                        Encrypted:false
                                        SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                        MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                        SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                        SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                        SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.320858632098423
                                        Encrypted:false
                                        SSDEEP:48:YuKds45URUkEItsUAnEHGKOXalUw9hSNj4prd3rUox1bJdXv1XJ5:YtsIkEI+EmJXw9cNMRbvd
                                        MD5:8C1E885EF43855B870431B7672E54A58
                                        SHA1:F93CB9AE90C73BA7598FE111763D3C3C257C5FDF
                                        SHA-256:D8A09073F51E97A977AE706A12310E5EA8FA9A7BD2BE3B3054130472ADFB449D
                                        SHA-512:9ED1A60A84A65A499049F85D3A372B6C087B7386031A7DAC287D07052E071456455E829BEE2B4430EF10290BC1FC9896504BB059F910262C226C6C53D628043A
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ................Km...........Km........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............._./.$x.......j6....N...^...............Bo5ZW$*K.Ho..^.]........f........................................I.qk..B.....LZ............._./.$x.......j6........._./.$x.......j6........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2033
                                        Entropy (8bit):6.8741208714657
                                        Encrypted:false
                                        SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                        MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                        SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                        SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                        SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                        Malicious:false
                                        Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.324698317857863
                                        Encrypted:false
                                        SSDEEP:48:isGqCWqZ7tFkEkJLqIXr3IBI9oYooj4lrd3rIxSNiKdXWb1fBlJ:is9qZ7kE8fXjD9o8YRbVNjel
                                        MD5:E6BEC26F3025B4EFBF0A6F2065D317DC
                                        SHA1:DA5A1B3F1B5BD628DF1CE8ACE2EFD5C99F878F45
                                        SHA-256:DCFEE2760D8FEEC77E787C48B53F4C00028EC619AC7A459C47972B4712CC502B
                                        SHA-512:38324A81F5A1B5B43F04F5100700417F62980A3645EBCBFB84B677489E02B5A308A35ECAAEEE36C29651C4351BEA45E8F97390D7D65DC63C192B8EB46B718B06
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.I.......I.^.-....;..0...I.^.-....;..0...I...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............dm.;....w.........N...^..................DspRK.......#........f........................................I.qk..B.....LZ.............dm.;....w..............dm.;....w...............I.......I.......I...........................................I.j.....I.T.]...I.......I...B...I.H.....I...B...I...>.).I...J...................;........4...4...4.."...............I...I...I...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........I.......I.....#.I.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):55804
                                        Entropy (8bit):7.433623355028275
                                        Encrypted:false
                                        SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                        MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                        SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                        SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                        SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.452128333777912
                                        Encrypted:false
                                        SSDEEP:96:QsoP8xEYDEMXcYL9w26ZRMkrSRoDS7ZJ:QsoP8KTMXco9w24RMkrSRoDS9J
                                        MD5:A897142A08E864DC736A3848E75CACE8
                                        SHA1:0DE063B8B621C5A13DDB6BFC33093E0D4992C56E
                                        SHA-256:D98C315F27110D9067898B5E472DB91208CF34BC5595E8B88E7BCDAC0B0843CE
                                        SHA-512:AB9313C898F8A9A39ABC923C7BE309EC9ABB3021F718029A9C733675E506AE54EAE7F6626759770CD0F3549B1D874AED3F746881DE08F5DC8AE25F6FBC534F26
                                        Malicious:false
                                        Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................*.......*...&...dt.s...I.......I.qk..B.....LZ.*...&...dt.s...*...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................#e.Z+.......N...^....................k.N.#..F.#.........f........................................I.qk..B.....LZ..................#e.Z+.................#e.Z+.............*.......*.......*...........................................*.j.....*.T.]...*.......*...B...*.H.....*...B...*...>.).*...J...................;........4...4...4.."...............*...*...*...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........*.......*.....#.*.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                        Category:dropped
                                        Size (bytes):59832
                                        Entropy (8bit):7.308211468398169
                                        Encrypted:false
                                        SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                        MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                        SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                        SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                        SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.291107992930122
                                        Encrypted:false
                                        SSDEEP:96:vsj9W/893WEIpX3p9exARMzFyYyxy8QyByYyK6y7y9:vsj9WUZ+X59exARMzFyYyxynyByYybyu
                                        MD5:BE54E7FB214F7F24B24216CDD51E2D25
                                        SHA1:C6B45C21B97E244A713D142F5D0A4DA4118A6F3C
                                        SHA-256:193AF3FB8E30EEAEEE73751E03458FB742A5486F96D86CE4D0D0E90047C7A3FE
                                        SHA-512:BC98AE163087F468D44E0B10F51E1E03F37EFEE7CE9DDE1EF6B20C0DB695EABFE9786F8A025AC95BD218539F6B4F7B35D6A93FF430E6546F1BC46CBE6D8AF97F
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................F.......F.._E.....2To.Q.I.......I.qk..B.....LZ.F.._E.....2To.Q.F...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............O.4.m..+.. 'v.....N...^..................F.y.H....a..$........H........................................I.qk..B.....LZ.............O.4.m..+.. 'v..........O.4.m..+.. 'v...........F.......F.......F...........................................F.j.....F.T.^...F.......F...B...F...C...F...>...F...|...F. .3...................;........4...4...4.."...............F...F...F...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........F.......F.....#.F.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):33032
                                        Entropy (8bit):2.941351060644542
                                        Encrypted:false
                                        SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                        MD5:ACF4A9F470281F475EA45E113E9FB009
                                        SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                        SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                        SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                        Malicious:false
                                        Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12180
                                        Entropy (8bit):5.318266117301791
                                        Encrypted:false
                                        SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                        MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                        SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                        SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                        SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.360387429598308
                                        Encrypted:false
                                        SSDEEP:48:YsLbdtGeabLvtt+1DEPEczowLhrX/VO9cs7p5FrdMrlEzijQXppc9/8qRv:YsdsTbTtmEsAowlXc9cuVRMBCcR
                                        MD5:52619FEB97C7BE906BA4FF4067C00CA1
                                        SHA1:9EC1950B902391A0B57E4B6FDC3DBA00AF7853F7
                                        SHA-256:2AE9DA082E221BB70DF4348D272E5BD379A6A91BD1965943D480ED17B8EAEFC1
                                        SHA-512:3978E63594A61744F6C00E28F15FDFEDCB22208D77AD72CDA780849F8A5F01B95B3DCD96B746C42C3C182A11889C10DD02276CD66E5E0A09D4EB4E5FB8547E27
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ"......."....I..U......"....I..U......"....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............X..w+..-..F.g3.....N...^.................i.HuhJ.80...`.........f........................................I.qk..B.....LZ............X..w+..-..F.g3.........X..w+..-..F.g3.........."......."......."..........................................."..j...."..T.].."......."....B.."..H...."....B.."....>.)"....J...................;........4...4...4..".............."..."..."....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........."......."......#"..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2104
                                        Entropy (8bit):7.252780160030615
                                        Encrypted:false
                                        SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                        MD5:F6C596F505504044DF1E36BA5DA3F09B
                                        SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                        SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                        SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                        Malicious:false
                                        Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.346629680861192
                                        Encrypted:false
                                        SSDEEP:96:WsWwhfV/F+LwnE2olXSyl99soRMQAX8/0Lg+zRMLKdG9:WsNV/QtPlX3l99soRMQc8/0LjRMLmG
                                        MD5:D6E387F2D9D20B4EC6357B0623E82E3C
                                        SHA1:E1C75EF8E8859A79BEC08AB9C491BAAEBEB99B73
                                        SHA-256:E79131D6FEA5A255AE30FAC4CDB1B1FCFD8FAE5C0BFA8A6EE34A79509FA5C5A2
                                        SHA-512:AF3E4B3E16F997184812A6B8A41A7B54F95A24A2AE018C1865E2298E4A5657CAB9EF97A710833E7A52E9E496635343DE421946BF13596A7F6DD7DD6E233E2A48
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..........m>e..u.a... ...m>e..u.a... ....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............oc9.......a.....N...^.................*.o..M...m............f........................................I.qk..B.....LZ.............oc9.......a..........oc9.......a.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):14177
                                        Entropy (8bit):5.705782002886174
                                        Encrypted:false
                                        SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                        MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                        SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                        SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                        SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.349503812365783
                                        Encrypted:false
                                        SSDEEP:48:kxswqwsyLhjtqFtEYXL7FGXhuH9ZsdpyNrdMr56A1IFXlY9sGl:Es4LhjgEQgXM9ZYgRMj2W
                                        MD5:F66C84152F111B71EB65E1606EF25EFF
                                        SHA1:301DE3774C4B9BB1C2A120D06AE2F5930825BA2B
                                        SHA-256:1DF7116CC57433FE655ECFE0A769A6A58B80A7F1C444831E44538551C548FB46
                                        SHA-512:3ADB6B9355DA9E9A2F74341D7997982E7978E46D847924678D0AA47BDB165872A1E03A6AD7340396936E7DEAE119DCDB6FEFE3FA9BC8AE33934AF6C427259240
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..c.......c....;Unx..|...c....;Unx..|...c..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'......................o..|.x:....N...^.................~..A...2#...........f........................................I.qk..B.....LZ.....................o..|.x:.................o..|.x:...........c.......c.......c...........................................cj......cT.]....c.......c..B....cH......c..B....c..>.)..c..J...................;........4...4...4.."................c...c...c..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........c.......c....#..c............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                        Category:dropped
                                        Size (bytes):36740
                                        Entropy (8bit):7.48266872907324
                                        Encrypted:false
                                        SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                        MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                        SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                        SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                        SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.45287248405264
                                        Encrypted:false
                                        SSDEEP:48:tszwsqolVtrMtaf/W+8ELLjZX8Pk9VslpyclSrdMrrrk1FXVVkxo31LPtQEg:tstVtQ458ELBX8M9VkzlSRMreeE
                                        MD5:1AAAED02DEF049DBC28F72797D4284FD
                                        SHA1:0A19731B7ED61C541F62D40A225CA94FE117096A
                                        SHA-256:37C4DC74A4876F3B448214551FEE598DB37DF72380F3C054163EF7DF7DBA0469
                                        SHA-512:1D508F59D7C0072D33BC2750973DC585880A35A45450DC9CB163A2133110EB7592FEA151C5B9CCD8417309B0F77617794192470B8689827A79207A87B93BD363
                                        Malicious:false
                                        Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ..9.......9z5?..>.l..`...9z5?..>.l..`...9..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>..\.....2F.......N...^................o..#.N..C~.1..........f........................................I.qk..B.....LZ.............>..\.....2F............>..\.....2F..............9.......9.......9...........................................9j......9T.]....9.......9..B....9H......9..B....9..>.)..9..J...................;........4...4...4.."................9...9...9..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........9.......9....#..9............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):53259
                                        Entropy (8bit):7.651662052139301
                                        Encrypted:false
                                        SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                        MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                        SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                        SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                        SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.289947212557227
                                        Encrypted:false
                                        SSDEEP:48:KsDVJmB6Wo432Wtx/WJEXDJYyXl9ndsMpyMSrdMrVl7J7FXSFPBvzLW2fvB:KsMo82WbWJEXlXl9ndVIRMvN7Adn
                                        MD5:33DE14E3B32AD6A06F69BB0C1B669428
                                        SHA1:28EEE5BA3F1081499B623C11BD9CEB379E6472BE
                                        SHA-256:452AA2047DA7004F3074FA62904E69B46DC11B89613B61EE7340D79EBC41C700
                                        SHA-512:30936782456AF1B7585956D900D543A05B79EF02990C2258E9EE859710DA29E1F86F0067767AAB80A3FC615F5F2197E5D0319B288A880A8261570341E1395542
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZI.......I.....n.!......I.....n.!......I....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............e.......;pC...i....N...^...................i{KA...5...........f........................................I.qk..B.....LZ............e.......;pC...i........e.......;pC...i.........I.......I.......I...........................................I..j....I..T.]..I.......I....B..I..H....I....B..I....>.)I....J...................;........4...4...4.."..............I...I...I....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........I.......I......#I..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):60924
                                        Entropy (8bit):7.758472758205366
                                        Encrypted:false
                                        SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                        MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                        SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                        SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                        SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.337530009469072
                                        Encrypted:false
                                        SSDEEP:96:seR0s1R7b+cMTNRE6Xuu496696ZRMdrR7bSubOEV:sq0s1RfTMY6Xud9F94RMhRfScOE
                                        MD5:94AAE242A446B6C67D738257F906C931
                                        SHA1:3FDC4F2B09F496E058DD71F537483FF652485A6A
                                        SHA-256:F860063579B6A88D8C70E7C5FF90AF35D0FFB8DD2FA461FA8F277C1EB3FB7857
                                        SHA-512:D358D49919007CE32F28D87F4D0D5D8BC848FE9F8EEDDD45D9D9F2581E12715A19DDE9BD35D5EE8740DEE65E71A1895617B3501410A95D75D27690575C906ACE
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................*.......*.rA...4...!.c..I.......I.qk..B.....LZ.*.rA...4...!.c..*...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............$......#bj...!.....N...^................5}.j..F...VEWy.........f........................................I.qk..B.....LZ.............$......#bj...!..........$......#bj...!...........*.......*.......*...........................................*.j.....*.T.]...*.......*...B...*.H.....*...B...*...>.).*...J...................;........4...4...4.."...............*...*...*...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........*.......*.....#.*.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):515
                                        Entropy (8bit):6.740133870626016
                                        Encrypted:false
                                        SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                        MD5:E96BE30D892A5412CF262FEE652921CA
                                        SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                        SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                        SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                        Malicious:false
                                        Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.364286324947276
                                        Encrypted:false
                                        SSDEEP:48:4DsAKkB6ctSenaJEPA8OLFXGY9dsIpyVrdMr3tNxFXGwrckJ6pg:4DsYB6cUJEPiXt9dpgRMTxjJ6p
                                        MD5:4A94646F33734577B7BEE4D92BB65125
                                        SHA1:74ED0CF6E4F954C620B5A84ACF476D2CAD752144
                                        SHA-256:55ECC3583FEA180DB7C04AA90019F9CB47C890F005CC53730324ACADBAF19903
                                        SHA-512:A712BA4FD6D84E5DB98A789F16A301C7EB41FE116C9CDF8864652B886D98C24B2F85F9E17223A3D7D0936F28A7C966884D844D90CDED395F95D2708042BECEB2
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ9r......9r.Lw49.+M.N...9r.Lw49.+M.N...9r...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............s.L.....<.....5.....N...^................IL.x..F.I..v.O.........f........................................I.qk..B.....LZ............s.L.....<.....5.........s.L.....<.....5..........9r......9r......9r..........................................9r.j....9r.T.]..9r......9r..B..9r.H....9r...B..9r...>.)9r...J...................;........4...4...4.."..............9r..9r..9r...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........9r......9r.....#9r.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1547
                                        Entropy (8bit):6.4194805172468286
                                        Encrypted:false
                                        SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                        MD5:0BA36A74DFBF411FAB348404CCEC3348
                                        SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                        SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                        SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                        Malicious:false
                                        Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.313814051565508
                                        Encrypted:false
                                        SSDEEP:48:4ttYl0s6a8dt6ZSJztBoMNE054jeXRoC9oohUPpy5rdMrMgDoFFXpJmtfScPWbV:t0s6Vt6ZSJzFEsXv96PURMMrwtKcPWb
                                        MD5:5C16867BFE5065E47B57B107341EA78C
                                        SHA1:CAA47C45790F8313FB16FAEB98716972917FCB55
                                        SHA-256:7118ED2CDD46DAC31B0E1DD7D7E957B9533A0F4BCA28C4143F3DA5358AD01B79
                                        SHA-512:54D2607487B2E223E66E138E8134EF59EFD5471CC5EA3734BF95FF08230A8C8AFD6AD350241521D4339AA946294A71106735AF9BC523078D4519D35F8F3A62AC
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..V.......Ve=.X...C`1.....Ve=.X...C`1.....V..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................4.BrkY....N...^.................:><..N..Te.hF.........f........................................I.qk..B.....LZ....................4.BrkY................4.BrkY...........V.......V.......V...........................................Vj......VT.]....V.......V..B....VH......V..B....V..>.)..V..J...................;........4...4...4.."................V...V...V..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........V.......V....#..V............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):95763
                                        Entropy (8bit):7.931689087616878
                                        Encrypted:false
                                        SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                        MD5:177DD42CA99CAA2CCBF2974221680334
                                        SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                        SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                        SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.355674070677948
                                        Encrypted:false
                                        SSDEEP:96:6sRvZl0uJEEy0bX39GgIRMmXGZEvc0tU:6suubycX39vIRMmX3
                                        MD5:9CB38BBACED9F867CBAD9DEAB5CC9D8F
                                        SHA1:A4AF79972C0CFBF64A97646F98DE30D20D407525
                                        SHA-256:004932C0DCE8D3E1993BF27A96BB5C2D0123E5B6E0EF3ADCFDF62C949BEBF1FE
                                        SHA-512:9C949358DBDA9D8DC49D5425080447F201A6BA0759C8512B0C9721BAAC5161260347EADA4C47A40092F7B4B371EBBD500440964BCB2252F64B3C2F0725716CC9
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZE.T.....E.TY)|D...+..:W.E.TY)|D...+..:W.E.T..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............g.4`.;^#3.z<.....N...^...............?%....F..,.{8p.........f........................................I.qk..B.....LZ..............g.4`.;^#3.z<...........g.4`.;^#3.z<..........E.T.....E.T.....E.T.........................................E.Tj....E.TT.]..E.T.....E.T..B..E.TH....E.T..B..E.T..>.)E.T..J...................;........4...4...4.."..............E.T.E.T.E.T..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........E.T.....E.T....#E.T............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):67991
                                        Entropy (8bit):7.870481231782746
                                        Encrypted:false
                                        SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                        MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                        SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                        SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                        SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.310538260832272
                                        Encrypted:false
                                        SSDEEP:48:V6smuR/C8klgteKgVEvlLRDXBG9AyUzpyE8rdMr7k/hlCFXh9k/91APk9:4s7/alg0REdFXQ9AFzURM7EKqMk
                                        MD5:7332376606E73A490C8171ABD145773C
                                        SHA1:3B76EDE61A4E949C6B75EAF2BB7C8898DCBD6EA2
                                        SHA-256:387B2E38B9052DE13ECE65651C2B5E20A991EC2304FEAEF9792649E3D74EAE54
                                        SHA-512:D40F7889EF5D7D0F1FEB8183CDB10F44C831ED9A734EBA3E2752AA0DE7495655CA152B55F646182B1AED2FDFC27AF837E3192A24FDB395D4E63FAE107F3B923A
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZD.......D..R:....'....z)D..R:....'....z)D....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................l...c.j?.....N...^................I...D.....@..........f........................................I.qk..B.....LZ..................l...c.j?...............l...c.j?..........D.......D.......D...........................................D..j....D..T.]..D.......D....B..D..H....D....B..D....>.)D....J...................;........4...4...4.."..............D...D...D....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........D.......D......#D..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                        Category:dropped
                                        Size (bytes):22203
                                        Entropy (8bit):6.977175130747846
                                        Encrypted:false
                                        SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                        MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                        SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                        SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                        SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.380132842191146
                                        Encrypted:false
                                        SSDEEP:96:tsNlBYljLQMfEDtXLv9i1sLRMpB8vBc2EOjY:tsiJLGDtXLv9WARMpB8G
                                        MD5:1DE1D00F46E0C5C516A0B5097B073C9F
                                        SHA1:50552A89A93C00B5975D5F8B2BA2B7D56B09B458
                                        SHA-256:554B5155607E9876C36CD95131BED59A2E42FC01C2DA75FC19A87404581CD273
                                        SHA-512:1EA2681A256199088C24342DFF61637006BDD4C5FD322635CA355ECBC89FC957FA319EA810988742C7B15EC07663CD836A2FF6DAEEF8236637CFE4E3D5E351AB
                                        Malicious:false
                                        Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ,.,.....,.,..R{....a....,.,..R{....a....,.,..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............-exl....P........N...^...............Q.B6...C.uQcI.f_........f........................................I.qk..B.....LZ..............-exl....P..............-exl....P.............,.,.....,.,.....,.,.........................................,.,j....,.,T.]..,.,.....,.,..B..,.,H....,.,..B..,.,..>.),.,..J...................;........4...4...4.."..............,.,.,.,.,.,..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........,.,.....,.,....#,.,............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):15740
                                        Entropy (8bit):6.0674556182683945
                                        Encrypted:false
                                        SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                        MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                        SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                        SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                        SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.303739949571902
                                        Encrypted:false
                                        SSDEEP:96:yBs2yeklKJOjEj3vXDEu9KkwRMEk76ECHVebSrjECBw:ys2yeklKXj3vXIu93wRMlrCHVebyjECB
                                        MD5:7B848F2CCF9A4046B80447E979135CCB
                                        SHA1:9835887F1CA58A8760F36440EECD3115C67BEA3B
                                        SHA-256:F7D7D6D89207A5C88B013FEB8B3EB04F078F87A50832E18EA084F2BD12D80665
                                        SHA-512:50B52F8BA55E9FA4BBFC070531AF5C87A19ABC293B7A695D7824A734278F732078F1007C4022A0EF2FAD91D071DA2220F6D0D032839D6AC8AC5F4DEB93C0DDCB
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.Jk......Jkq..o.+.y+.^A..Jkq..o.+.y+.^A..Jk..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............z.........iV.......N...^.................<....L..GU.M.(........f........................................I.qk..B.....LZ.............z.........iV............z.........iV.............Jk......Jk......Jk..........................................Jkj.....JkT.]...Jk......Jk..B...JkH.....Jk..B...Jk..>.).Jk..J...................;........4...4...4.."...............Jk..Jk..Jk..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........Jk......Jk....#.Jk............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):86187
                                        Entropy (8bit):7.951356272886186
                                        Encrypted:false
                                        SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                        MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                        SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                        SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                        SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.657919914084602
                                        Encrypted:false
                                        SSDEEP:48:eGGsJczIwxAVSqtC2kEdzbULSBhrVXA9VUMpylrdMr69nYkFXQoHS8D9lL6HM38o:Is1SqAEtU0JVXA9mM4RMYRKcZ
                                        MD5:29E33347D96DCA6F214B24C6A146C153
                                        SHA1:DEE781843C5294DBE752137A6632C9775AD7211E
                                        SHA-256:69E6159DB28393EE7797C75202EE7B2209B47568D6106415CA44952C26AA9560
                                        SHA-512:9853570D9703015C8291F8C59486EA228F9289B6A42005FECB33F0A708D60BFA4339687C23C58F00BCFC6909217370B4E23A9BE243242FA2477E761EF90F4946
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ.U.......U....i.8s.N.Zc..U....i.8s.N.Zc..U...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............G]..L..5...e......N...^................{..3.PF..a$Pl.+........f...................................H....I.qk..B.....LZ............G]..L..5...e..........G]..L..5...e............U.......U.......U...........................................U.j.....U.T.]...U.......U...B...U.H.....U...B...U...>.).U...J...................;........4...4...4.."...............U...U...U...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........U.......U.....#.U.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):11197
                                        Entropy (8bit):7.975073010774664
                                        Encrypted:false
                                        SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                        MD5:DDC3CC30794277500EFE4BC6667EC123
                                        SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                        SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                        SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                        Malicious:false
                                        Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.329415016079728
                                        Encrypted:false
                                        SSDEEP:96:ys3tQGx5BEElhXlcC9m04RMYpCaKa2ajxanaKaA+ala:ysuGFRlhXiC9X4RMYpCP7sxCPYg
                                        MD5:9BA96055821169EF185E7AD5ED814A77
                                        SHA1:B4720AC50BFF649EB2FA97B55ADDCF995CDCC9C1
                                        SHA-256:FFA8BE1E99065C93140119FB1314507A79CA29F7DBDFD852AB6C733359AA825B
                                        SHA-512:965BCBE2A8B476EFB77FEDEE7755244D65071BF94E5893A148969885B0234377AFD4D519AF61FDC797A6157D2B493306B4ED061A8C99809FA42CB9E4A5154464
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ>l......>l......9.W>...i>l......9.W>...i>l...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............x.E...9I..T}.....N...^...............[/{gmLvJ.g..j.........f........................................I.qk..B.....LZ.............x.E...9I..T}..........x.E...9I..T}..........>l......>l......>l..........................................>l.j....>l.T.]..>l......>l...B..>l.H....>l...B..>l...>.)>l...J...................;........4...4...4.."..............>l..>l..>l...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........>l......>l.....#>l.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):19920
                                        Entropy (8bit):7.987696084459766
                                        Encrypted:false
                                        SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                        MD5:1BDAD9B3B6DE549162F9567697389E1C
                                        SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                        SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                        SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                        Malicious:false
                                        Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):3.042924858655932
                                        Encrypted:false
                                        SSDEEP:96:VswInTuPL1lE1tN0fMXrYv9JmgRMH8CVc7BU:VswiTwRy1tN0kXr09JmgRMTc
                                        MD5:F93783FA8D7485BE016C024B88CAAAA7
                                        SHA1:F8F5CCCF3E6364C4A91CEF5593DA0B379A912AA9
                                        SHA-256:1D88CFACF6E4BC4CBD2C5DCC4C29B93BB799F12F484814A29751E0521674E8C3
                                        SHA-512:CB8BE299C27D10EC331CA233CB1341AB10B31A8F81E35920543192CF6AC748A37FBABB06CA89143D13B3B1AC93DFBA99730B227956E4D2D7ABE056923FBB1684
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>...........v...X...2...>.......$...v...<....I.......I.qk..B.....LZ.cl......cl.dw..<..p...cl.dw..<..p...cl..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'........................"t.(.....N...^................Y.5...C.......a........f........................................I.qk..B.....LZ......................."t.(...................................cl......cl......cl..........................................clj.....clT.]...cl......cl..B...clH.....cl..B...cl..>.).cl..J...................;........4...4...4.."...............cl..cl..cl..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........cl......cl....#.cl............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):179460
                                        Entropy (8bit):7.979020171518325
                                        Encrypted:false
                                        SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                        MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                        SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                        SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                        SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):2.3646346206177595
                                        Encrypted:false
                                        SSDEEP:48:Kj4u2JPdCWlfnCHQlFObDYpl9YNlXT8lp:yqn62Spz
                                        MD5:E5BCFADD111CBDC4457B4348A81A7779
                                        SHA1:9720EB4552E183F63943DBE0F63ECCC23D9D3B1A
                                        SHA-256:1010ABF3F190CDBC7852BE1DBFCF2F54D0B17D454477B2BEA0F9280B080ED2E3
                                        SHA-512:A914BB1A2DC1432C3BA6F154EA300F2F08024F6257468E7C8EDF77AED1CCE081F5C754DC6D4FA8D02555479D3DCD07C7B0F2EBEE7BE38C0A73B0B91BC55BEDBA
                                        Malicious:false
                                        Preview:.................................................................................................................................................................................................................5.......*...#.......#....c..S...#......Ak=.+.fr...........>.#.+.Q..T.,.........D...>.y.................Cl......Cl..................................................Cl..g...Cl`.....Cl..1...Cl..A...Cl..Z...Cl..a...Cl..k....................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y.....................c..,....................Cl..1... ..$....S.t.a.t.i.o.n.e.r.y.....................c..,0............=iY...N...;hF.&...........Cl......Cl...A...7..h.............Ak=.+.fr....2...........T...................#....Cl..................................#....c..,....................Cl..Cl..1.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.344478256010167
                                        Encrypted:false
                                        SSDEEP:96:0DsFHSs5ekE+Xia9tpgRM9RuiTUfdi7i64BN:6sFys5M+Xt9tpgRM9Ruiidi7ihB
                                        MD5:592F69561B6B602FF350404832F938C5
                                        SHA1:A82ADA11F705F36D6C5CC8DFDA50552079B67FDC
                                        SHA-256:BC1E51200A086EE579B2D95D58E98DA8C01C1B4EF8B55B7C2ADEAEBBD359C3EE
                                        SHA-512:B60AB05881EF33A8188307D239BDECE1C98FDD22C426FAF8811859D8E69F5B8BFAFA72BE94A9C9D473C86FC9BB7B8CA7B7B9F49725AAFA62B0393FC7CF62974D
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.........H.]..a.9L....H.]..a.9L......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Y.H..R.............N...^....................}.M................f........................................I.qk..B.....LZ............Y.H..R.................Y.H..R.............................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):109698
                                        Entropy (8bit):7.954100577911302
                                        Encrypted:false
                                        SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                        MD5:8D804A60E86627383BED6280ED62F1CF
                                        SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                        SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                        SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.317427797395882
                                        Encrypted:false
                                        SSDEEP:48:MKssq34Ob+V/gtRyhE3yP9XKXc9NsEpylrdMrZw6FXatvVAQirO1l:MKsshOb+5gehEWXKs9N9YRMlK5U+
                                        MD5:EE1ED05389F8C15D519E82DBD4268814
                                        SHA1:4C634EF5565AC7EE74B0637A39F1645187025AF3
                                        SHA-256:AAAE2D669705444558164904888759FA19B202C3C2B3AA4E8049790D45F82049
                                        SHA-512:0016CEC215C4086FED6934C2C2E72A42FD869EAB846A69FC182406305D7D9BCA728FE491415C4D88C922416929138F887FABA0961BC68A97A80749FE5667CE4B
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........e......f%^.....e......f%^.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............c..n.f..F.Rv.z.....N...^...............(..$D..G...A...........f........................................I.qk..B.....LZ.............c..n.f..F.Rv.z..........c..n.f..F.Rv.z.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):41893
                                        Entropy (8bit):7.52654558351485
                                        Encrypted:false
                                        SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                        MD5:F25427EFECFEE786D5A9F630726DD140
                                        SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                        SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                        SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):3.2906106048148978
                                        Encrypted:false
                                        SSDEEP:48:G1iDrnYzFX8y0q8j3CEDbPUErl7v/uDFSm9E:HPWM2EDb8EpAcmS
                                        MD5:98FF8354731EAC4D9568F94BA4615877
                                        SHA1:69069EADBC3F42B2E013A7512F61210B16C9A74A
                                        SHA-256:F9EA48D180C0A39A27808B4A5F07DEFF2FB89EAA3F6536B95117B15D5B8F32A9
                                        SHA-512:AB842B634F129DE967A1C1FFF5EC5CB8BADD7A480B223C80C951FD014B297149F4B7C19B9462457FB9506C5682E516ADD4C64DEA4B0D008869215B021BDC52DE
                                        Malicious:false
                                        Preview:........$...........t......................................?....................................................................................................\.......................................L.......L.....[.9;,.o.I............'....4...?.....'....4...?.........C.k=...u.b.."......Da.].E.........D...........................................................................x.....X.........4...............$..`.AT(Q....DT.9..}.T&e................4..(.....x.(.....`.A.....`.A.T.IM.6..+....D.......Da.].E........2...v.................................D.}.............................D..........c..,0...e...B4.$........[.-...I.......9......................}......}.....I./.r.?|0...........C.k=...u.b...L.....[.9;,.o.I.L...QE.T..."fj..7'QE....Da.].E.........D.....>.......4..........C.k=...u.b.."..Da.].E.............................}......L....c..,0...e...B4.$..............E........................................0...........e....4..................T.o. .D.o. .L.i.s.t........s.)..O@
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.8889914652809128
                                        Encrypted:false
                                        SSDEEP:192:hs/YU8Tbw3aXEQTMlPsRzSHKs7yZ5KOHl9+cx3f:2c9l80RziEL
                                        MD5:7FD1330FE585C1102AA23D87957C47DC
                                        SHA1:0EA6E0B8C0A79BF36832ABB539FD27935082C502
                                        SHA-256:29A30E2915D3E8984F7CEF6A073A5171BCEB3E16AECBA898042B03642FCEB632
                                        SHA-512:C6698306D5BA05EFD4DBFC1C6CAA2F5804144DA6B9B4443CB351A19D885CE91B3E0E095DE60FC8DD9082CDDD8EA379AC6BDBFB2CC326AD01361C1FA52747A27A
                                        Malicious:false
                                        Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ4...;...4...1...%w...1..4...1...%w...1..4....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................-I...5>..Z.'.....N...^................|.w..2E.;....k.........h...L...............................D....I.qk..B.....LZ...............-I...5>..Z.'..................................4.......4.......4...........................................4..j....4..T&n..4.......4......4..H....4....K..4.......4..$........4..-4..J4....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(4..#4..84....z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                        Category:dropped
                                        Size (bytes):68633
                                        Entropy (8bit):7.709776384921022
                                        Encrypted:false
                                        SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                        MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                        SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                        SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                        SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):4.078485555171257
                                        Encrypted:false
                                        SSDEEP:192:lrbxBCD33fmMIhQs/1YExIZPaGFPFw/ePFyO3MhyqBxVhA7c7nBAXK6BCIUHRJBd:xuTh/SOZPw/QyR6c7nBKyRJ/FKuSzlZ
                                        MD5:FD4A0B25E9092B544E76433C16B3E78A
                                        SHA1:0F7553FFFC9F4811DFA6AE967392822B02C76387
                                        SHA-256:ADCC7770084532909A5C84EF73B526D07825C3DD1878398A839A670C6C4BD0FA
                                        SHA-512:292388A6FC54C8A63343F8CA7BDF5E3D6B8A024344D43E107115FFB1A1D74B80E5967E43F3BB1F85207AF16FE1BE84E8229FE0335263362451AF556344262210
                                        Malicious:false
                                        Preview:^...>.......L...d... .... ...9..^...>...........d...h...@...@;...........................................................................................................................................I.......I.qk..B.....LZ...1......5g..?.N.b._....5g..?.N.b._(.... ..#B..$..7..... ...I.qk..B.....LZ.I..................................................................... .$..... . ..... .$..... ...)... . ...... .N.&.....'...@.....'..2....z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y........................:......z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3............ ...z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'..%......z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1.........*..........%..#...'..&...9......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                        Category:dropped
                                        Size (bytes):59832
                                        Entropy (8bit):7.308211468398169
                                        Encrypted:false
                                        SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                        MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                        SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                        SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                        SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):3.2366154651249484
                                        Encrypted:false
                                        SSDEEP:384:7iHlZjGILpmflgnmpGUTvbRJGPb2TxYw:7iHlZjGIdmflgnmp/jbRoPb2TxY
                                        MD5:70AF205212DADCD4FC1C8A8AA7DC4E3A
                                        SHA1:B429CB836F0D7355EB78176068365520F085AF1D
                                        SHA-256:7EE48CD888F869B015BCCCCC555E5A13011CB208FD2445BA1C94F091A6D3CAFF
                                        SHA-512:A79A5292FA202CDD8E57DBF59F3DE113F8042441DC84E15483ABC7661E365F6D4D85BFEAF2B4519CA4F33D3961BA94F32B0C50616DCEFEB2C0BAD54349AFF58A
                                        Malicious:false
                                        Preview:2...>...........v........ ...-..2...>...B.......v.......@....,...........................................................................................................................................I.......I.qk..B.....LZ....P......".].....\q.@D...".].....\q.@D.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............n.p.....6..i...n....N...^................{..Wd.F.bH_..3..............................{..Wd.F.bH_..3..........{..Wd.F.bH_..3.........n.p.....6..i...n................................................................................................j.^.....T'.......................-..................... .L.........3...I.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6................3...9.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):53259
                                        Entropy (8bit):7.651662052139301
                                        Encrypted:false
                                        SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                        MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                        SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                        SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                        SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Matlab v4 mat-file (little endian) h, rows 975182774, columns 0
                                        Category:dropped
                                        Size (bytes):72
                                        Entropy (8bit):2.3244093931715546
                                        Encrypted:false
                                        SSDEEP:3:bkjaaHtFpRDyXRRtl:bktHtDFmX
                                        MD5:E90C7F7217C00E189774958B9C146907
                                        SHA1:CB4C865652235759710CA2007252FA9F42B6935C
                                        SHA-256:62E7E8871CE2446EDCB57BB89AE906C83C777D9B6ABCA5C2ED049E75E7EB011D
                                        SHA-512:30DFF909F5EB07F7228306C8C738550D5E321DDBEB56155F78F049B3AE7C96F8496290D3564140E45C409B54401DF0B4A616BB85B230DAF42C1DD99E288FE52E
                                        Malicious:false
                                        Preview:...... :........=...h..................................@................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):0.04401584019170665
                                        Encrypted:false
                                        SSDEEP:3:RRk//:Lk
                                        MD5:CD74ABACE8A00B17BD8107BC5982C21E
                                        SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                                        SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                                        SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                                        Malicious:false
                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):0.4945136704264069
                                        Encrypted:false
                                        SSDEEP:3:vldawlAuil8xt/l2l7BPFUt/gBOr6FuBkdfQlsxl/ll2hliJw5YfICiXvyllaclH:NTcFPyYQr6zwsj//GwJdXifZw1EVBs5
                                        MD5:2F8D33D8EC36D7D6907200530B2698A1
                                        SHA1:770AEB94C7D0E5DDA259966AFD4A5546F329DF34
                                        SHA-256:D396B19B3F7471CA5064D570244666110813958C3AE545DDB82B34FCC3EDFE39
                                        SHA-512:11A732E7AEC20D2481FB060DD2A43F4BB89EBDF80FAD5792305AFA584FBCED9A3DF5E76614A05F2A5B113D0044601D34E9FD4D88A375DA94A95CFC5267A679EB
                                        Malicious:false
                                        Preview:2...>...........~.......................................................................................................................................................................................:.......:..4.NTF....x..f........................:..4.NTF....x..f:....................................................:...........................................................:..P..............................................................................5........m;.H....7.5N..........Z..........$.62.k.N...`..k-....N...^...........................................................................................................$.62.k.N...`..k-............................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.738345541190342
                                        Encrypted:false
                                        SSDEEP:96:O+8K3jduSQxjzExyLk3s3gL8FttECxuEwFK732xtQhTX:O+8KTduSOjg8Lkc3gLsKCx7wFK732xtq
                                        MD5:BCA07CF1C51BA13D5E0CD6B4EB4E7305
                                        SHA1:C9540AE3E732D8841C3B3BC69124743FB3CBA868
                                        SHA-256:79703B7EB311E476C368DB488BF0F57DB3EB6897B362E29D428953483052E6D3
                                        SHA-512:20329057898DEC58FB8D0A6765251E8E0A18D57AAEAF077728578AEA7161F5224442C66E09BA2C92D7D1A792BCA7E3CBD7E03EFCAEBB185FA3CC60FC8414A57F
                                        Malicious:false
                                        Preview:j.......`.......L..................................................................?....................................................................j...............L...............................{q......{q.s.....,..18i.A.......A..)b....X#.N...........$!..."s.....A..)b....X#.N...A...{q.s.....,..18i.{q...........A.......A...................................................w5......w5....C.54...F].Q9......Q9=..GA..b..1..2...^...................,.......{q...Q9.Z.T.....J...<+............w5T.N...Q9T%m..Z.TT$.....]T&...J..T.:..A....5..A...."..A....h......J.......{q...c..,0...e...B4.$..........C@RQ.H..B......Y....................Z.T.....Z.T{...A..v..m.}........................<+.3T...?..y...<+...Q9=..GA..b..1...Q9..w5....C.54...F].w5.....>...............A..)b....X#.N....Q9=..GA..b..1...w5....C.54...F.................$!..."s.J.......J..Q...N.8jE..\.......Q9..........c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):4.743715879166226
                                        Encrypted:false
                                        SSDEEP:192:bs3wr7y85oVnXOYWRiBI3GONwJgL9i98/M0:A4eVXLWRiQ809q8/M
                                        MD5:37B0BA27935F5DDE309EA8A27F8A1482
                                        SHA1:E13F15B17685E13C6A096055F8F9866EDE9321C3
                                        SHA-256:1A59DB76DDAB9300445FF20597FBEC8680CC3A617AF4FCFA7B25F2C6B5026991
                                        SHA-512:503708D5D617501DACE823B426A7B274F0166989094D5E26D09464986D25F2A9DBAD2D5729AE786982AF2C1C66A2E4D05081B10B00486F6EB1D48091290D9127
                                        Malicious:false
                                        Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ..n.4.....n7R...;.. .....n7R...;.. .....n..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............v....9.....}..^....N...^...............LPr..l.L..... .............>...............................$....I.qk..B.....LZ............v....9.....}..^........v....9.....}..^...........n.......n.......n...........................................nj......nT%;....n.......n..W....nH......n..+....n..S....n..........Z4...........................................4../4......p...............C.a.l.i.b.r.i....................n:..nk..n..z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):40884
                                        Entropy (8bit):7.545929039957292
                                        Encrypted:false
                                        SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                        MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                        SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                        SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                        SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):4.371218751069372
                                        Encrypted:false
                                        SSDEEP:192:86sD/CHqJsomXMYDF8L2M0Kd8wp9n6RhVQIXSpRkT8WE22Nmuj9zUFCc:UD6K2oHYJ42MHvp9shVfSpRkTe22Txh
                                        MD5:483D93D6AE85EDAA2F700FA02C956038
                                        SHA1:2EE3D002484E6EB3B6F26549D6BDCCCE3133896C
                                        SHA-256:C32E738CD5171DEAAC3CEF1CFB3C31F9CE53B7E2F5F69717B10792FB1D207963
                                        SHA-512:EE98B5BBAD27CCE6574D373DC2C8A0A0B0DB42D263917817BEE7E5B68E652076249137DA52DE72911C50C8C24AFBA1AEC9369884EACD301833C1B1CC75E278DF
                                        Malicious:false
                                        Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZm7e.H...m7e~.l.....'$..m7e~.l.....'$..m7e..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............kH....P..mf.9....N...^.................]..&.B..$L.-............................................."....I.qk..B.....LZ..............kH....P..mf.9.................................m7e.....m7e.....m7e.........................................m7ej."..m7eT....m7e.....m7e..T..m7e.....m7e .A..m7e.....m7e ........m7e3m7e:m7e8m7e..z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                        Category:dropped
                                        Size (bytes):24268
                                        Entropy (8bit):6.946124661664625
                                        Encrypted:false
                                        SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                        MD5:3CD906D179F59DDFA112510C7E996351
                                        SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                        SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                        SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):4.592661791461898
                                        Encrypted:false
                                        SSDEEP:192:vslMIO8MynVEbGGeX9hjfe0mvw4/r7i7+/P7xGLXLTTRp3bKO9Jh6fgAxL9XD0Zn:kWmMyn1tnjm0oj7LHFGjLTTRpJhUgAxE
                                        MD5:7AAEC34FF987A25C5034F52BBAAF5029
                                        SHA1:78DC52963D8C98512A6D1D01DB8CAC13A0C32F6D
                                        SHA-256:CC497AC382F43B6B7981F0F59ED5AEE3A9CF29483432F4F2ED2A50A4D7316BF3
                                        SHA-512:E6859D3114768D26718122DB0FF74B13D5644F0B9C330539B7FB0C1E610C8A2D36C383B9CA7D4881038F81BD166905AC4C05376646D2BFF15E0B310D16C330D7
                                        Malicious:false
                                        Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZr...N...r.........h.A.%Nr.........h.A.%Nr....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............6.,..i.1..".......N...^............... ...*.N.B.B-..a............P....................................I.qk..B.....LZ.............6.,..i.1.."....................................r.......r.......r...........................................r..j.9..r..T....r.......r...s..r..H....r....0..r....`.&r..........r..3r..:r..Ar..8r....z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):39010
                                        Entropy (8bit):7.362726513389497
                                        Encrypted:false
                                        SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                        MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                        SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                        SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                        SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.9036201054293698
                                        Encrypted:false
                                        SSDEEP:192:Dst9jagJmH1aZURe+ABCevfL0Lkr183wRE4wjXQYcSyjEzXYRh:4vjrsHuURebZ0Lkr1WwRE5jXQnS06O
                                        MD5:98E1A8ABDA29943851741E450ADAC8CD
                                        SHA1:1444095EEDE36D3663E21055A41E41F0C719E074
                                        SHA-256:C855B359752936BB14671C7E6ABAF416BF2BB1FB0A1C0C3EE7F33711FB54D7D3
                                        SHA-512:E3BAFE1B469E6668F9AF6598F3F8C4991DDCBC0CD070473AF04665E516737022FE7ABFD4D51DF009F3B531E070AF3E0CF16DCE034C8C15CFBC5CBBFDCDF7D1D2
                                        Malicious:false
                                        Preview:....>......."...v.......8 ..."......>.......r...v...>...@....!...........................................................................................................................................I.......I.qk..B.....LZz.......z...=~..(.]I.N....&..*......P._...&.z...=~..(.]I.N..z....I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'............../....i.?.W...ot....N...^...................VT.@..H..k.............(...............................z....I.qk..B.....LZ............./....i.?.W...ot.................................z.......z.......z............................................&.8.....&..*......P._.z.......z...=~..(.]I.N..2................................I.................................&H......&.......&..d....&.......& ......&$.7....&.......& ..........&!..&..z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):59707
                                        Entropy (8bit):7.858445368171059
                                        Encrypted:false
                                        SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                        MD5:47ADB0DF6FDA756920225A099B722322
                                        SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                        SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                        SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.855894093934613
                                        Encrypted:false
                                        SSDEEP:192:Esr8WEkWjjZhSeUTpCXRzRlhcmJCUvwvS9NM2Ujoa:ZoC+ZMeUl8RzRlhCxSNH
                                        MD5:4BB89B392709CB9D2DD56CEDA39C1C1B
                                        SHA1:126D3D40E2B49FE2805C5C7422D4D42F560401CD
                                        SHA-256:DE051B155F75FB4494D9453397EEC0C91AA89CEC2C995D931B6FBD78F4342C25
                                        SHA-512:06229AD6F618A3C93DFA668E0C509FF25D1D3EF24705D5A8FCC6672D8003DB553DC301D0AAD83C118E009CD72D29C1A4E3B2C5A4897DC1547FFE2609ED2E2AE3
                                        Malicious:false
                                        Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZs...<...s..8....0k...".s..8....0k...".s....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............0....)....vb."......N...^................!Qw...B.V.I9Y..............................................D....I.qk..B.....LZ............0....)....vb."...................................s.......s.......s...........................................s..j....s..T.T..s.......s..|..s....;..s....h..s.......s.. .W.....'s..2s....z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y........................s..3s..8s....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9.............s..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                        Category:dropped
                                        Size (bytes):27862
                                        Entropy (8bit):7.238903610770013
                                        Encrypted:false
                                        SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                        MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                        SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                        SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                        SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):5.369670358923896
                                        Encrypted:false
                                        SSDEEP:384:WP7T5MX9E8syNmx/rdt/d2Zb6oAoOycY+vCPmM98MiDWVwdgQyEDr/XXg:dc9v6ZOQjU
                                        MD5:280645A60A1D4649B4651C02986402E0
                                        SHA1:C5E2DE55F1B1F9D496461D1F42DD7A5C1B8A93ED
                                        SHA-256:C5ED4CF2A744A09F9D29ECFED84912839E5AE9FEFD27E41603EF91FF8557ED91
                                        SHA-512:FCA6F216171F00235586019D27EB02DE51ED6CF88AF79080AE15DA3028D16F5A6A04010769AAAC12B268A768CDA5C9DD839E059D0A3F8E4E03E261A966F0FC45
                                        Malicious:false
                                        Preview:...@|...h................@..P .. M.........@|...................`K..P ...K.................................................................................@|...0................K..P ..@L..........................x.eK.k.X~.............=....................5.^6.p.)....0.....M........]0...........8=.W...c............................................................................T.a..}..T...."..T#P.............X.................I...................0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e....i.......i.... C.)P...!..<.......<...0.C....S..2...h...............8...............}........<..z.......r.................0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.1067720016393325
                                        Encrypted:false
                                        SSDEEP:96:Nus1yq/6S/IjkIEaueXK9sxDkTNRLOXRV:Nus1yC6Swjk1aueXK96Y5RLOX
                                        MD5:6A64EECE89FA61ACB344E92FF340DC52
                                        SHA1:8F00EA300BD1B68243C4CF06A994F1E0712C13A9
                                        SHA-256:BA4777135372C2FBB3D3300817E76D3F5382808433838CEFE70AA8D37B179BDD
                                        SHA-512:96BEFFC75784396601C9A126CA84D038CFB9D597D14FDA4CF0E3FB37940E3B8B038CB9E0A7E67BF8D72CF8BE48B979068D1FF178CC49897D8F6540C0F67B6703
                                        Malicious:false
                                        Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZ.a.......a.[.....(X...d.a.[.....(X...d.a...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............9...Z..|.j-I......N...^...............Y.8T:..E..............f........................................I.qk..B.....LZ..............9...Z..|.j-I............9...Z..|.j-I............a.......a.......a...........................................a.j.....a.T.]...a.......a...B...a.H.....a...B...a...>.).a...J...................;........4...4...4.."...............a...a...a...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........a.......a.....#.a.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.055808202188051
                                        Encrypted:false
                                        SSDEEP:48:m0s1MisaF6t5V/lNBt8EfmrXI9QTVscToirdqrtEIzdXRqkjfsa:dsejaF6P5lN78E8XI9QTVscTTRyzaes
                                        MD5:152DEADD0DED3106E0B860E6E3177C53
                                        SHA1:AC51F4F894388E85C7B0C128C9A56F9D15BD11EB
                                        SHA-256:EA9349FB8EF217FC73F2591889599358D6862A7C122B2829509532535DEB526F
                                        SHA-512:6A2D847796A7219A621E4920F94425481F55D6780A17B38F2234DF50637AD34C431654CD24A41E68ABF23F010F0626B1B149B8BDBCEE64A876DE30BC925DABCC
                                        Malicious:false
                                        Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ.t]......t].....#..B./G.t].....#..B./G.t]..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............}.......\=.......N...^................>..p.$D....2...........f........................................I.qk..B.....LZ.............}.......\=............}.......\=.............t]......t]......t]..........................................t]j.....t]T.]...t]......t]..B...t]H.....t]..B...t]..>.).t]..J...................;........4...4...4.."...............t]..t]..t]..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........t]......t]....#.t]............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.051794836325931
                                        Encrypted:false
                                        SSDEEP:48:5smesJat8wE3pmXs9BKrTo+rd6r+eIdVdXJfDzi04g:5sSJaLE3IXs9BKrTnRich4
                                        MD5:1D669030F4054EE9B1AE1BAFC70AC447
                                        SHA1:08C17BA5258FCD7A26F478D2FD6B91B4D6300B09
                                        SHA-256:35BFFBFAF7F77BA4611FF626DD5987D6B119B4CEA2688A6D9B418856CBEA442B
                                        SHA-512:4CEEF015808EB15D8013AB52574E783707847B9C9FE2E6D627A6C4F1D45DF4578DD1EB332AFA0E5925FAC66804F9F152D2E2B49D075BFBEE38605DC4712C3D09
                                        Malicious:false
                                        Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ.?.......?...+..'.C.'i.c.?...+..'.C.'i.c.?...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............1.zZ.j..-..Ew......N...^..................G#.yJ...]S.*.........f........................................I.qk..B.....LZ.............1.zZ.j..-..Ew...........1.zZ.j..-..Ew............?.......?.......?...........................................?.j.....?.T.]...?.......?...B...?.H.....?...B...?...>.).?...J...................;........4...4...4.."...............?...?...?...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........?.......?.....#.?.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.068405247455166
                                        Encrypted:false
                                        SSDEEP:48:UfksQKML9ne5ZqtXYwElxXm19yz5ToErdnrO3Ip7dX3Dj22cg:Ufkske5ZqFVETXm19yz5TJRrOw77c
                                        MD5:B2C624F4938A20CDB2CF9C058B92D5C9
                                        SHA1:ABF807D441D90C1E3729EACA695655A2BF9B9EC1
                                        SHA-256:AD77E12F3736C3CC20C0F3AF710D5A42D329B78A4D187E493B16C41972F3F8F6
                                        SHA-512:FD449CE01FC3EE4401542A5FD007CBD1DEA45A6225B8F13BA839C7A3B12C6ED186847B118ABFB6D31BB7E0E1043472C570869DAA3217AD26634C5895AC85961F
                                        Malicious:false
                                        Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ/>....../>...m;.<....M/>...m;.<....M/>...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Dh2Xcz~..td-5.......N...^...............YH.....A.....P.........f........................................I.qk..B.....LZ............Dh2Xcz~..td-5...........Dh2Xcz~..td-5............/>....../>....../>........................................../>.j..../>.T.]../>....../>...B../>.H..../>...B../>...>.)/>...J...................;........4...4...4.."............../>../>../>...z...y.. x.. ...........$........4......7...7........................;........4...4...4........./>....../>.....#/>.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.076057376881498
                                        Encrypted:false
                                        SSDEEP:96:1stTeUqC3EHaXE9ItCTIxRydYVeDpP1mpob:1sVq9HaXE9IUGRydYh
                                        MD5:D931918D1C421C5F1708AACA0DCF4BBC
                                        SHA1:8A227B85ED7DB6C6AAA27B297460B2EC01227931
                                        SHA-256:14203E26396369EFD043C4BA4E74561064C04C8E99BB9E196343312E607F9E2E
                                        SHA-512:351B44C61388172B3B472A3A32C8AC2A2A573FEC1227CC6E8E0B48CEE8D5CEE373E85AFCD95C95F7DDD3729D93E47E398A8F8CEF40C8FF851272EB11C09AF89F
                                        Malicious:false
                                        Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ.$W......$Wgb.../g......$Wgb.../g......$W..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............n.O.(m..&D.........N...^.................'.I.pF....~.s........f........................................I.qk..B.....LZ............n.O.(m..&D.............n.O.(m..&D...............$W......$W......$W..........................................$Wj.....$WT.]...$W......$W..B...$WH.....$W..B...$W..>.).$W..J...................;........4...4...4.."...............$W..$W..$W..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........$W......$W....#.$W............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.0942099024749385
                                        Encrypted:false
                                        SSDEEP:96:usYdeJGMfYVqdLSEaXA9lv+TERPLG7e3xzR1:usg8YAdL/aXA9V+IRPS
                                        MD5:E8DCDB0EEFAFF7873ED5E11F53258BEE
                                        SHA1:9B2C7CEF4A36EECD31DD132D03A4027724455D64
                                        SHA-256:CE22AD0D6EE509B42B70C827B79D32A512CC4B1419D70CF0C4B38B8D91B7E927
                                        SHA-512:FD2779E3C8551005F074367A5275185D7C48B6D9F15DFFB7B22F1A1396ACFADD647BC8F76609A582523CC41DFC1FF967D90AC6AE30A9640030AA4F4F341C5C57
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ..c.......cZ.....A`......cZ.....A`......c..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............._....!..72^..m......N...^...............K'..HC..{+%.A.........f........................................I.qk..B.....LZ............_....!..72^..m.........._....!..72^..m.............c.......c.......c...........................................cj......cT.]....c.......c..B....cH......c..B....c..>.)..c..J...................;........4...4...4.."................c...c...c..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........c.......c....#..c............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.069003498778496
                                        Encrypted:false
                                        SSDEEP:48:YpbsGRmzh7deuS5ftG1uO6EYw+X49UY3To2rdmrRhIBpdXxlRG78OqGL81:4bsHel5fAgEY7X49UY3TLR2ypcI
                                        MD5:43D77CEAB9C2F7C133C051CC162FBEA8
                                        SHA1:9A79367D3A7FA0FFD473DE1081920542C04D8159
                                        SHA-256:CF9AF1E80786C0DA36B6846293BB98F1D075B20DD0969E8DD2F30C90CD06ADF1
                                        SHA-512:A5D7F00EBC941D2833AD8B22CD6FBF34FFBEF890649DEA5E5163D11581388EA2F41EC2D7CE65678358246980353C93D56D41CB512585A0B09F0D147060AE3A47
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZy......y..A.a."..0.\.Jy..A.a."..0.\.Jy...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................]..u]q....N...^...............2.4....B..-r._.........f........................................I.qk..B.....LZ......................]..u]q..................]..u]q.........y......y......y..........................................y.j....y.T.]..y......y..B..y.H....y...B..y...>.)y...J...................;........4...4...4.."..............y..y..y...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........y......y.....#y.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.090410189535527
                                        Encrypted:false
                                        SSDEEP:48:YIi8i9srb8rN/1U1jVtqGEn6rFXSh9dzKTolrdvlxrEIBwdXKlRhxd:yN9sUNNU1jVfEYXk9dzKTMRHk6
                                        MD5:2155497090A350BB38DA6C7D8CBC7AC5
                                        SHA1:18E575F1533D04A295B2F99DE1FBE33BE768F6B8
                                        SHA-256:ADE1B0EE1F3F2FF1B5FA4F831D0698F4D4D6669D73C4437300528E989B5F7A24
                                        SHA-512:3E466D2B2AD882E0E5BF99F8DEF696785B36DCC614F837C0F1059B34A1FD8E8EBBCB5F1D2E7CC2B3F4B2B8DF1B22732AFE622C0BC22A18FA1ED3144478B079B1
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZM.......M....2F. ...-/.BM....2F. ...-/.BM....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................Q...,..G..;J....N...^...............~...=..H.=..[..........f........................................I.qk..B.....LZ...............Q...,..G..;J...........Q...,..G..;J.........M.......M.......M...........................................M..j....M..T.]..M.......M....B..M..H....M....B..M....>.)M....J...................;........4...4...4.."..............M...M...M....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........M.......M......#M..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.084140552572893
                                        Encrypted:false
                                        SSDEEP:96:KsQ5CkHzq3D8vEXgiXs9xPGTQRjT+6k/M3pnK:KsYgDfXgiXs9xPGcRjT
                                        MD5:1FEC51786534A8E5D40724AD868D042B
                                        SHA1:B2732EE55A13B827210ED45E8FFB03BBA069B8C6
                                        SHA-256:58F98441D11FA62D9F5A37EAA74FA212D9C23CD87939B02EEC7D6D4705E1F02C
                                        SHA-512:69EC658199D578D64425047ED716C8C5D50EB56D4DA210C7AC280B54A95E1EF3B348C4C1EBFF7698688399A87DBEC750B7F7A4570DCF24B887E74ED5203D5AD8
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ..........F;P.......[....F;P.......[.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............<r..[l..=.V.U..N....N...^...............~.~].^C....?..c........f........................................I.qk..B.....LZ............<r..[l..=.V.U..N........<r..[l..=.V.U..N....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.086480976264342
                                        Encrypted:false
                                        SSDEEP:96:qsqQe78HLE7Xg9dMTORIuPjcpVjGSpVnWVY:qsqQeT7Xg9dMCRIoIpVjGSpVWVY
                                        MD5:38CDDA3F27E3D8D0A47C6DEE5A2982FF
                                        SHA1:E32BA3F6CCDBF8D31307D507E5D01DC4D7BC1395
                                        SHA-256:D18E800E430723AA92E5A8A47E356BB01E9841E5BA72FA8D303C0F6124146DDB
                                        SHA-512:FB27734D697BECAEC736E95D30EDC1E168BCDC75AF9CAB51E9C19C794DCA0EBBAC36F08CF36CB2EDEC4ACFAED283551F4A2AF8B2CAFC7EBC85D34B86B6E34240
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZAm......Am...l..:.......Am...l..:.......Am...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............1..1..&D.#.H.]....N...^....................0L.M-8.9$S........f........................................I.qk..B.....LZ..............1..1..&D.#.H.]..........1..1..&D.#.H.].........Am......Am......Am..........................................Am.j....Am.T.]..Am......Am...B..Am.H....Am...B..Am...>.)Am...J...................;........4...4...4.."..............Am..Am..Am...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Am......Am.....#Am.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.077972801894362
                                        Encrypted:false
                                        SSDEEP:96:P72sSWdJAg8Sl+jEfZXE9dkTyRfOHJIcMOA:asn4ZSjxXE9dkuRfO
                                        MD5:E84774DFC07EFA3EA724E49E78A03A77
                                        SHA1:14165A37CE3ED61FA2ABF974F2144863641C7B24
                                        SHA-256:5BC5D68DC13E1FF83A27567072F34AE84DCB3589A5060DF9C29568EECE41265E
                                        SHA-512:420868E47D97FF2F32A19185894A0D3A8F4177D8490AD612034325B62476618E8A80BC3C643BD1F142DB370C68B83A86BCED67BD6AEF6BF1F53E77C3B3C15415
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.a......ao.V?./.w:(....ao.V?./.w:(....a..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............2.%e.3..4-X.TQ.....N...^................o..i0G.fu...).........f........................................I.qk..B.....LZ............2.%e.3..4-X.TQ.........2.%e.3..4-X.TQ...........a......a......a..........................................aj.....aT.]...a......a..B...aH.....a..B...a..>.).a..J...................;........4...4...4.."...............a..a..a..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........a......a....#.a............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.068147457442855
                                        Encrypted:false
                                        SSDEEP:48:Y+wBstKMNX7EXltc22FhGEFnoXg935a82ToVrd2tr4IydXylRuMlR:iBsHr0lOiEFoXg9U82ToRegGl
                                        MD5:4A66FAA710DEED5FB5C2C5DACCA36BB4
                                        SHA1:B91D28B76A17506E37506F91C761C8284BD459C5
                                        SHA-256:F8E6F33EF2E659CF9F54FD703FFBEA35752F3AD30A8180B9430054C4AC7FE63B
                                        SHA-512:EBAF9982FEE72269CE99861989B14E7735150454F9EBB5444FD399175A16B3715408CDB1D083C45EBAE64D1FD4366F3E89296D4206BD3FFE2AE02F345359610B
                                        Malicious:false
                                        Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZl]......l]...4...o.C..Zdl]...4...o.C..Zdl]...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............v.......%...)a......N...^...............V":...I@.3j_.f..........f........................................I.qk..B.....LZ............v.......%...)a..........v.......%...)a...........l]......l]......l]..........................................l].j....l].T.]..l]......l]..B..l].H....l]...B..l]...>.)l]...J...................;........4...4...4.."..............l]..l]..l]...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........l]......l].....#l].............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.078931485181804
                                        Encrypted:false
                                        SSDEEP:48:IKUX2U+srkgKdqZltRjtxiEt9X/Q96MTozrdfokr9IYdXW5akxQY8a:BJ5sAqZlVgEXXY96MTaRfHpF+8
                                        MD5:130C61B1F726812215E45FC83774A411
                                        SHA1:03DAF7F6D67634462B17E59A781C85977F4134BB
                                        SHA-256:354C5E1FFCCCC95D9460E881BF77B7861E36F06CC16AC2B4E0DF4E57F402A432
                                        SHA-512:57A7F74BE0902BEAA74738EC80A8C90E751F72D17401B8EC6D16B946CC47300FD0BEB851D6D5322D25407EB675E766D0F45101DBBD52225BD9529AB4F8FA23A0
                                        Malicious:false
                                        Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ............7.T...nb........7.T...nb.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............b. ....!K..Q.....N...^................L..a..N.Z...d;t........f........................................I.qk..B.....LZ.............b. ....!K..Q..........b. ....!K..Q.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.033245185344536
                                        Encrypted:false
                                        SSDEEP:48:BstEpY6ct0Qt8Eno3CX4B9ZsVNToErdlrEZIZdX3GkI+0a:BsSY6cSC8EVXI9ZANTlRpEAga0
                                        MD5:E1CCEC397AC9877055025475F7CC9BB3
                                        SHA1:B0E6F6C348A9041BE917BBACE44C0D427BAB8675
                                        SHA-256:EBBE1766099DA786551EA7385D3D9242E032D1BE73283D4C5FA797923DDDCAC5
                                        SHA-512:7901E147FFF33F3168C262097A56F1F5DFA4E95E7D50863F3DC3FB627756FB3D587AC4B5DBF3AE6B171ACE1E8DA4E06D5DC3A2BD84CEBF343027ACEBD3FC9041
                                        Malicious:false
                                        Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ. "...... "..7$...d.3.]. "..7$...d.3.]. "..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............1...@./.m.@......N...^...................>CM..+.............f........................................I.qk..B.....LZ..............1...@./.m.@............1...@./.m.@............ "...... "...... ".......................................... "j..... "T.]... "...... "..B... "H..... "..B... "..>.). "..J...................;........4...4...4.."............... ".. ".. "..z...y.. x.. ...........$........4......7...7........................;........4...4...4.......... "...... "....#. "............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.078327358986024
                                        Encrypted:false
                                        SSDEEP:48:Rs+pU8pQMomtzeB079tMEdLXM9wNT+5TotrddrDIOdXKdqtkp/5lrqoON1a:RsWeMom8B0TMEZXM9wNTCTcRR9Heg
                                        MD5:97B55B5E389DC605745AE03F20513057
                                        SHA1:AC8DA28C2E25FD70915060B40FE21EDCFF026AD3
                                        SHA-256:E512E095D3DE545D0C70C08BABEC646D630B5B4C9C0A0F335309AC1C598AD725
                                        SHA-512:283084BF4B060A5867EE463187FA9466E4A01EA48C4DE749772BC57C0CCA43BC4643DA85C9A55C75D4D1DD2F79EE9AEF4C2DB8D956A60D160EF91230936BC582
                                        Malicious:false
                                        Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZN.6.....N.6....4.md.b.,N.6....4.md.b.,N.6..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............%2@.j../..I.6.....N...^................5.pK..G.%-$..-.........f........................................I.qk..B.....LZ.............%2@.j../..I.6..........%2@.j../..I.6..........N.6.....N.6.....N.6.........................................N.6j....N.6T.]..N.6.....N.6..B..N.6H....N.6..B..N.6..>.)N.6..J...................;........4...4...4.."..............N.6.N.6.N.6..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........N.6.....N.6....#N.6............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.173712062646338
                                        Encrypted:false
                                        SSDEEP:96:eskTPPsy/A0lcEKXYP99pTdRvxYPy0mhl:escH/AC5KXYP99pJRvx
                                        MD5:F4E500BE956A46E3C43B1897C5865F72
                                        SHA1:F53BC96C1A18E7F077204A5B3F8625D895E5887E
                                        SHA-256:2631FF3CB7FD4B07B61E61D45540D5FE3B7C12D0D0DDFDE0E7B6939BA7D82DC0
                                        SHA-512:9C4E32DCB841FCA738FB441BCA8FD05C5B2334EF4906E6770DAA8E227CC9C5AAAB0604B0EBDAA0B07EEC1B2AC951AB0EDC7A545C390926EE109857B75BD09D87
                                        Malicious:false
                                        Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ..8.......8.HV..,.,.......8.HV..,.,.......8..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............3.X.-.G.*L.|......N...^...............B....M...g.-..........f........................................I.qk..B.....LZ............3.X.-.G.*L.|..........3.X.-.G.*L.|.............8.......8.......8...........................................8j......8T.]....8.......8..B....8H......8..B....8..>.)..8..J...................;........4...4...4.."................8...8...8..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........8.......8....#..8............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.158798621542166
                                        Encrypted:false
                                        SSDEEP:96:0DsmBCYpdEr5MEPIXw9DMcTTaRIpy/CpPxHK4:6sypdq5pwXw9DMcTmRIpyR
                                        MD5:626F51245CECC7F9D19D3F0C388BECE3
                                        SHA1:4166D0DA936F1B70EE9DAB186AD499C2354278F1
                                        SHA-256:A237A3BA56AB827ED7E49F0A03B998432F4C805B151A12E5D46CEF31481ECCA6
                                        SHA-512:73562128B3F6A1FCC24048550FD307F062EE0A12DFC12FC6A0D0E1C2FFBED25F1B3FC3F1CBA222F47EF9BE0B5A4F096BF12DAF996A76FA94E036E52D1EEDF544
                                        Malicious:false
                                        Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ.o......of......f(.M...of......f(.M...o..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Rs..d U.-{A{Wm$6....N...^................HE...F................f........................................I.qk..B.....LZ............Rs..d U.-{A{Wm$6........Rs..d U.-{A{Wm$6..........o......o......o..........................................oj.....oT.]...o......o..B...oH.....o..B...o..>.).o..J...................;........4...4...4.."...............o..o..o..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........o......o....#.o............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.125872313063504
                                        Encrypted:false
                                        SSDEEP:48:7mesax6aD5Md9tWKhY+EBAC+r6Xw9XDjvqBToFrdSroIKdXCuMsD1V:pssLMd9EwEBA7uXw9zzqBTwRKIqsJ
                                        MD5:B355433F0F0C276D04FA77E9D7ADB4A2
                                        SHA1:E0CD3F42BEEB1BF3A1A8AD025B4E76E47ED4F441
                                        SHA-256:D4AB7E8C5ED5C806F6737FCA12251528BCD227DE2792B55FCECF2EA7FBEA5CA5
                                        SHA-512:2031810C982AB09F47E28DCE55F9501EA615BB4F4D4D5487BF6A6FDB7BB63DB076798EB0798D381A309D51E7089DBC4611E480DD287DEC0AE1E1A6880402BF66
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZu.j.....u.jv.Q..7.m...=u.jv.Q..7.m...=u.j..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>.+....(.?.U.......N...^...................].O.9q..N..........f........................................I.qk..B.....LZ.............>.+....(.?.U............>.+....(.?.U............u.j.....u.j.....u.j.........................................u.jj....u.jT.]..u.j.....u.j..B..u.jH....u.j..B..u.j..>.)u.j..J...................;........4...4...4.."..............u.j.u.j.u.j..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........u.j.....u.j....#u.j............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.098647584219779
                                        Encrypted:false
                                        SSDEEP:96:S0sCvTz2pTJ4mI7E78cXrc91TXRKmGnMkrzqhtik8NkDTb:1sCvTz21JjI4IcXrc91DRKPMkrzqhtiA
                                        MD5:1DB1F99F671EC9326C5E555917F1F0C9
                                        SHA1:C3ABC7993B071EB74B39EADC9CB4B723180BD5C8
                                        SHA-256:495F9FF31D2D738376D726DB6D89016082CBB5214CF07297D7B428498A79992A
                                        SHA-512:628C1171BA752BF9EC99468F4FCBD7C39422AC085D397B223E75B54C7A82B4F0BB30B52717F623DE0D80C058F3565FFF5FA38BAE808340E3CE0ED7B1279A4B9B
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................8.......8.*.b}....X?.)..I.......I.qk..B.....LZ.8.*.b}....X?.).8...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............G..........O....N...^................1...x.N.ZL...lo........f........................................I.qk..B.....LZ..............G..........O..........G..........O..........8.......8.......8...........................................8.j.....8.T.]...8.......8...B...8.H.....8...B...8...>.).8...J...................;........4...4...4.."...............8...8...8...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........8.......8.....#.8.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.131841932144553
                                        Encrypted:false
                                        SSDEEP:96:VsEchlve/zVesEEYXI9w96TlRKmVnC1l:Vs9XvqQRXI9w96RRKmV
                                        MD5:B94184AF9EA279FFE27D8722B8EAF721
                                        SHA1:6DFB73B68A84DEF492BCA4308BD72F324F134B57
                                        SHA-256:F1E10102B688FD4D8FAF9029DAF38F9F7B6FFE00661CA3977AEFE3CB185BDD5B
                                        SHA-512:B986BAB6C7337A162EB7320686251C5E82DB311FA50757C3BF16CD31A195A6A8CE542AFA3611224886707110C2D54022263D6EDE9680C77A34B2D7E0128B2615
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.D.......D..v.L.+.jw..iZ.D..v.L.+.jw..iZ.D...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Y.thA..6...I.......N...^...............x.F.a..C.....M..........f........................................I.qk..B.....LZ.............Y.thA..6...I............Y.thA..6...I.............D.......D.......D...........................................D.j.....D.T.]...D.......D...B...D.H.....D...B...D...>.).D...J...................;........4...4...4.."...............D...D...D...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........D.......D.....#.D.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.102101253846096
                                        Encrypted:false
                                        SSDEEP:48:E0BsI7Zbw1k071Qt8yE2CH8XAB9rzLTo4rdSrimmIRdXH2gw1Ggtr1Dx:9srv7a1E2RXg9rPT1RKp0D
                                        MD5:1CAFE32A9F9085A00EBEF9BDB8FD2229
                                        SHA1:EF45DA0276497529EAE82575E7A63867B365CBEE
                                        SHA-256:2789E8279F68EAF43D89EAFC9D7DB6F248572BB4C902D53C91DECDAC2B4DEB5C
                                        SHA-512:10A5CF9E642EF8DCBC9BB5EA03DE821E93553730D284A1344C66B79607B6E782535D34DF03DE61E8BADE2DE284D929C56067EE7BC3D82136A88DA94652CEF5DC
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZq.......q..i.>....b8ED.q..i.>....b8ED.q....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................u,....|..V.......N...^...............i.....uA..Z...].........f........................................I.qk..B.....LZ...............u,....|..V..............u,....|..V............q.......q.......q...........................................q..j....q..T.]..q.......q...B..q..H....q....B..q....>.)q....J...................;........4...4...4.."..............q...q...q....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........q.......q......#q..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.095832645166951
                                        Encrypted:false
                                        SSDEEP:48:Fs8XiINGSQNtL0KFEG9CCZjXo9LTOGTomrdSr1IHdXFWNKuZ:FsLINGRN1EiTXo9tT3RK+gJ
                                        MD5:D3422FC7561E29FA2AC7AD1E63D4D32D
                                        SHA1:6645EA4B6D486B8560ED4FCFCF5D2A87094F6D4E
                                        SHA-256:98F4D5E7C1DD7DDAE029D55FD442657CC0D8D697A399C3357A30FE2FE53DF448
                                        SHA-512:329801C1F124CD1C83F5045E04DA637F081A97C58A9A2876816D2C186E46F510041F342185AAF19E8504826B8FD09392A8499C2090C776EA17603AA747F6A1BF
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZA.J.....A.J-.....73....A.J-.....73....A.J..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|c.9?...w...._.....N...^...............0..]m.J.A.............f........................................I.qk..B.....LZ.............|c.9?...w...._..........|c.9?...w...._..........A.J.....A.J.....A.J.........................................A.Jj....A.JT.]..A.J.....A.J..B..A.JH....A.J..B..A.J..>.)A.J..J...................;........4...4...4.."..............A.J.A.J.A.J..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........A.J.....A.J....#A.J............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.096451769598394
                                        Encrypted:false
                                        SSDEEP:48:ZsMf6OBAYgGQ5tQuEnpDCZPSX09YI5x8TovrdSrFIT4dXcW0a0C5:ZsIHgGQ51E1xX09YI4TmRKZ6W5
                                        MD5:B5EB8EA564FE36742D88AD896F8DBB5C
                                        SHA1:EABB580D119744FAC1CBE2EFDF95101E07778D8E
                                        SHA-256:E33DEF31240CDEF5FD09ED9209B8ABC9E2B47D2B753E687F8960E63B1FC50C38
                                        SHA-512:E119F18978BD6539BA9249346D71FED8D8D8C05DAEA4365E2D3DA5B34BB854F24CCBDCA3898A07EF8BB7D5FEAA6C09BDB2D0605AFC91F08815CDA984666092F9
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.P2......P2Y.[g.........P2Y.[g.........P2..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............e.$....'.........N...^...............0....0.C.....j+.........f........................................I.qk..B.....LZ..............e.$....'...............e.$....'...............P2......P2......P2..........................................P2j.....P2T.]...P2......P2..B...P2H.....P2..B...P2..>.).P2..J...................;........4...4...4.."...............P2..P2..P2..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........P2......P2....#.P2............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.128300819256392
                                        Encrypted:false
                                        SSDEEP:48:Zs6qQNNnP1T2DS3FNtDM6EmCKZXI9WTMyToLrdSr0IZKdX4hAyLCQyMGTN:ZsydT2DS3LdnEm3XI9mvTaRKjKEk
                                        MD5:164B38B13DD945980D0A85B4F450A8A8
                                        SHA1:7B436EA21D1173E9EF8AAD366A0C4A1340CE9098
                                        SHA-256:DDB5699B7A26DD0890F650920E4EA2075EC913430226A752CEBDC1546E306C69
                                        SHA-512:699A05776EBDA8EEC40C7F29987B73E529C5CE4D2FF47A2233E44A3B937A3307A03F6421AFD7B4ACAFD7E2B12F99CE46B560759F1AF11A54F129702ED499D613
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.k.......k...u....P/(...k...u....P/(...k...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............../...L..8A.Rn.......N...^................/.^j..D.t.....4........f........................................I.qk..B.....LZ............./...L..8A.Rn............/...L..8A.Rn.............k.......k.......k...........................................k.j.....k.T.]...k.......k..B...k.H.....k...B...k...>.).k...J...................;........4...4...4.."...............k...k...k...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........k.......k.....#.k.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.128042689297395
                                        Encrypted:false
                                        SSDEEP:48:KcsfflBcL/Ot6zsElCC5gX09am/ODToIrdSr+IFdXTl0Q0GGft:KcscL/O1ElCbX09UTNRK1g
                                        MD5:1FF7810DBD0BEF2CA4622C34D30ED3D2
                                        SHA1:866FEE4945F8492438E653074E737CA5AABDFB0D
                                        SHA-256:960A4961C9BDAB0F19FD3343E59C26A71DD198E7968EBD5C455C2D37BA3BCB7B
                                        SHA-512:26BA80F32646636D78D224128825A400CCEEEFB74CA1015D8AFEA34EF3B6897B403679569F4C2D1D85B30B4F1CD8B2D49A1F6EC641A2E709C5B0E8C8D53C07B1
                                        Malicious:false
                                        Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ].......].......gP5F..].......gP5F..]....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............V..b..|.4..&.....N...^.................;...8O...;<..........f........................................I.qk..B.....LZ..............V..b..|.4..&...........V..b..|.4..&..........].......].......]...........................................]..j....]..T.]..].......]...B..]..H....]....B..]....>.)]....J...................;........4...4...4.."..............]...]...]....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........].......]......#]..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.102335939821532
                                        Encrypted:false
                                        SSDEEP:48:KXAhsyLclbZWfUEte0E6tiC+GPXA19DaqTonrdSrDIha7dXozLt0Q4wWPHR:KEsHH+hlE6c7IXA19DdTORKTQgXH
                                        MD5:8A8EE06908F67C8011B06D1D903A5C4F
                                        SHA1:458E90BF9B26ED6EF95EAF6742C2A4A08B08D907
                                        SHA-256:771563303A16DB7A8D45842F8ADE2D937E9C16EA24C1D703497026AA9B34DA9C
                                        SHA-512:9C96E109AA2A099A918BDE8CD82CF3468FB7E19A7B7B7290D1C1B413D4AE44F506CECF696FE60A89651B628BD861997EBCB0DDE4AEB6CEBB7323BEC6F8FCAE24
                                        Malicious:false
                                        Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ.<.......<....B.-e.y^E...<....B.-e.y^E...<...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............@/p....^..Ik5.....N...^................z..:..E.B..$...........f........................................I.qk..B.....LZ..............@/p....^..Ik5...........@/p....^..Ik5...........<.......<.......<...........................................<.j.....<.T.]...<.......<...B...<.H.....<...B...<...>.).<...J...................;........4...4...4.."...............<...<...<...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........<.......<.....#.<.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.143951692653315
                                        Encrypted:false
                                        SSDEEP:48:QuesHNYEcS8IBKtbfTqEIWCCY6Xs9HcBToWrdSreI/dXB35SRil5r5l:QTs/BKdqEPhXs9HQTvRKvX
                                        MD5:76A32175D81D3A0FDBEF46E4757A847E
                                        SHA1:19179442A9EDAC50B598A3F7E5F2DAB470E60398
                                        SHA-256:797E25760AC4D367951CFBC87E09817DCF6223A42D056516A61CF6233C5D5F6F
                                        SHA-512:51CF42BB04F84886774AEA57C4FDB01BB371EF8B1F12ACDD619C5DBE57EFF1246F258AACE50F3FFB7635D412989845DC9893BDD5BFDCA7D09A7EFF903A3747AD
                                        Malicious:false
                                        Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZN.X.....N.X.t.W......w..N.X.t.W......w..N.X..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............f]...\...%.lQ.r.....N...^...............q...N=.G...b[Ccb........f........................................I.qk..B.....LZ............f]...\...%.lQ.r.........f]...\...%.lQ.r..........N.X.....N.X.....N.X.........................................N.Xj....N.XT.]..N.X.....N.X..B..N.XH....N.X..B..N.X..>.)N.X..J...................;........4...4...4.."..............N.X.N.X.N.X..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........N.X.....N.X....#N.X............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.126236507055654
                                        Encrypted:false
                                        SSDEEP:96:5s44DjH0jJEVEXM9ETkRKezfiGrEfOVu:5sfH0qmXM9EIRKe
                                        MD5:D7FDFC7D5CE062534EFA188F9B99052D
                                        SHA1:4C3AFA5D004BDEB65E306C18D4FCDC8F79CAA096
                                        SHA-256:734ADF22214154B3FDF6DB9EC542CC8F8C0CCDB89B5786967AC8C44357022092
                                        SHA-512:ADBF5356AED12C85CC89C9F42939A90AD0535563916E13B500DD19EE6468034435C8B7DBF1F464FD0E29E08C72061A7176A520CA74D6DDB6C9FF7473E21DF2FF
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.>.......>...HF.>q.......>...HF.>q.......>...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............f..v}....Lb{eQ......N...^...............=uX.FV.M..|..n&]........f........................................I.qk..B.....LZ............f..v}....Lb{eQ..........f..v}....Lb{eQ............>.......>.......>...........................................>.j.....>.T.]...>.......>...B...>.H.....>...B...>...>.).>...J...................;........4...4...4.."...............>...>...>...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........>.......>.....#.>.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.135071304220647
                                        Encrypted:false
                                        SSDEEP:48:uSss/pfeC7ftNNDU6dEsWCjt4X09jh3mYP6ToJxrdSr9IEdXoqMud:9sAeC7fl9dEsWMyX09066TeRK53
                                        MD5:6EA5EEA7274E0A0B897E13B7AF165458
                                        SHA1:6727D8EBFA41DEE4433C9BD0B56E3A7925A1F959
                                        SHA-256:AACCEDD6F346075F78FCE945E3F8D60BF70DA3791518D01FE0890F352CF01507
                                        SHA-512:29510E99AFAF85A0EA9EA8FB4B3CD1FF608B7EED061228B042E2E9F2448C1A045C58D6EBE070321FBCBB53194ECEB7238FA54657125CFBF321E9AD8A291E52A5
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.............,}..:...H.......,}..:...H.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............8.X.....l.+........N...^.................|.8SlC..T".X........f........................................I.qk..B.....LZ............8.X.....l.+............8.X.....l.+............................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.11017319039304
                                        Encrypted:false
                                        SSDEEP:48:3psydC7YifSLqtP4vqER35uCAZ0XM98ZSi4JTo+rdSrGIndXJKl2kZV:Zs4CYifSLqMqER3cqXM98z8T3RKPkZ
                                        MD5:49505EAE2FCAD585AD89C36CE4BE38B5
                                        SHA1:270A369877B696B37DEE5903E2485E82D1593518
                                        SHA-256:2CF8EF823A7FBC91838D367D7A59F2C6948707F47CEB1A539A5CF66471DBEA57
                                        SHA-512:50173C0DF8F11B995C596B56799F6012AF2FB850EF1CCFFA094C89196EE029435BE698A1EB23C7BF1C82C9F95C2290DE8C4845DED12D171D99491F4A0C462D59
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ>S......>S.c.z....T^..Qk>S.c.z....T^..Qk>S...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............l...J;. C._Y.......N...^...............M8.l.dcJ..C`.|i.........f........................................I.qk..B.....LZ............l...J;. C._Y...........l...J;. C._Y............>S......>S......>S..........................................>S.j....>S.T.]..>S......>S...B..>S.H....>S...B..>S...>.)>S...J...................;........4...4...4.."..............>S..>S..>S...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........>S......>S.....#>S.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.119705309370674
                                        Encrypted:false
                                        SSDEEP:48:E05sdUs2K0ds3m0tHd0M3GSENAIWCp2h9XY9ZlvToGxrdSrsIIR7dXDGV0VVlvSZ:E05s8s3rD731ENA1s2TXY9XTBRKs32
                                        MD5:F79C36B5806BF4F3647C67ACBC35A1E6
                                        SHA1:160E0DEB8B653C023E22BBFB24A86C50AC351A3B
                                        SHA-256:902E87F4428660350DC0E95C5A2E142C34E3281157E70754706667781E02C2E5
                                        SHA-512:E0BEC816A16E84AB6AC4DDF5646FF44E259F5ADD72903B406ED519580F6D33A4EF11135EE9AC81DB0A38528412920580B33A5B1E6EC843E53342410396D33942
                                        Malicious:false
                                        Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.R.......R....W.-:.).d...R....W.-:.).d...R...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............F..Kg.......'......N...^...................1.9L....Ii9.........f........................................I.qk..B.....LZ.............F..Kg.......'...........F..Kg.......'............R.......R.......R...........................................R.j.....R.T.]...R.......R..B...R.H.....R...B...R...>.).R...J...................;........4...4...4.."...............R...R...R...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........R.......R.....#.R.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.153247531483543
                                        Encrypted:false
                                        SSDEEP:48:K4BskuAR09ztZ8MEyrCQmXk9SBTo90rdSrVI3dXBypy0QR97qLqpObIe:KQsP9z1EyrWXk9iT+0RK+xI
                                        MD5:A0DFCC464CDFAE1C0CA73091062383B0
                                        SHA1:554ADF64CC30351F5C6CEDA327C0B3E5A4FB6C71
                                        SHA-256:A7B5383DF8CEFA59F4727C49AB8B237254B42203762A7D5E8817ABBB21E36814
                                        SHA-512:FFEFEBEDE6D05EF54BCCDEF62B3278A7D1FA9DBFF7987E92C2101D5472CF6EDBBFEB66BE1768E20E32FEDD86DD870381F780D6F562A12528738FF7A7810267A8
                                        Malicious:false
                                        Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZS!......S!...Z.......|1S!...Z.......|1S!...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............]*.2~.c.......*.....N...^................<.uj.A.X-.l.b.........f........................................I.qk..B.....LZ............]*.2~.c.......*.........]*.2~.c.......*..........S!......S!......S!..........................................S!.j....S!.T.]..S!......S!...B..S!.H....S!...B..S!...>.)S!...J...................;........4...4...4.."..............S!..S!..S!...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........S!......S!.....#S!.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.152502327934496
                                        Encrypted:false
                                        SSDEEP:96:kmsvD4MYa/F+7yEXlXC9IfTZxRK+hLyyYbWEjT5FgLZ0ab:nsr5/FC1XC9IFxRK+o
                                        MD5:D0C54719B78B0D117131DC1FCA4F90B5
                                        SHA1:19BD09EE70F5F5B459480E85884A4AFD72AD92D9
                                        SHA-256:FF39E4B0A0F784446A68EA58C686972252D36BD9629687B288791768D8EC1441
                                        SHA-512:21D93764BEB981275F5315AC2CC9E4ED4CD747734411655AD6193B722542199ADFF81A4C7993A5C905D9F65DEF11D79C6AECDF007047B9D41064BA04ED36516B
                                        Malicious:false
                                        Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZ."o......"o%$.`...q....."o%$.`...q....."o..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............u].[...6.l.........N...^...............{..&r4.F....8..&........f........................................I.qk..B.....LZ............u].[...6.l.............u].[...6.l..............."o......"o......"o.........................................."oj....."oT.]..."o......"o..B..."oH....."o..B..."o..>.)."o..J...................;........4...4...4.."..............."o.."o.."o..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........."o......"o....#."o............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):3.591485610750949
                                        Encrypted:false
                                        SSDEEP:96:teo1u7fGypoYo9LCpEqBdnFQYEG4IYwEWNKZT2Gmic4IdtAH4IQZ31:0o8Gwto9VqBdFQFOYNDFU/AX01
                                        MD5:48F83D100EAFC33C3A277F6052F1D9D5
                                        SHA1:2874B4DB5C9C988F9D093FE2D7CAB7F5FC9B55F8
                                        SHA-256:5EECA78ADACEC8D54F4D5E94C2120B8BB4318D2E9687D5561E5EFDE458E41BD9
                                        SHA-512:4D610C967043B5B26516FCB971B64AEFFB1A75E838DEB5465E98191D0096B1A1C5BF65EC4216A869018F34710047762254C171945309336A124DFA68BC51DB10
                                        Malicious:false
                                        Preview:\...L...............................................................................................?...................................................\...L...............,............................%.......%.{_J.......|p..4......4..I..3.Ke...i.sq..........vi.s.X...\..-./...$.X....4..I..3.Ke....4...........4......4................................................AJ@.....AJ@...L..T.c..Ci:b.....i:b.jsB...$T...2... ...^...@....................%...4.AJ@.i.s.=...C...x..........T)....4......4X.....4..G...4......4.."...x.T)...Dp.T.r......X.......i.s..c..,0...e...B4.$...........GP..A..}.....J....................=......=.Y_|tH..I..XE>X.......X..S...B..~P....C..G........c..C...%.{_J.......|p..%..i:b.jsB...$T..0i:b.....>...........0...X...\..-./...$..4..I..3.Ke...i:b.jsB...$T.............0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):4.5903504526276855
                                        Encrypted:false
                                        SSDEEP:384:Ml6vRw4o1L4oYrzTfHjIcWRtDHYBCuAu7iAqHjnw77K2jKNMbOC1RuQLre6o/:Ml6vO4o1L4oYrzTfDIcWRZHYIZuGAqHD
                                        MD5:0BE81DB58519B950E823B380D0138826
                                        SHA1:19229331380157D8E735F3827A7C91678CC7F5F6
                                        SHA-256:CD5CAE0778BC20AEACED24B9E66DA364FD30E85854107856D9AD531863C8A4AF
                                        SHA-512:5554252BE1949415B3E4F2BEF455C6A3175520AA995E4E77C2135BF4E7FBE7768303A704552F6D45876D4E4D60E2FD27B14E28389360A8F3CA5E07AC47CB0A2B
                                        Malicious:false
                                        Preview:....>...........v.......P@..` ...I..........>...T.......v.......PH..` ...H..................................................................................>...`.......v........H..` ...I...............I.......I.qk..B.....LZL:f.....L:fq....3.G.9 .N....%C.+.M...i.N...L:fq....3.G.9 .L:f..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'...............z.(/:...6}......N...^...............m(.PU.jK..'.|R[.............J....................................I.qk..B.....LZ..............z.(/:...6}...................................L:f.....L:f.....L:f.........................................L:fj....L:fT.<..L:f.....L:f..S..L:fH.`..L:f....&L:f....'L:f..8......L:f3L:f8L:f..z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                        Category:dropped
                                        Size (bytes):22203
                                        Entropy (8bit):6.977175130747846
                                        Encrypted:false
                                        SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                        MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                        SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                        SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                        SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):3.961484477346544
                                        Encrypted:false
                                        SSDEEP:96:40sESvUpdU9X7VaTR/EQyvyDeOdWEwn992kkXXSPkk/y7mG:40sESvUpdMX5aTR/EYlpw992RXXMROm
                                        MD5:9A051E0549931F1A8D7DF1048C37B766
                                        SHA1:5D3BFADC21115E6FF8EA3CEA830CF941F1689B62
                                        SHA-256:9D49487640E0A4108C53E2E563854FA6D276B904E540A85F2A3883998F448294
                                        SHA-512:8563D11F1C16E2AAB945D9AD14D4E0E9FA7AD2BE93D10E17DD5474FD562EDD43BF8BE0BA43BDA2172AD8BFF934E902B8860C08AA090C9093DCE3131F45234775
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZK...)...K...b......-5?.K...b......-5?.K....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............O..]$..?..ZC.].....N...^..................wZ?K.T3..|.".................................................I.qk..B.....LZ.............O..]$..?..ZC.]..........O..]$..?..ZC.]..........K.......K.......K...........................................K..j.h..K..T)...K.......K...L..K..H.]..K.......K....H..K....}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i..................K...K...K....z...y.. x.. ...........$........4...!..7!..7...............K..:K..FK..GK....z...y.. x.. ...........$..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):52945
                                        Entropy (8bit):7.6490972666456765
                                        Encrypted:false
                                        SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                        MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                        SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                        SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                        SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.5397459835840572
                                        Encrypted:false
                                        SSDEEP:192:TSsB9jg/11GcoHHPH5HwIX9p0HMGH6RtMvG/HXzHKUIm10AdAHm79cH5HHNsHVaS:7wec8H/pwSHwH6RtMoLj1zdkmpopH6/X
                                        MD5:714EFCC0224A1236E202C9F78A67880F
                                        SHA1:2A227289E0E39D9B6667C04F7A4F30AC91D8DE73
                                        SHA-256:C3C1DDF9A1FD3F5F2F3B682C0D9F5C4713873A640F465F2FE6779BA8E1AC3266
                                        SHA-512:08219857FF294A4D01FB7C09B1CEA3228D0D8C13736622922DE92E223BD02727254F9AB16BF5665433F489FE7AFA8CB6402A06DD9196CA9E9C925CDCBEA47795
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZWF..9...WF.IJ:A...}8f1.WF.IJ:A...}8f1.WF...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i..FV...?%.].......N...^..................M..FN..M.9K..............................................r....I.qk..B.....LZ............i..FV...?%.]...........i..FV...?%.]............WF......WF......WF..........................................WF.j....WF.T.H..WF......WF...\..WF.H....WF...3..WF...O..WF...........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................WF..WF..WF...z...y.. x.. ...........$........4...!..7!..7...............WF.:WF.FWF...z...y.. x.. ...........$......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):25622
                                        Entropy (8bit):7.058784902089801
                                        Encrypted:false
                                        SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                        MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                        SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                        SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                        SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):3.1796662043353847
                                        Encrypted:false
                                        SSDEEP:384:Oo8d5R1IeO+ci3yJfOJYqCPkeRSPXOsrhzrmVKu+FD7:Oo8dP1IwckyJf3qykeREesrhzcKuWD7
                                        MD5:F1BC54427B7022347AC629B5A316FFEB
                                        SHA1:5A930A34FD3A7557208B94082674B6CC750CA757
                                        SHA-256:F8646D6B6A0C8E082973B305D2691E605141F78FDEA4E810F517DEE1650643F8
                                        SHA-512:CABA736E8A90C9C28851A13A74F577815DBB9D2F44CE6A136F917CE6A9282A9BE3B78C9647E8514E6320F1C390B42D5057ED46E6B25603B940D478B4FFC55D66
                                        Malicious:false
                                        Preview:2...>...........v.......0 .../......P...j.9.&V..+..........P...j.9.&V..+.......I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8...................]a..T...]a...H..6.h;..,..I.......I.qk..B.....LZ]a...H..6.h;..,.]a...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............P...j.9.&V..+......N...^...............P..<V..J.h..............................P...j.9.&V..+..........P..<V..J.h..................P...j.9.&V..+...................................]a......]a......]a..........................................]a.j.e..]a.T....]a......]a......]a...a..]a......]a......]a. .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................]a...z... ..$..............
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):15740
                                        Entropy (8bit):6.0674556182683945
                                        Encrypted:false
                                        SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                        MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                        SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                        SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                        SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.790301025075798
                                        Encrypted:false
                                        SSDEEP:192:hsyRy/0reDQWHaXworrrRtshyTWn2ReOSd+4XpdJ9d1MScT6w:2K00re7Uw2rrRtUyyn2oHXpdTd1M5
                                        MD5:9121D78500859A6C4B476D596591E5FA
                                        SHA1:9E66AA004DF7C6121E22BDED2C4CC925BE7EEE00
                                        SHA-256:B5C3444F9D8093B728A94944033597D971B2C4268295BF577F4584ECFD7C8C94
                                        SHA-512:750E820574773236D1AE14305FA1AEEA4FF7627C59CF14FD08186237E672541612A69D82EBCA3730D1637E5E5800DE84178B33826DE82D5F7335B6B0C75E924F
                                        Malicious:false
                                        Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ..g.9.....g.!0..!....)J...g.!0..!....)J...g..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'....................9.y/A.......N...^................G`...O..a......................................................I.qk..B.....LZ...................9.y/A......................................g.......g.......g...........................................gj......gT.Q....g.......g..n....gH......g..9....g..V....g..........Z4...........................................4../4......p...............C.a.l.i.b.r.i....................g...g...g..z...y.. x.. ...........$........4...!..7!..7..............'..g%..g...g..z...,4. ...........$>........4
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):55804
                                        Entropy (8bit):7.433623355028275
                                        Encrypted:false
                                        SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                        MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                        SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                        SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                        SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):4.721110064121988
                                        Encrypted:false
                                        SSDEEP:192:FAsAcBNafG4BZQJN4jPwqoGcAnG8Hb3/SXzoOrP/RtgMYjBPZrGhHs9uC:bA8NafG4zQQwqoG/9bPsRRtRYVPdGhH6
                                        MD5:143CC0A511E9EB0E84165CCC97DE2975
                                        SHA1:3D648008718D0C525D33006CDC67526D46E53072
                                        SHA-256:B4BA53E2F9FED395356986355D0070E0CAAEF03B90D4CF0D929B7791D66D8B59
                                        SHA-512:B0685F5A5C2A403B7D827468B1EFC7D6D8D58ADBE7699C0ED410F7B4841441843F1E125A1DC831BAE42F5E967720CE139DA43C4F00CA40E38005BD56B7B9D80F
                                        Malicious:false
                                        Preview:....>.......^...v...2...0 ...+......>...........v...z...@....*..............................................................................................................................................O.........4_....0.I.......I.qk..B.....L.......4_....0.....I.qk..B.....LZ.I..=."z...O...i<F..=."...........I.......I...................................................I.t.....I................................................................4..'...'.............T.w...B...$.Y......N...^..................JE.M......V.................................................I.qk..B.....LZ............T.w...B...$.Y..................................................................................................j.N.....T)................f............. .<............. .......'...8.....z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):41893
                                        Entropy (8bit):7.52654558351485
                                        Encrypted:false
                                        SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                        MD5:F25427EFECFEE786D5A9F630726DD140
                                        SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                        SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                        SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):4.5551599435902075
                                        Encrypted:false
                                        SSDEEP:192:Hsl5oDjmKMGHTjXtF9R5U/iDoSsdUhGvUlST4aPCNeH2sX067AS/oQEGRt0buOFi:MMlHTjXtH8/iDyUheFPCNOtjnRtUFhRC
                                        MD5:3748722FFBD9C967F8CB262ECE7B0440
                                        SHA1:0FC3DDA832093019EBA176079E7E07DE3D28D733
                                        SHA-256:706CE99AD3EC4F8B8B3D2BD495395B0AC5B563130048256597EAD49B7166AEAD
                                        SHA-512:159126547DCD51B9F2EBC134D42A6CC396B6CD79CA60DD566765D146F0490779B3F259B6581538CBD8EE52A6BAB03312644FC750BED76B070EC42D03E2C0A29A
                                        Malicious:false
                                        Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*...........................................................................................................................................I.......I.qk..B.....LZ8...G...8........WpN....8........WpN....8....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............=2>_..............N...^...............:..6. .J.....n^........V...x....................................I.qk..B.....LZ.............=2>_...........................................8.......8.......8...........................................8..j.A..8..T....8.......8....r..8.......8.. .7..8.......8.. .........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................8...8...8....z...y.. x.. ...........$........4...!..7!..7...............8..;8...8....z...y.. x.. ...........$......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):14177
                                        Entropy (8bit):5.705782002886174
                                        Encrypted:false
                                        SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                        MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                        SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                        SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                        SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):49152
                                        Entropy (8bit):4.66650848512984
                                        Encrypted:false
                                        SSDEEP:768:adN7bCNwj++f/4F763AvuYaZg3SBGk+x/C2Y:KPCay+HE7eZg3SBGk+Q
                                        MD5:73D7AA0A07394D92E2ABE119B9CBCDF5
                                        SHA1:FE9FC82833A34CA0E81152A022BE5CB82755842D
                                        SHA-256:C0EC941D9CC37BADA78579A8190A01F974A55D8B65B85986380D8A9D790EA411
                                        SHA-512:E842EEF28FD690F8DF5BDE4C78CF34441BEA7DA03192F576AE2A031E62E8338DF6833887D608176D8C67474762E292796551454E31FF962EFAE612C317AE0F91
                                        Malicious:false
                                        Preview:t........&......v%..2&....... ..8@.. `.........t........%......v%..N&..(.... ..8@.. `..................................................................t........%......v%........... ..8@.. `..........cU......cU..VT......~..............8.@O.c.F.Sh...N.F...0m..x............R..p".?...............D.h................0.......0.....................................................T....2..T.......T....C..T.......T.Y...V.T.....Y T"[.....T#E...........0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.........C.......C...7..O.c."...............7tL.l...{.'2...J...j...R...................cU..........2...........d........................c..,0...e...B4.$........{p.....G...^...?@kO...................:[4.....:[4.......}.\....!B......!B.-3.I..........x..I.:....~D......V..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.375673900828685
                                        Encrypted:false
                                        SSDEEP:48:LQsyy7EUXADxXYtWp9/E8oPXv9iuzcXrdhSrYRtXZI9ANkV:0sZBQDxoQFE8SXv9BziRA4j+
                                        MD5:95F9BFA1255D2811A47793A0E0A68794
                                        SHA1:4C8800C67071F8501A5BE3303501AB9A70D718A1
                                        SHA-256:7B27D4B9643EDAC65CFEF138F195A43CECA231C8028C5174703530AB0FCC6096
                                        SHA-512:31B50A81B5321AF5C726DCA118430B39673BC07A9DD3E5DD48F2D08C496DAAE48447DB02F31BFA91726852D1A98E5FAF3A3D235CB81458453F97562D34D39B16
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.R.......R.hu....o...-..R.hu....o...-..R...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'....................h....as....N...^..................A.~.C.~LT7.97........f........................................I.qk..B.....LZ...................h....as...............h....as..........R.......R.......R...........................................R.j.....R.T.]...R.......R...B...R.H.....R...B...R...>.).R...J...................;........4...4...4.."...............R...R...R...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........R.......R.....#.R.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                        Category:dropped
                                        Size (bytes):12654
                                        Entropy (8bit):7.745439197485533
                                        Encrypted:false
                                        SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                        MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                        SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                        SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                        SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.312536122767789
                                        Encrypted:false
                                        SSDEEP:96:UsR3txD2pNEpkXM9x3YRAGXeGWvperTz:UsFH2IpkXM9x3YRAGXebvpefz
                                        MD5:27463C768D62717F69618A5F788E433F
                                        SHA1:71B15B56B101AB4668EAE8B31BE19E3488504C74
                                        SHA-256:EB392D78AEFBA77913DB0C1802960E1BF75F43B78717179EF83A351245DE4078
                                        SHA-512:D62E26E48A630946ADF9254358FF6B2DA20E2EECADA9F76E8BD8D4062CEFA830EAEDF0AE38EE6FF1004845FA7D942C9C815CD882D3FB8FE974666880E49B00ED
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.M'......M'.A9.....p.Z..M'.A9.....p.Z..M'..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............UD...4_.W.+......N...^.................;zxCyC....j...........f........................................I.qk..B.....LZ..............UD...4_.W.+............UD...4_.W.+............M'......M'......M'..........................................M'j.....M'T.]...M'......M'..B...M'H.....M'..B...M'..>.).M'..J...................;........4...4...4.."...............M'..M'..M'..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........M'......M'....#.M'............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                        Category:dropped
                                        Size (bytes):2695
                                        Entropy (8bit):7.434963358385164
                                        Encrypted:false
                                        SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                        MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                        SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                        SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                        SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.330198273553403
                                        Encrypted:false
                                        SSDEEP:96:Mszd6MbaecUjE/FKXtu9B7q7RACq/fzdOd9dpdXdOdBYid5d:MsZ6Ma//FKXw9B7q7RA7xAT/tA3v
                                        MD5:6EE84858732ACEC311D377FB7A258A11
                                        SHA1:E047EAA4A4AA5AF1B36D6FB652F49EC93CB0388D
                                        SHA-256:C44FE7BFA38872A033EC0E4BAFDDA7715F8457A48B13F047BA7E5AA9F9AFDEDB
                                        SHA-512:FAEBB84C3542EECC7C09132806094EB273B60804D6FE728136CAB5DCF9EB669B5FFF045C40B9986F2AF99FE1CF5F1D6AC819E990254F14E0B7FF85F6B7437A95
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZZx......Zx..P.@...S.gV.oZx..P.@...S.gV.oZx...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............$Y....3F.........N...^...............k.}.b.uH...?.5.?........f........................................I.qk..B.....LZ..............$Y....3F...............$Y....3F..............Zx......Zx......Zx..........................................Zx.j....Zx.T.]..Zx......Zx...B..Zx.H....Zx...B..Zx...>.)Zx...J...................;........4...4...4.."..............Zx..Zx..Zx...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........Zx......Zx.....#Zx.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                        Category:dropped
                                        Size (bytes):11040
                                        Entropy (8bit):7.929583162638891
                                        Encrypted:false
                                        SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                        MD5:02775A1E41CF53AC771D820003903913
                                        SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                        SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                        SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.474241737573426
                                        Encrypted:false
                                        SSDEEP:48:isRZEDslp3z9ltUEP3F7dXi9UXnLq6c4ErdHrbwtXRP7k7zsZn:isIsl9zbWEP3FZXi9UXnLq6ERLMms
                                        MD5:517BD5D7A807282CB40DDF3D770F7E17
                                        SHA1:ED383AA862C74484ABB56DC25149FD0D9B902E0A
                                        SHA-256:8170B14086DD17C41362E5A7F81EECCB1F25750007C7AA773D1A8395BD46845F
                                        SHA-512:B6A07E46B617243B5057926FFBF67C0E12EDFCDFC1C9FA91B4672DB36A300BA64B738597FCB2652C12085676F1221490212DB6552D7C62BF40F2915D40C40E05
                                        Malicious:false
                                        Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZU,......U,.[@....I....O.U,.[@....I....O.U,...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............@.".ZG..:X.m........N...^...............3.jU.*.G..8.vX.B........Z................................... ....I.qk..B.....LZ............@.".ZG..:X.m............@.".ZG..:X.m.............U,......U,......U,..........................................U,.j....U,.T%c..U,......U,...G..U,...H..U,...>..U,......U,. .3...................;........4...4...4.."..............U,..U,..U,...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........U,......U,.....#U,.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                        Category:dropped
                                        Size (bytes):2268
                                        Entropy (8bit):7.384274251000273
                                        Encrypted:false
                                        SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                        MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                        SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                        SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                        SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                        Category:dropped
                                        Size (bytes):784
                                        Entropy (8bit):6.962539208465222
                                        Encrypted:false
                                        SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                        MD5:14105A831FE32590E52C2E2E41879624
                                        SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                        SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                        SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):2.7104742166085263
                                        Encrypted:false
                                        SSDEEP:96:5s5WgHVkBVs7SGyWEHsUXMU93QMnRQ5IKDK:5s5WgC3GSnHsUXMU9AMnRCPD
                                        MD5:F58FADFCD990405688F3E4A38A455841
                                        SHA1:CA8AFB7167359E18B9924F51FEE7A86050A99688
                                        SHA-256:F29E4E4C653085522EE56F6EA4C27E7B9E8A2D06F20843B01DC0D27A30EA2C7B
                                        SHA-512:BABB856F6EB340F6CC630574CE6291EBD60E081D9441D0872F215DD6F5590A630A16A7A83E509C4A9386200E5AC2C42CCA092D6C402BBFDDB4D4AE1F7C05A0C4
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZb.......b..]~#..: |<6T..b..]~#..: |<6T..b....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............w..P..(..v.C.....N...^................x.%..FA.U4..>a6............................................^....I.qk..B.....LZ.............w..P..(..v.C..........w..P..(..v.C..........b.......b.......b...........................................b..j....b..T.l..b.......b....Q..b....Q..b....>..b.......b.. .3...................;........4...4...4.."..............b...b...b....z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........b.......b......#b..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                        Category:dropped
                                        Size (bytes):3009
                                        Entropy (8bit):7.493528353751471
                                        Encrypted:false
                                        SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                        MD5:D9BD80D40B458EDB2A318F639561579A
                                        SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                        SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                        SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                        Category:dropped
                                        Size (bytes):2266
                                        Entropy (8bit):5.563021222358941
                                        Encrypted:false
                                        SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                        MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                        SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                        SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                        SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.323826890459674
                                        Encrypted:false
                                        SSDEEP:48:YuCsV1KN215ityVXEgIWXBW9SRo1rdQqryz+2BXBuylt4JqB:YVsp15iIXEQX89SRERQyGyctAq
                                        MD5:43DF3C5D42C9C1A715D775C1A26CCCCB
                                        SHA1:0B656D9A94C85749E8FEA1145B773BD5AEDA07F1
                                        SHA-256:8860BB6801CDC56473AD249776C6EFCB9F2BF4A1330344189EBC8F5008C5A3B7
                                        SHA-512:B9F39BBF75F5F66FF567E693F618127B0F572DE004CDCE0E3ED2A133825801A3D2D9764C0C8C3215FBA5C4BE075C4C5D242554399EFC5AFD04D48321A95588C8
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..........q...-...u^MZ...q...-...u^MZ....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................R....o...)D....N...^...............S..gs..L..=..5.........f........................................I.qk..B.....LZ.................R....o...)D.............R....o...)D....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):99293
                                        Entropy (8bit):7.9690121496708555
                                        Encrypted:false
                                        SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                        MD5:EA45266A770EEA27A24A5BB3BE688B14
                                        SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                        SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                        SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                        Malicious:false
                                        Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.350183508314882
                                        Encrypted:false
                                        SSDEEP:48:YuF5Z5Gs77Zt+tNPohEVpyKXNPu90ze2oNrdQqr2vdBXpJU1Sx:YKHGs5t+3PAEP9XNPu90ze2cRQyIdAS
                                        MD5:FC421513F69191F649276DD320E1EC05
                                        SHA1:92B28BFA524B512DD24232F36EDF5AE7FDE1DE1E
                                        SHA-256:83D56012BA887E565126B2AB86E3285D2B9AF59122D292C0F792D2C2C00BB646
                                        SHA-512:9790D7D4B3E1B5272D7E0A0A842859FC193CB2E18B5B59CCEB020FEBE99A8B8A495C36F26596938CED690F88815631A5F0029C50C53CC1602FA769C6436F1990
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZc.......c....#..4s......c....#..4s......c....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................../. ,Q....N....N...^................1p...>L.V.}7+$.........f........................................I.qk..B.....LZ................./. ,Q....N............./. ,Q....N.........c.......c.......c...........................................c..j....c..T.]..c.......c...B..c..H....c....B..c....>.)c....J...................;........4...4...4.."..............c...c...c....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........c.......c......#c..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                        Category:dropped
                                        Size (bytes):2898
                                        Entropy (8bit):7.551512280854713
                                        Encrypted:false
                                        SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                        MD5:7C7D9922101488124D2E4666709198AC
                                        SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                        SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                        SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.318667216250849
                                        Encrypted:false
                                        SSDEEP:96:m3VsUyRB8ODgEShSXhEav9YkcRQyRprpeITSFFhTSNDZq:esUkB8oBXWo9VcRJRVpeIQ
                                        MD5:8E35AC5648693104B2B04EDC1FE5DA67
                                        SHA1:F8CC2BCF65FAFC3F55C94AFEA885C0F6E68A98D5
                                        SHA-256:46CF38142EC09A003E3448AC5CF450E0AFCBF9A681A24CAD0F6D9C7F3D88CAD7
                                        SHA-512:6D074F2078B60EC58A042A5BA9CE637D6C2277318C2F31BFEEF24168F02435FC41140B438C76BB3353830BD0C35EBD629435DFB13012889E7A6D71E3E8203F38
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ............8....t.2C~.o....8....t.2C~.o.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............r....p...z'3(t.....N...^....................P.G.p..~.c.........f........................................I.qk..B.....LZ.............r....p...z'3(t..........r....p...z'3(t.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                        Category:dropped
                                        Size (bytes):29187
                                        Entropy (8bit):7.971308326749753
                                        Encrypted:false
                                        SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                        MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                        SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                        SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                        SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.362318654007514
                                        Encrypted:false
                                        SSDEEP:48:7Ih1sgRzGxxzv+tn2nEYYOt7Q1XtZM9qNFotrdQqrITV7NBXT1q9bD1:7Ih1s0wzv+KEYY6kX7M9qPMRQywV7NM
                                        MD5:3D9B61772251AE5FDAB2AF0EBE6D3215
                                        SHA1:224D3C102FD480E9757F5560F0AE1752F6AAA15F
                                        SHA-256:674D65281DB1C0CA271D95A5348463AAD0A7A27735B80549A62EA2E0C51049A2
                                        SHA-512:61895D4768A11D6DE2C14EA1FE1E75E1CF23F369A6EB9FEA4D618114D57A4E063BD4BF66F50688DDBF7AC37393D67D88FE6A1D5FA41C142D807F8C295D1D6435
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.........H..W.3soc.....H..W.3soc.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h..r....M(9../.....N...^................Ed.S..B.._x.a........f........................................I.qk..B.....LZ............h..r....M(9../.........h..r....M(9../.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                        Category:dropped
                                        Size (bytes):4819
                                        Entropy (8bit):7.874649683222419
                                        Encrypted:false
                                        SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                        MD5:5D6C1F361BC04403555BE945E28E53FC
                                        SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                        SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                        SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.357201675707043
                                        Encrypted:false
                                        SSDEEP:48:isP59BSH04gz7UmtBpYOEnV5PJXHV9mbo17rdQqraI0BX1TA0kxQN2FAEk9/8:isxiUtzwmTEV1JX19Eu7RQygjIpk
                                        MD5:CFB920999E999BA6BAA21F7BA531BA0F
                                        SHA1:2CC87463F6FD8FF65205AE37AD017D1EC132E015
                                        SHA-256:76134B286602B5B87C53ECF99A716D34BD0DD88D5352AE58E6FD43A30916AC07
                                        SHA-512:57CB65116CC974955C0193D1DAF46BF7981ED32876743CF1FEC037901FAB917B3CD729AA3A1423EDF1A2DA94E3051287585CC03A6E8DC9E8E1F958C493F3AA2B
                                        Malicious:false
                                        Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ..N.......NM~T..1c.!F..(..NM~T..1c.!F..(..N..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............4U..5.+...z......N...^............... .q?.YN...{Fs.y........f........................................I.qk..B.....LZ..............4U..5.+...z............4U..5.+...z.............N.......N.......N...........................................Nj......NT.]....N.......N..B....NH......N..B....N..>.)..N..J...................;........4...4...4.."................N...N...N..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........N.......N....#..N............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                        Category:dropped
                                        Size (bytes):1717
                                        Entropy (8bit):7.154087739587035
                                        Encrypted:false
                                        SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                        MD5:943371B39CA847674998535110462220
                                        SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                        SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                        SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.361363320538416
                                        Encrypted:false
                                        SSDEEP:96:FGtsG69Wu/6XEKd5jX7p9LsRQyUXk6Pw:ysGMW6jKXX7p9LsRJUXk
                                        MD5:F9CAD91A482A133E93D34BC6606BD7B2
                                        SHA1:136C9FCA5052C731D858C5C4D4A44B87F226A60F
                                        SHA-256:42D38FF1D2CDE2F3B6B3997A58E3B26E3F3EC02BBAA30E6EDAE688E32021C94C
                                        SHA-512:99193E44D4BCD594CFEA4B9D6F4C83A1526B9075C242CFC7FE011BE79C4C06D95DCA9076FFBD3C4FCAAAF891DDAF9EA2A0E5EC80FF03EE9A5746B3E61838D4EA
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZC......C.TQu..8hSL...IC.TQu..8hSL...IC...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............W...Yjr..t.@..0....N...^................T.....M.r.%=..*........f........................................I.qk..B.....LZ............W...Yjr..t.@..0........W...Yjr..t.@..0.........C......C......C..........................................C.j....C.T.]..C......C...B..C.H....C...B..C...>.)C...J...................;........4...4...4.."..............C..C..C...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........C......C.....#C.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                        Category:dropped
                                        Size (bytes):3555
                                        Entropy (8bit):7.686253071499049
                                        Encrypted:false
                                        SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                        MD5:8A5444524F467A45A5A10245F89C855A
                                        SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                        SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                        SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.358152873978549
                                        Encrypted:false
                                        SSDEEP:96:q1siYytH1JZehxMENXCh19UX0RQyEZHU6Ihy1bdVx1d:q1siYytH1JZApNXCL9UERJEHU3y1bdVx
                                        MD5:89598EC08876852CCB3B343E0FC81CBF
                                        SHA1:F2BA8CCF5DD5DB47494E050B34C32321A7240272
                                        SHA-256:576DF54D01B07D8775E4E7062C7C7799658D6CFF951E6D99CC424686671C1361
                                        SHA-512:8E2BE323956F8778DF8E9A31E5D7FE1C2647356D6A7BC148D56927F3F50B5DE1B22438609037E4A7AAA1F2F54EBA1EB4BA6A16D5C03ED93F9B007208EFBBC541
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZS.......S../.Qj.......S../.Qj.......S....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............MJ?.z..,t.MR.^....N...^..................L..M..t.Z.O.........f........................................I.qk..B.....LZ.............MJ?.z..,t.MR.^.........MJ?.z..,t.MR.^.........S.......S.......S...........................................S..j....S..T.]..S.......S....B..S..H....S....B..S....>.)S....J...................;........4...4...4.."..............S...S...S....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........S.......S......#S..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                        Category:dropped
                                        Size (bytes):3428
                                        Entropy (8bit):7.766473352510893
                                        Encrypted:false
                                        SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                        MD5:EE9E2DF458733B61333E8A82F7A2613D
                                        SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                        SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                        SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.358566067898559
                                        Encrypted:false
                                        SSDEEP:48:gsOo+xWtytmqEXNrx7k8XgZ92uoRrdQqrlm62BX8NE9gOd:gsCxgyzEXNrxHXk9RwRQyyek
                                        MD5:02CCD8940DD462E271D60CC3E57C3AD0
                                        SHA1:82B4F94F95A23DDE5936DF5ED6984DFCC1C0AF02
                                        SHA-256:0D0BF03CC1149AE52C4C959B64BB5F5E77F9A932EAE27D69066BBBC16B26B4BC
                                        SHA-512:7E767806C3259D9E045A9360562AA52E144704A94852518E35FFF3FC5525917B137BFE42C8302F4628D3A347FC352EBEEBB8B1A9BE3EC56FE04BD99D313947AB
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..].......]..q...@..?....]..q...@..?....]..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............c.\.......p .6.....N...^.................A...M...n............f........................................I.qk..B.....LZ.............c.\.......p .6..........c.\.......p .6............].......].......]...........................................]j......]T.]....].......]..B....]H......]..B....]..>.)..]..J...................;........4...4...4.."................]...]...]..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........].......]....#..]............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):65589
                                        Entropy (8bit):7.960181939300061
                                        Encrypted:false
                                        SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                        MD5:8B48DA9F89264D14B83FF9969F869577
                                        SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                        SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                        SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                        Malicious:false
                                        Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.388867524066096
                                        Encrypted:false
                                        SSDEEP:48:vRks4it1t57t9tVxbREmdPyXft9m3o7lrdQqrwoyBX5vkstG9+wqkrt:vRksR7t9T/Emd6Xft98OlRQy/y/G
                                        MD5:685B5EEFD3BFF6E9B8BA9EF20B57546A
                                        SHA1:75EECBDC1B32BB0758A501336006F9B5D5E40EFE
                                        SHA-256:918B18075B2B5A07E008AA1A91CC1D26C223165C1F10F60620F60D927CE93BE6
                                        SHA-512:3F4C3DCDCEA8D7453E238439FAC6A27832ACFCE651DC00F1374BF0C582F85DBAC3EFECA9171A888444EF732038BA3AB245CB74D9FB3AA47C1E3F5F4A722981E0
                                        Malicious:false
                                        Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ.{5......{5..>..1!"..a.(.{5..>..1!"..a.(.{5..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Z.T....+..]sg[.....N...^...............O..!nH=I..l.Q.h........f........................................I.qk..B.....LZ.............Z.T....+..]sg[..........Z.T....+..]sg[...........{5......{5......{5..........................................{5j.....{5T.]...{5......{5..B...{5H.....{5..B...{5..>.).{5..J...................;........4...4...4.."...............{5..{5..{5..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........{5......{5....#.{5............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                        Category:dropped
                                        Size (bytes):1873
                                        Entropy (8bit):7.534961703340853
                                        Encrypted:false
                                        SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                        MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                        SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                        SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                        SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.373155176396375
                                        Encrypted:false
                                        SSDEEP:96:CsHdFmX/IWWEDoXJo9Z89goRQ5mapmhPep3F:CseI+0Xm9ZEgoRC10
                                        MD5:EA255D8A7CEF23965655B76711C43912
                                        SHA1:53874F4D93FA178D6FD339DA840489A853DBB57F
                                        SHA-256:E5EDE57FBF5142DCD30092182D2869A00CB27C6F442FDA625463B423A70B3E5F
                                        SHA-512:C296336A0DC13430F6DE06184FA592ABF22F313BA7D589F26090CE87DDDA7053AC88352789FD6D30867BEF05C21742DFE8FDA347BA4A7ED3F6C6F652421DF42F
                                        Malicious:false
                                        Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZK.......K...v":....s...K...v":....s...K....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............q..,.O...T.Bc......N...^................=.\k.mG.n..;...........Z........................................I.qk..B.....LZ.............q..,.O...T.Bc...........q..,.O...T.Bc...........K.......K.......K...........................................K..j....K..T$c..K.......K....G..K....H..K....>..K.......K.. .3...................;........4...4...4.."..............K...K...K....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........K.......K......#K..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                        Category:dropped
                                        Size (bytes):5465
                                        Entropy (8bit):7.79401348966645
                                        Encrypted:false
                                        SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                        MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                        SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                        SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                        SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                        Category:dropped
                                        Size (bytes):3361
                                        Entropy (8bit):7.619405839796034
                                        Encrypted:false
                                        SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                        MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                        SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                        SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                        SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.357351245375293
                                        Encrypted:false
                                        SSDEEP:96:hgsMuQS379bVE9XYu9uZOlRQyPHKQ1ONAoA:msMuQA79m9Xl9uZgRJPHKQ1ONAo
                                        MD5:32D02AC14DCB31F8307979DBE243E8C5
                                        SHA1:D38AEA90BABC88CAA0C1634D86EB6F0713FABD58
                                        SHA-256:2A87C1645EBC3278004BC3A86936B89249033D87F871459B1832317654B41EBC
                                        SHA-512:174779B6CE190642B8E9F4B497B4A7420960D8712AF0E89E2151A90BDDCD910DEB296B266D0B69577E36AC656BB83ECD7B2E160A1BC903B9EDAAF597D3ED24F4
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.[u......[u..;..-.8...b#.[u..;..-.8...b#.[u..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............F2.6<.+......-....N...^................,..._.A................f........................................I.qk..B.....LZ..............F2.6<.+......-..........F2.6<.+......-..........[u......[u......[u..........................................[uj.....[uT.]...[u......[u..B...[uH.....[u..B...[u..>.).[u..J...................;........4...4...4.."...............[u..[u..[u..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........[u......[u....#.[u............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                        Category:dropped
                                        Size (bytes):140755
                                        Entropy (8bit):7.9013245181576695
                                        Encrypted:false
                                        SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                        MD5:CC087700C07D674D69AFDFDA0FA9825C
                                        SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                        SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                        SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.346861138730066
                                        Encrypted:false
                                        SSDEEP:48:YuYpJsT1aNmO1DK1cobVtybEuVLkXk9+7oBrdQqrzA1pNBXMw1l1DK1Z17r1F1sx:YlpJs8L6bV6EuVYXk9+7wRQysrNPB/0
                                        MD5:BB13C96B3A5774368DE6E84323F995FF
                                        SHA1:A095D85619B598325D96EFDE55F9A2EF7764AE5E
                                        SHA-256:5B15254BEE6B845C45E493E583490753CF04623942F049C7F61BE9F5B8EED296
                                        SHA-512:D0F4CB23272038215F3C88DF670100562A6A906997E6FD09BF48E7B91090ABD47ECF4CB1FB76772D7F0C6D4D9BB9693CA3CF7A8E848F27B1013F03E010EA61E4
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..b.......b.=...9G)H....b.=...9G)H....b..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............{'.....7..........N...^...............6..Y.ZzL.....Sub........f........................................I.qk..B.....LZ..............{'.....7................{'.....7.................b.......b.......b...........................................bj......bT.]....b.......b..B....bH......b..B....b..>.)..b..J...................;........4...4...4.."................b...b...b..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........b.......b....#..b............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                        Category:dropped
                                        Size (bytes):129887
                                        Entropy (8bit):7.8877849553452695
                                        Encrypted:false
                                        SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                        MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                        SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                        SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                        SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.303811096052157
                                        Encrypted:false
                                        SSDEEP:48:YuysQ2m11RtAEQNtEr7LMUXXFEHz9WtoNrdQqrP/osBXNl3uw9:Y9sw1R2/Er7QUXXQz9WtsRQyZT
                                        MD5:D1F64FD7795A6D88C8853A1596B76745
                                        SHA1:F3265EF70574825BABF93263B1DF74117254D8DF
                                        SHA-256:B14A8A985FBFAC4BB750FBE147019CFF4E037BF23087A115386C790CC2DC5A96
                                        SHA-512:38217B3ACD6D5FB996FDDEB2E60F86ABB4E0B87E4A4577680D34C0FCDE967B828EAAE2CB77D45206FEC2D2F304C2EC81CC557BF7DC4C62E20EF2784BB9081E69
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ/......./...F.L....|.K&./...F.L....|.K&./....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............1>..q`&.......f....N...^................T....H.1.&.=l........f........................................I.qk..B.....LZ............1>..q`&.......f........1>..q`&.......f........./......./......./.........................................../..j..../..T.]../......./....B../..H..../....B../....>.)/....J...................;........4...4...4.."............../.../.../....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........./......./......#/..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):84941
                                        Entropy (8bit):7.966881945560921
                                        Encrypted:false
                                        SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                        MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                        SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                        SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                        SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.35869950356618
                                        Encrypted:false
                                        SSDEEP:48:YuNPSLs5KFW2xrSr2WrtGR5wEe+h2MXf9dha9igxolrdQqrjxHYwF2BXgD2FsP22:Y5s02r2WrhEPfXfda9igxkRQyFL2Ef
                                        MD5:1DD6B8C94885153DD5A99235C78B7DD9
                                        SHA1:3878A3FE2439B8C7555B9F449BD5D347EA556A72
                                        SHA-256:393CF2C3C0E34DCA7E4E2FD2A21CF93FE69F41DE0F61D1F3AF2C1F7C883B4673
                                        SHA-512:9BF4B51E431341801D55DC8CBB64E054B342DC32EBB4024D3235A9D3049FE57EB6A9E55963FDE614C13DD27B9672A85A8C28A91B6D1E6EB230B08A5A7BC7FC50
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.%.......%.h%...2..b..G..%.h%...2..b..G..%...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............3|.0....8iAS.......N...^.................U..H.I.u...s........f........................................I.qk..B.....LZ............3|.0....8iAS...........3|.0....8iAS.............%.......%.......%...........................................%.j.....%.T.]...%.......%...B...%.H.....%...B...%...>.).%...J...................;........4...4...4.."...............%...%...%...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........%.......%.....#.%.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1569
                                        Entropy (8bit):7.583832946136897
                                        Encrypted:false
                                        SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                        MD5:07DB3F43DE7C1392C67802E74707DAA6
                                        SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                        SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                        SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.32129046202274
                                        Encrypted:false
                                        SSDEEP:48:WZ5sCsgyuwe/WKtmMXE+YlLmXQ9LqRwodrdQqrLnDCBXU897g0Bd:WZ5sYH1WKVXEplqXQ9WRwcRQyDWVj
                                        MD5:61DF7AC3959958375CEDBE80EB5B5C50
                                        SHA1:275E067460A1D27547664DBDCE82CFEAF8D74C28
                                        SHA-256:B86FCD9ABC9EF55167F5BBC9C53C037173060B007F338C9B33FBA9FF709B24B5
                                        SHA-512:8BE081E69B6D19E0340D6B48EFBDFCC3644DCFFA89C05BE5431005A80619827743E88C4FA6D9F145BBADCD0B2A18DA8910773E9D280C4782D848F75F081E984C
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........'C.....Tm[.Y7...'C.....Tm[.Y7.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............O.AV...1.I6........N...^................m).E...Kr.{#........f........................................I.qk..B.....LZ.............O.AV...1.I6.............O.AV...1.I6............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):40035
                                        Entropy (8bit):7.360144465307449
                                        Encrypted:false
                                        SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                        MD5:B1DDD365D87605F96D72042CB56572F6
                                        SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                        SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                        SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.598315416120695
                                        Encrypted:false
                                        SSDEEP:96:Vs63jlxXGXRE3/XXF9urERQyduD3aJueFaO4P:Vs6xxXSu3/XXF9urERJMD3aJueFaHP
                                        MD5:25A1757DEE6DD7B1F235946D2BCB7D9F
                                        SHA1:6B06FF9CB60DB756118310DB8105A056500AE929
                                        SHA-256:15F9FD19E9F5E12E2E82CDE8409FC9B3841F318442E515D04B1A198E9414B9FB
                                        SHA-512:95E11ACA3ADFCB2D7B51309A49D5E87C4CD827F03358B4745934A033E90F8AE7A274C7C10C9A76AFF19F28C9629DB649673D448CEE16C19FB9F0F9DFD9818D74
                                        Malicious:false
                                        Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZH.?.....H.?C.....2....NMH.?C.....2....NMH.?..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............)..]P..*.....8....N...^.................5..M......JC........f...................................:....I.qk..B.....LZ.............)..]P..*.....8.........)..]P..*.....8.........H.?.....H.?.....H.?.........................................H.?j....H.?T.]..H.?.....H.?..B..H.?H....H.?..B..H.?..>.)H.?..J...................;........4...4...4.."..............H.?.H.?.H.?..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........H.?.....H.?....#H.?............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                        Category:dropped
                                        Size (bytes):242903
                                        Entropy (8bit):7.944495275553473
                                        Encrypted:false
                                        SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                        MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                        SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                        SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                        SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.320880551770791
                                        Encrypted:false
                                        SSDEEP:96:Y9sO8mWNEXMRpXQ9SWYfRQyN8SkeokbAk7kmkeokNWkgk:OsO8mfXMRpXQ9SWYfRJN8SkxkMk7kmkm
                                        MD5:6473C1C200E550CA1DD1EA7BF58A0403
                                        SHA1:397A114AE9163C5E81E5552760E8ED2C30CE77EF
                                        SHA-256:20D619D3A36CA80382419229409CA191A6122FF5A1E45F8050B7B04FC00CCF78
                                        SHA-512:6DE6D210B959ECCCACF635432818204DF676B5DB52439978C1C45B1D6004BE8BD363A59C32A9B6E36593A141DE26518B3769FC1334215880D2DE4EF1196A698C
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.P>......P>ZP.I...'...*r.P>ZP.I...'...*r.P>..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............~. ..E..*/S4|.......N...^....................P.H....U..........f........................................I.qk..B.....LZ............~. ..E..*/S4|...........~. ..E..*/S4|.............P>......P>......P>..........................................P>j.....P>T.]...P>......P>..B...P>H.....P>..B...P>..>.).P>..J...................;........4...4...4.."...............P>..P>..P>..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........P>......P>....#.P>............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                        Category:dropped
                                        Size (bytes):70028
                                        Entropy (8bit):7.742089280742944
                                        Encrypted:false
                                        SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                        MD5:EC7811912ACA47F6AEB912469761D70D
                                        SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                        SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                        SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.350500311847513
                                        Encrypted:false
                                        SSDEEP:48:UJls+u3jatprE5VLP/XyfK9e/oNrdQqruAevy2BXfprZZlz:Os9jafE5VzXyfK9e/MRQy9uy2RZ
                                        MD5:D51AF4C397808EC6C5A61FB2DC1FF418
                                        SHA1:F98E5792EA7A40F39FA0953E4C01F404CCBEADB3
                                        SHA-256:AE4D201E9F41A29D265006BAE0E201945ECE6972590823587C1B38B2F3D88B49
                                        SHA-512:6779392A0CAA45E71B5664394F69CDEED47F3ECB3DF3F90B12D29FA9680D0CE95CC37D2076165EE8CDE143A730AF52F5CB638861A3EC26949FBCDA30F5F3D10E
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..-.......-<u.]./.P..9.?..-<u.]./.P..9.?..-..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............O.F......*..*....N...^...............C..J...C.=p}..M.........f........................................I.qk..B.....LZ..............O.F......*..*..........O.F......*..*...........-.......-.......-...........................................-j......-T.]....-.......-..B....-H......-..B....-..>.)..-..J...................;........4...4...4.."................-...-...-..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........-.......-....#..-............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                        Category:dropped
                                        Size (bytes):24268
                                        Entropy (8bit):6.946124661664625
                                        Encrypted:false
                                        SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                        MD5:3CD906D179F59DDFA112510C7E996351
                                        SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                        SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                        SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.30580244487992
                                        Encrypted:false
                                        SSDEEP:48:IPsxiU8yuAP6C+t6NU1wEr0xQXDDURg9qwNoXlrdQqrDhMBXwtR93IK:IPsD6bYNUiE8QXDDURg9qwN0RQyS03I
                                        MD5:37A1ED6CC4533FF76CAABE8FE00B2B96
                                        SHA1:89D9EC23FBA8E6C58280AB55BEDBCA68683C10D9
                                        SHA-256:22AF22919F27C7FED34EAC280DD344F63D3F997359791D7F14A4C29328AF8BD8
                                        SHA-512:BAC24D61385C5AB3F1FC4A1E61551FADA7AA09A43428697C6C6CA92024F4323E19BB66AB9C0EAB0ECFD80638DF2EA09EBD46F803B13AE1B97492685704C3BC19
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................\.......\..B-T.2.).S`F.I.......I.qk..B.....LZ.\..B-T.2.).S`F.\...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............4.,.."#.#......J....N...^.....................1L..&.w..q........f........................................I.qk..B.....LZ............4.,.."#.#......J........4.,.."#.#......J..........\.......\.......\...........................................\.j.....\.T.]...\.......\...B...\.H.....\...B...\...>.).\...J...................;........4...4...4.."...............\...\...\...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........\.......\.....#.\.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):47294
                                        Entropy (8bit):7.497888607667405
                                        Encrypted:false
                                        SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                        MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                        SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                        SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                        SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.483895895387769
                                        Encrypted:false
                                        SSDEEP:48:YJsBw1o4T166t88aEwLmFLNXUf9OEoprrdQqrXrSBX2Gk13J1:4sMo4Tk6uEwWXUf9OEwrRQybSa
                                        MD5:EEFCC39457813D52C298474BA69E21AB
                                        SHA1:9C3634E3E51F26A13D5522C532BC60BFDCCAFE1F
                                        SHA-256:4EF5A4F4FD42E35B7FCE72E78A5218E3681D189A8302FFDCD7F23FB8B683EAC7
                                        SHA-512:BA3A4F8400E8B891105AA3078E020D2A5289CA8610685068684BBE118C8553E4AAB21622E413FDCE7414A1BA4F9FB7CB8B7C5B31D002A313222D87674B6F6728
                                        Malicious:false
                                        Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZlX......lX...... 6.....lX...... 6.....lX...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................".?M.F.b....N...^...............\.....8F.T..hA.w........f........................................I.qk..B.....LZ....................".?M.F.b................".?M.F.b.........lX......lX......lX..........................................lX.j....lX.T.]..lX......lX..B..lX.H....lX...B..lX...>.)lX...J...................;........4...4...4.."..............lX..lX..lX...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........lX......lX.....#lX.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):347
                                        Entropy (8bit):6.85024426015615
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                        MD5:78762C169F8B104CB57DFF5A1669D2DF
                                        SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                        SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                        SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.359037095615672
                                        Encrypted:false
                                        SSDEEP:96:5DXd0skmXeU5xMsE3XGB8MP9GoCBRQy8w4Dz:VXd0skSeUfe3X7A9GoIRJ74D
                                        MD5:75400EAF65384BCF1B5825FDD36DDC28
                                        SHA1:71481C9FF0319A13D3FB04BBA04F2A55D2F45CA0
                                        SHA-256:22E58510BC2984387128A71BADB262B18B3578009DAA068508C40A1A7F82F6A5
                                        SHA-512:37BBF87F341EFE8FCFF88F371632BF2361FA116BAF9041E2D741CF638D50AB52C5865A4C7B4C564C383844E3FD47FB023FB563C880AE3432B9545BCE7082950A
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZO......O.....!Y.,~1.O.....!Y.,~1.O...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............>.. .b......>D.....N...^...............F.f...G.5.AI.rR........f........................................I.qk..B.....LZ............>.. .b......>D.........>.. .b......>D..........O......O......O..........................................O.j....O.T.]..O......O...B..O.H....O...B..O...>.)O...J...................;........4...4...4.."..............O..O..O...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........O......O.....#O.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):827
                                        Entropy (8bit):7.23139555596658
                                        Encrypted:false
                                        SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                        MD5:3E675D61F588462FB452342B14BCF9C0
                                        SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                        SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                        SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.326276229066202
                                        Encrypted:false
                                        SSDEEP:48:YHs7C2SyHNttAEX24LUWXf5kW9KyoFrdQqrsh/6xBXY7NDkBqfF:KsRSKN4EXnwWXRkW9KykRQysgxqCY
                                        MD5:E37B130A89C61E58CC286F5401907DDB
                                        SHA1:58AFAC5517E493F2BE22E7EEDEF0851A28EC9EE7
                                        SHA-256:EC05B28A54DC6A2C9305AB8849003E07BE2E6E7CCCC3AD9E89262C66F94628DA
                                        SHA-512:7B8C300F491233AFDBBC1D539E9783EC43F3A0B7517DBA49AAE82308027D6C5ACAA38F7FD42580EC2D0ACB57D8FEFD37A66E75104F4396A3F9515475A235337B
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZF@$.....F@$.H.....+..j.F@$.H.....+..j.F@$..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............T.q...>.........N...^................*D...mK.R...'?.........f........................................I.qk..B.....LZ.............T.q...>..............T.q...>..............F@$.....F@$.....F@$.........................................F@$j....F@$T.]..F@$.....F@$..B..F@$H....F@$..B..F@$..>.)F@$..J...................;........4...4...4.."..............F@$.F@$.F@$..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........F@$.....F@$....#F@$............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4410
                                        Entropy (8bit):7.857636973514526
                                        Encrypted:false
                                        SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                        MD5:2494381A1ACDC83843B912CFCDE5643B
                                        SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                        SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                        SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.358102106747063
                                        Encrypted:false
                                        SSDEEP:96:Y1skIsUXEJiEZnf0gX4e9u2VPcRQyQRkf9:WsvsUUJB0gX59u2NcRJQRkf
                                        MD5:27D107CC9A80AED0F61968226D9F549A
                                        SHA1:962E551CF62C698561A91038C88B2FCBE7B6D834
                                        SHA-256:2DF0141E1BAA5FC6890FE4F76D2E0CAA6BA12FB67C81918C9795FA06FA60AE2A
                                        SHA-512:EAA901C071C1BE39D808A5CC74CB6A90584539952F6F3CF40AE458611250DC50C48AD3B5F7AA1B390325D96986455D80E8958596DBEE5601B69FB645B7475372
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZC.......C.....r.4.7.).C.....r.4.7.).C....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............u.@cS.......0.....N...^...............F.i..i.M....*W.........f........................................I.qk..B.....LZ............u.@cS.......0.........u.@cS.......0..........C.......C.......C...........................................C..j....C..T.]..C.......C...B..C..H....C....B..C....>.)C....J...................;........4...4...4.."..............C...C...C....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........C.......C......#C..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):136726
                                        Entropy (8bit):7.973487854173386
                                        Encrypted:false
                                        SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                        MD5:4A2472AC2A9434E35701362D1C56EDDF
                                        SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                        SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                        SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.3177335223839854
                                        Encrypted:false
                                        SSDEEP:96:isg6EuScYEKHbLXzL9uVEwRQyxm4pVsfPupVAfc3:isg6EYFAbLXzL9aEwRJxm4pVsfPupV48
                                        MD5:65C8B90B6217F0EA3F37DF4F29459D78
                                        SHA1:C3B6D93BDD9DCA9ECB9A7CFCE391B47C6119A630
                                        SHA-256:FB0F960B44202D13C8B74FD6BE1CC768CD409C575B947F6453F8ED6A96D93F8F
                                        SHA-512:95ED0C94A76278C002D734CE139658DBC3F2854CE297264AB623E6E90D505FD7AE115B46F1AF90285F8E7ADC9062921E1705E6498C6B66330BD7C8D0CB04ED2E
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ>ie.....>ieB.f...qaA....>ieB.f...qaA....>ie..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............@0..p.4....S.....N...^................T..E.fE....7n..........f........................................I.qk..B.....LZ.............@0..p.4....S..........@0..p.4....S..........>ie.....>ie.....>ie.........................................>iej....>ieT.]..>ie.....>ie..B..>ieH....>ie..B..>ie..>.)>ie..J...................;........4...4...4.."..............>ie.>ie.>ie..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........>ie.....>ie....#>ie............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):5136
                                        Entropy (8bit):7.622045262603241
                                        Encrypted:false
                                        SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                        MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                        SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                        SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                        SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                        Malicious:false
                                        Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.418551600172651
                                        Encrypted:false
                                        SSDEEP:48:zWSsROvzE+pUatpJe2EBLXUD9gzAo/BrdQqr3eEwWBX+412H8uasV:ZsF+pUaVdEFXUD9gzAiBRQyX1TK8W
                                        MD5:8640FF980EA4164B8FD750015C1AB3A6
                                        SHA1:AF5DC614FA8D52291DCCFE28C7F6FCA246FFE498
                                        SHA-256:7834D2E4BF674946E8A62E142534133585E659C604BD6C7EB6D4333025E13BFD
                                        SHA-512:E0CF88F2F0BA1762DFCF5861AC4C93ABB311152449EF03C7E038F2827903B047EC06748BA06517A7A40768695FE896A188C1076A91475E5CB0DE74E9553E5A9B
                                        Malicious:false
                                        Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ..................sDK............sDK.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Y.;&s...,.gX35.k....N...^..................K7.zA.=pcc.h=........f........................................I.qk..B.....LZ............Y.;&s...,.gX35.k........Y.;&s...,.gX35.k........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):52945
                                        Entropy (8bit):7.6490972666456765
                                        Encrypted:false
                                        SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                        MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                        SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                        SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                        SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.386857482334115
                                        Encrypted:false
                                        SSDEEP:48:zWJ52sDr8RnSOtOoEbLAXXQX5B9ut3FrdqrbuTBXQY2wQB:U52s4nSOZEbLX5B9ut1RysVC
                                        MD5:DE5F6F05833D8BFFE7C64D01ABA26A6E
                                        SHA1:F4AC27C9FBA03A5DA7B813FD95469F4EBC13A5A4
                                        SHA-256:C0589B10803E053BC083273C73BEFE202773B8C048476F483766BF85D2413F1A
                                        SHA-512:E72D40F43816DFD9C8CB012B107BC6F510150E0B75E1A9D4DDC0CA8CD171B734BD263CE573B678520FA6C9DDAF89A4573A66F0B845E6ADBD4101B6ED3B7A9106
                                        Malicious:false
                                        Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZG.......G...'...=.z~..r.G...'...=.z~..r.G....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................6..l..f.!.....N...^.....................N...)L...........f........................................I.qk..B.....LZ..................6..l..f.!...............6..l..f.!..........G.......G.......G...........................................G..j....G..T.]..G.......G....B..G..H....G....B..G....>.)G....J...................;........4...4...4.."..............G...G...G....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........G.......G......#G..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):79656
                                        Entropy (8bit):7.966459570826366
                                        Encrypted:false
                                        SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                        MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                        SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                        SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                        SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.455502484835719
                                        Encrypted:false
                                        SSDEEP:48:vLksitPxBZol+tSghEWn7qlxX4we9Drolrdqr2xnRX6P5tdHJn:vLksMfol+ZhEZXI9DrERy2tsdH
                                        MD5:3619392341204FB7C243CB69FB183318
                                        SHA1:4BBD5BC27E71F7F264E1D75934E2E2C162E06508
                                        SHA-256:299751F9521F82AE5DCE16C5C18B91AF1B55B86246F990208FFEF43386FB729C
                                        SHA-512:569FF09E8785C8A5CE1CCDB59B0639AFCA295AEF4BF15553C766B9626B4C4909759D6DB625CAF2336D5EC4FBA80903CF970A4132162ADECD54E0C7AE81A3E773
                                        Malicious:false
                                        Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v...............................B.......B..0P.Q.;}..Mo`..I.......I.qk..B.....LZB..0P.Q.;}..Mo`.B....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............:.k!.al.>s#...T....N...^.................[...D.uu............f................................... ....I.qk..B.....LZ............:.k!.al.>s#...T........:.k!.al.>s#...T.........B.......B.......B...........................................B..j....B..T.]..B.......B....B..B..H....B....B..B....>.)B....J...................;........4...4...4.."..............B...B...B....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........B.......B......#B..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):40884
                                        Entropy (8bit):7.545929039957292
                                        Encrypted:false
                                        SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                        MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                        SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                        SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                        SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.335372394529703
                                        Encrypted:false
                                        SSDEEP:48:YuWs8c+kinu8gtipEfB+ZpXN4p9HyoBrdqrv2RX1VXxR:YpsknFg0EZ+PXY9HygRyuX
                                        MD5:0440A7A92823460592EBFCC5E7F221A1
                                        SHA1:B6A89FB05C73990D6180FC5D0743B479FFBFC962
                                        SHA-256:1E64A0E48DB16E4E25D16383535BF4A734499A2637445635759660E2FB656653
                                        SHA-512:841347F51690D7862191C24C75D49F16C14EA002458045E13A412399579567CA241BE1FA65E828B36ECEA63EAB11F81A45E65D0350A42FEE473D187B520CEC2B
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZI.j.....I.jZ$../..7...WI.jZ$../..7...WI.j..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............jkI..n...?l..N.....N...^...............i.~L.o.C.d....yw........f........................................I.qk..B.....LZ.............jkI..n...?l..N..........jkI..n...?l..N..........I.j.....I.j.....I.j.........................................I.jj....I.jT.]..I.j.....I.j..B..I.jH....I.j..B..I.j..>.)I.j..J...................;........4...4...4.."..............I.j.I.j.I.j..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........I.j.....I.j....#I.j............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                        Category:dropped
                                        Size (bytes):68633
                                        Entropy (8bit):7.709776384921022
                                        Encrypted:false
                                        SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                        MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                        SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                        SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                        SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.455293553008515
                                        Encrypted:false
                                        SSDEEP:96:5qsbGe0UzzhpmEg30mXxXE197U1NSRyxYDrHVXSUnCHhmI:5qsz0UhBg30mXxXg97YNSRygx
                                        MD5:B7C31632DFBD09CF19E74113F33B587C
                                        SHA1:22EA2D6B4B67F4A7F10B782DF5B992DDE78243BB
                                        SHA-256:E7E9D16B9171626EAA35940FAC03E063F47D5B45F7614BE571D846779E0B4252
                                        SHA-512:E8AB641587BCE24A2DACF0C6C299E52D652916AA84C78831416BF4788B69EED2D7F725126CADC3823D4221E8B508DF8A8F620D5704761EC40649B43BF248300E
                                        Malicious:false
                                        Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ.J]......J].S.....d..vr.J].S.....d..vr.J]..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............."*..Mo.1.}....T....N...^.....................M.......y........f...................................$....I.qk..B.....LZ............."*..Mo.1.}....T........."*..Mo.1.}....T..........J]......J]......J]..........................................J]j.....J]T.]...J]......J]..B...J]H.....J]..B...J]..>.).J]..J...................;........4...4...4.."...............J]..J]..J]..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........J]......J]....#.J]............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):11043
                                        Entropy (8bit):7.96811228801767
                                        Encrypted:false
                                        SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                        MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                        SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                        SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                        SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                        Malicious:false
                                        Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.375471538439732
                                        Encrypted:false
                                        SSDEEP:48:D/osg8udrSrVItW7JEQLUXKV9zOo9rdqrz6RXrxjFu9wrcYA+qFB:cs3VI4EQQXKV9zOsRyGNVq
                                        MD5:E00A2C8A507472C047EB55D6741CC19B
                                        SHA1:78B11434FEDBE152D3EEE580B58F95A49090235D
                                        SHA-256:BF0049CE6713AC7D1CBB8D1753C7A50A6313C4934E8957D22DDD265AFDC2B587
                                        SHA-512:A565EA77182DAB7754B36520208D1D5B4869F4BB814F6EE8E25C76CA37AC55512A997A3C27409266644616DCE957F637B857BBBD8FD04E8112EC519C2BBF0228
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ].!.....].!_]$..2p.8.g.W].!_]$..2p.8.g.W].!..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............K..V..x..D......N...^.................{...F.6_...%.........f........................................I.qk..B.....LZ..............K..V..x..D............K..V..x..D...........].!.....].!.....].!.........................................].!j....].!T.]..].!.....].!..B..].!H....].!..B..].!..>.)].!..J...................;........4...4...4.."..............].!.].!.].!..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........].!.....].!....#].!............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):647
                                        Entropy (8bit):6.854433034679255
                                        Encrypted:false
                                        SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                        MD5:DD876AA103BEC3AC83C769D768AD39FB
                                        SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                        SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                        SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                        Malicious:false
                                        Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.35703884868332
                                        Encrypted:false
                                        SSDEEP:48:esRiu2uKB+ulTNt515/EjFLqjWX1d6jW9ruoFrdqrKimnexRXtIXuXVJTJ4Qg:es6BJlTNrEjF8WXjYW9ruERyK3wcQ
                                        MD5:DA2C0F42798EAFEB5B3E3680330A5BE7
                                        SHA1:BAECC6F51A93D569E29AFA2626D7FA13E5AFB698
                                        SHA-256:9B1CFF14AC1DFC4C763383F05964C16D32682EC71A41E6A5801992BACD0D4873
                                        SHA-512:8DB7F63FE6704853C812E326D38EA063FB61943D5E2FCBCD91144D303A1C81E6E08BB5690629005F041853B1B264745A8279F1085C15D2439223983EC7D0EAC7
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..6.......6.y ..<X.K...[..6.y ..<X.K...[..6..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............(...@..#B..QJr....N...^................MT<...J...O[...........f........................................I.qk..B.....LZ............(...@..#B..QJr........(...@..#B..QJr...........6.......6.......6...........................................6j......6T.]....6.......6..B....6H......6..B....6..>.)..6..J...................;........4...4...4.."................6...6...6..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........6.......6....#..6............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                        Category:dropped
                                        Size (bytes):52912
                                        Entropy (8bit):7.679147474806877
                                        Encrypted:false
                                        SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                        MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                        SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                        SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                        SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.336846024770334
                                        Encrypted:false
                                        SSDEEP:96:ysgiIIttpbZEkIXDtJ97mERyxGEpI56hk0ky:ysgiIItt0kIXD/97mERy4EpI56hk05
                                        MD5:A7F6C37A32957E21EE27A3495E0A21E1
                                        SHA1:8D2EB64AF363CBA5351CAB58851F221DFDC5E943
                                        SHA-256:CEA3074742528020AD5284BE019F8381949CEE1F07B643F71FA3756A27093782
                                        SHA-512:C7526235B6F860ABE63407F12B6B10856C40B60DEAA029F06FCCEF90E3DED30561DD113AF36AF29882B8646D6734A3335FAA9B4EA10F4E4DE623A09A9AD70685
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ")......").O.."..[{~....").O.."..[{~....")...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............p...(....z^.W......N...^...............:..p...@...0...>........f........................................I.qk..B.....LZ............p...(....z^.W..........p...(....z^.W...........")......")......")..........................................").j....").T.]..")......")...B..").H....")...B..")...>.)")...J...................;........4...4...4.."..............")..")..")...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........")......").....#").............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                        Category:dropped
                                        Size (bytes):27862
                                        Entropy (8bit):7.238903610770013
                                        Encrypted:false
                                        SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                        MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                        SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                        SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                        SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.525037402433904
                                        Encrypted:false
                                        SSDEEP:96:Osn7LnN5E5DaXsJm9j8QRyJVbMCFvVCrTz:Os7LNm5mXsJm9j8QRyLb
                                        MD5:4F67FA38FC5C775C072A508BA7480633
                                        SHA1:567B20559056357CC840D1A209EF7F4940E98E30
                                        SHA-256:8233DA425003B73EC79CC2AA4B3F9F5ED793EA20FFFF28970999DA7A8A9838DA
                                        SHA-512:F83F29A38A8508B790650B895129E586E9E2A13884C9F384B4AD48B5C12B371C6C4BCEB345C2F6D1480B33B0A16BC24FFB46356AB14FE7C28A2E2036C888ABBD
                                        Malicious:false
                                        Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZh!B.....h!BY..B.>.~u0...h!BY..B.>.~u0...h!B..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Q}..=....\D..V8.....N...^................]/....C.J..I...........f..................................."....I.qk..B.....LZ............Q}..=....\D..V8.........Q}..=....\D..V8..........h!B.....h!B.....h!B.........................................h!Bj....h!BT.]..h!B.....h!B..B..h!BH....h!B..B..h!B..>.)h!B..J...................;........4...4...4.."..............h!B.h!B.h!B..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........h!B.....h!B....#h!B............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):977
                                        Entropy (8bit):7.231269197132181
                                        Encrypted:false
                                        SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                        MD5:B7F74C18002A81A578A4EE60C407A8D3
                                        SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                        SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                        SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.354583685165952
                                        Encrypted:false
                                        SSDEEP:48:wmesFmKJXYuYUXteCE3VpL+4OXGh9/S8oprdqrGzRX6+lr9ghQt4lARWg:wsF5YuYUX/E3TqpXg9/S8wRyoz
                                        MD5:37E67B5188D44661AA372C93EAE625AD
                                        SHA1:7BF65E4CCB12A5A714F1BF7125170A9A7616B722
                                        SHA-256:7A29368C28ADBC9F7FBC147BDDADA6040B3FB4F5F728673C6FCBF1A23249EA5F
                                        SHA-512:958CCE93C5F336CEFA4796A0B4646116DAE1656AF0BCFEEF4FA3952F8676AA83A29BE21364DAC0423812E3F73BD143EA1E99909B951419D03F75A79F7C959FF5
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................5.......5...K......A..&.I.......I.qk..B.....LZ.5...K......A..&.5...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............n...C.....w...%.....N...^.....................K.Fn.............f........................................I.qk..B.....LZ............n...C.....w...%.........n...C.....w...%...........5.......5.......5...........................................5.j.....5.T.]...5.......5...B...5.H.....5...B...5...>.).5...J...................;........4...4...4.."...............5...5...5...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........5.......5.....#.5.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):34299
                                        Entropy (8bit):7.247541176493898
                                        Encrypted:false
                                        SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                        MD5:E9C52A7381075E4EBC59296F96C79399
                                        SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                        SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                        SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.327781828943444
                                        Encrypted:false
                                        SSDEEP:48:6sWrZN2Z2b4tQYBXLEHSFLQXgVkB/9DEoFrdqr6/WjC2RXnNmt2B:6sqNc2b4jbEyFsXX/9DEERy7jC242
                                        MD5:5A511387C3D453DEC8F8CC50DCB18095
                                        SHA1:3800C62A408B916C9720485F888539361C612F37
                                        SHA-256:B4B4DDC165B4BED9C04A5DC8CC20C310D194E4BB5738AD2F2A64C2D5AEE9EF67
                                        SHA-512:85CFCEE340F9DAC73E8E6EECA199F23DFD8C59E918F8911CEE768CAB37AF4756211EF07FC85D0959637840601C2A3F0F2E1AE99BD98348B6A0A9EBEF1A44512D
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ`.......`...v`.1..l...N`...v`.1..l...N`....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............;....9.!...d2....N...^...............A.k).0.D....JV..........f........................................I.qk..B.....LZ..............;....9.!...d2..........;....9.!...d2.........`.......`.......`...........................................`..j....`..T.]..`.......`....B..`..H....`....B..`....>.)`....J...................;........4...4...4.."..............`...`...`....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........`.......`......#`..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):10056
                                        Entropy (8bit):7.956064700093514
                                        Encrypted:false
                                        SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                        MD5:E1B57A8851177DD25DC05B50B904656A
                                        SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                        SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                        SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                        Malicious:false
                                        Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.332109216963161
                                        Encrypted:false
                                        SSDEEP:48:rQNs/8DIxEInCtueyEXh2aLIXX9v/olrdqrQzfxRXrCdAIGNu9:rQNs8IyMCshEfcXX9v/kRyQVtzIou
                                        MD5:CEB45F28424A2515F36F2A4E80DE24CF
                                        SHA1:21D13A041B3F6FCD9A743AE8A70B7D0D1520497C
                                        SHA-256:69CA02C4A3BD28EFB71AEEACC03B13841131C88DFBB58505FE937CB8F9776FE6
                                        SHA-512:2AEFBCFE460F4C5A73C61E74D1EC3E53230CE272CE2FA8EF4E2BA622F689EC36B3B41061F7CB328D3D9FF27CA95E767473C89E4F783DC04914ABAFA5316A13D3
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.V\......V\..m..'.+igs7.V\..m..'.+igs7.V\..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............\X..f..&U.........N...^................d.=...I..<.1..r........f........................................I.qk..B.....LZ.............\X..f..&U..............\X..f..&U...............V\......V\......V\..........................................V\j.....V\T.]...V\......V\..B...V\H.....V\..B...V\..>.).V\..J...................;........4...4...4.."...............V\..V\..V\..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........V\......V\....#.V\............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                        Category:dropped
                                        Size (bytes):84097
                                        Entropy (8bit):7.78862495530604
                                        Encrypted:false
                                        SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                        MD5:37EED97290E8ECB46A576C84F0810568
                                        SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                        SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                        SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.351431233064563
                                        Encrypted:false
                                        SSDEEP:48:SeQMslliI6W09g7nt2gGEMx4XNs3U9XToRrdqrBIloRX+r8B3HZ:SeQMsn6W09g7nI3EPXNt9XT4Rymox
                                        MD5:FAB6A2198C267D1C54FF04C0A45158B6
                                        SHA1:25BDC38B397DA1C84E96082058A67276354C4499
                                        SHA-256:EC4738F7BEC6A1AE654AFB3C3BDC27121C8C4E066BBF8AF2BA4B5D539648FB68
                                        SHA-512:FCF3535E16D9BB00C5EB839E7A7CF33681EFA2C96FEBA46842FD796DDDE74043E22DE2FD68987082A1106C10149F380F3CFD18E867E4FF4200E6A8E9395168F8
                                        Malicious:false
                                        Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZtu......tu....*......W'.tu....*......W'.tu...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............a...i....b.n......N...^.................|Bp1!K.~.L..6.........f........................................I.qk..B.....LZ.............a...i....b.n...........a...i....b.n...........tu......tu......tu..........................................tu.j....tu.T.]..tu......tu...B..tu.H....tu...B..tu...>.)tu...J...................;........4...4...4.."..............tu..tu..tu...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........tu......tu.....#tu.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                        Category:dropped
                                        Size (bytes):64118
                                        Entropy (8bit):7.742974333356952
                                        Encrypted:false
                                        SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                        MD5:864EEA0336F8628AE4A1ED46D4406807
                                        SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                        SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                        SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.332013589505558
                                        Encrypted:false
                                        SSDEEP:48:l0N0esAqn//SOOAuLtbhEEpcDXOI9XxoLBrdqrvCh/GURXsHFk6fFaO/0ni/x:l0N0es6OOXLUEoXz9Xx2BRyv+QTKy
                                        MD5:1C21BD60A2324744EC6527A6EC68438A
                                        SHA1:5847CAFC0ECAD3207EE7BBED20CAB7FE70A7CFDE
                                        SHA-256:4F9F0BCBAA4EA3E859F3C2775CACD702BDF96CFE65990BE3D3BA70292F246099
                                        SHA-512:539743EA48870D630361AFF1402D24B634CBC156FE2B586CD7E45F2FC5BD8F09CF4CB9D1E30AE51BB393C543C2FAAE92A8F1AEF418F2DBA5FCF8D699D571F7F5
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.p.......p.......w....9.p.......w....9.p...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|g.X}Y.4...].......N...^...............+e...*.@..s...*d........f........................................I.qk..B.....LZ.............|g.X}Y.4...]............|g.X}Y.4...].............p.......p.......p...........................................p.j.....p.T.]...p.......p...B...p.H.....p...B...p...>.).p...J...................;........4...4...4.."...............p...p...p...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........p.......p.....#.p.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                        Category:dropped
                                        Size (bytes):65998
                                        Entropy (8bit):7.671031449942883
                                        Encrypted:false
                                        SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                        MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                        SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                        SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                        SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):3.239215693201694
                                        Encrypted:false
                                        SSDEEP:96:us0fzlCi+WEcEq7XlYy9/Tq5b+ZR0TqZah:us0fzlCPcFXlYy9/mbUR02a
                                        MD5:80816F82C95389353A623201F534045D
                                        SHA1:6B4BB2C00B19DD4B663D8A05B4C2E819E05EE8E5
                                        SHA-256:86C6BD88CA00994019512CDE8234726620AFF1891A2440F8A3046FB6A254F168
                                        SHA-512:69FEE33AE92ED2AE0EC86B6F67842FACAC9BA3F5A6BD184A690B5FBC09E38778215D7ABE6800DCC6165A5BC4E685818F9C7A48CB25BE7AB696B5062CE62DC9D9
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>...j.......v.............................................~...Q.{3jN.I.......I.qk..B.....LZ......~...Q.{3jN.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............g.x.r...r..c.w.....N...^............... |... 2G.=.>.K.|........&...................................>....I.qk..B.....LZ.............g.x.r...r..c.w..........g.x.r...r..c.w.........................................................................j.......T.a...............D.....H.........N.......?.#.....9...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4........................#...............................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):32656
                                        Entropy (8bit):3.9517299510231485
                                        Encrypted:false
                                        SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                        MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                        SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                        SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                        SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                        Malicious:false
                                        Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12824
                                        Entropy (8bit):7.974776104184905
                                        Encrypted:false
                                        SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                        MD5:2628353534C5AD86CBFE57B6616D46DD
                                        SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                        SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                        SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                        Malicious:false
                                        Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):32656
                                        Entropy (8bit):3.9517299510231485
                                        Encrypted:false
                                        SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                        MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                        SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                        SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                        SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                        Malicious:false
                                        Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12824
                                        Entropy (8bit):7.974776104184905
                                        Encrypted:false
                                        SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                        MD5:2628353534C5AD86CBFE57B6616D46DD
                                        SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                        SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                        SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                        Malicious:false
                                        Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):32656
                                        Entropy (8bit):3.9517299510231485
                                        Encrypted:false
                                        SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                        MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                        SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                        SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                        SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                        Malicious:false
                                        Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12824
                                        Entropy (8bit):7.974776104184905
                                        Encrypted:false
                                        SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                        MD5:2628353534C5AD86CBFE57B6616D46DD
                                        SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                        SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                        SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                        Malicious:false
                                        Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.311690133653324
                                        Encrypted:false
                                        SSDEEP:48:YuqRsoJowpBvteie3Eya7RXz069jFjdUmrd3rVxjRX3UqHyCN:YJs7wjv0ioEyaNXz069jF7Rb7J
                                        MD5:E1AE520C1FF5E26E467809869B56F779
                                        SHA1:1A24434D95183D1F538CA1E5E9BBB15BF1C3469D
                                        SHA-256:6ED61C52A13583F740E5DCC08FA6D6DFB56D6A2DA20FB72136135645FE8990D2
                                        SHA-512:CDE6ECFB1620B52DE5AB862198F115FA982F91433DF1E70A5667FB435A9C0FA2C7D78AEF5DD2A63D2C9017FD990A5693DD6305A7F58CAC5863B4D1642F51B2A1
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..7.......7.......J<.1....7.......J<.1....7..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................K #.....~A].....N...^...............!.mb.Z.G..:.C.B........f........................................I.qk..B.....LZ...............K #.....~A]............K #.....~A]............7.......7.......7...........................................7j......7T.]....7.......7..B....7H......7..B....7..>.)..7..J...................;........4...4...4.."................7...7...7..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........7.......7....#..7............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):39010
                                        Entropy (8bit):7.362726513389497
                                        Encrypted:false
                                        SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                        MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                        SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                        SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                        SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.428916779706829
                                        Encrypted:false
                                        SSDEEP:48:zWSsxq0pnne1+xtwj6Er+RdXBO9kmj41rd3rK3xtkdX2k2+6p:Jswye1+xbECdXA9kmQRbKDkXW
                                        MD5:D6CBFDC2FAF585FBB1BAD1EBE4D200D9
                                        SHA1:8A8CCEA5846155BAB9C3FCB80904FC78AD56CC66
                                        SHA-256:F93B5BF8893879E706581B4A278E6DC15725EA2120C91E83CDEB2607B817231B
                                        SHA-512:25EC5842433EC42A7ECD2BA5B92BB56770999CB2773A83564E3725D728927B2F8A673ADE664B71A351F2E16A223D82C5B3D703CFDBADB348D5A2D9B6AFE87819
                                        Malicious:false
                                        Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ.X.......X.E.........T..X.E.........T..X...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............PE.b..%q..........N...^................^.....L.j.............f........................................I.qk..B.....LZ.............PE.b..%q...............PE.b..%q................X.......X.......X...........................................X.j.....X.T.]...X.......X..B...X.H.....X...B...X...>.).X...J...................;........4...4...4.."...............X...X...X...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........X.......X.....#.X.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):25622
                                        Entropy (8bit):7.058784902089801
                                        Encrypted:false
                                        SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                        MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                        SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                        SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                        SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.320858632098423
                                        Encrypted:false
                                        SSDEEP:48:YuKds45URUkEItsUAnEHGKOXalUw9hSNj4prd3rUox1bJdXv1XJ5:YtsIkEI+EmJXw9cNMRbvd
                                        MD5:8C1E885EF43855B870431B7672E54A58
                                        SHA1:F93CB9AE90C73BA7598FE111763D3C3C257C5FDF
                                        SHA-256:D8A09073F51E97A977AE706A12310E5EA8FA9A7BD2BE3B3054130472ADFB449D
                                        SHA-512:9ED1A60A84A65A499049F85D3A372B6C087B7386031A7DAC287D07052E071456455E829BEE2B4430EF10290BC1FC9896504BB059F910262C226C6C53D628043A
                                        Malicious:false
                                        Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ................Km...........Km........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............._./.$x.......j6....N...^...............Bo5ZW$*K.Ho..^.]........f........................................I.qk..B.....LZ............._./.$x.......j6........._./.$x.......j6........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2033
                                        Entropy (8bit):6.8741208714657
                                        Encrypted:false
                                        SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                        MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                        SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                        SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                        SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                        Malicious:false
                                        Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.324698317857863
                                        Encrypted:false
                                        SSDEEP:48:isGqCWqZ7tFkEkJLqIXr3IBI9oYooj4lrd3rIxSNiKdXWb1fBlJ:is9qZ7kE8fXjD9o8YRbVNjel
                                        MD5:E6BEC26F3025B4EFBF0A6F2065D317DC
                                        SHA1:DA5A1B3F1B5BD628DF1CE8ACE2EFD5C99F878F45
                                        SHA-256:DCFEE2760D8FEEC77E787C48B53F4C00028EC619AC7A459C47972B4712CC502B
                                        SHA-512:38324A81F5A1B5B43F04F5100700417F62980A3645EBCBFB84B677489E02B5A308A35ECAAEEE36C29651C4351BEA45E8F97390D7D65DC63C192B8EB46B718B06
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.I.......I.^.-....;..0...I.^.-....;..0...I...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............dm.;....w.........N...^..................DspRK.......#........f........................................I.qk..B.....LZ.............dm.;....w..............dm.;....w...............I.......I.......I...........................................I.j.....I.T.]...I.......I...B...I.H.....I...B...I...>.).I...J...................;........4...4...4.."...............I...I...I...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........I.......I.....#.I.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):55804
                                        Entropy (8bit):7.433623355028275
                                        Encrypted:false
                                        SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                        MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                        SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                        SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                        SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.452128333777912
                                        Encrypted:false
                                        SSDEEP:96:QsoP8xEYDEMXcYL9w26ZRMkrSRoDS7ZJ:QsoP8KTMXco9w24RMkrSRoDS9J
                                        MD5:A897142A08E864DC736A3848E75CACE8
                                        SHA1:0DE063B8B621C5A13DDB6BFC33093E0D4992C56E
                                        SHA-256:D98C315F27110D9067898B5E472DB91208CF34BC5595E8B88E7BCDAC0B0843CE
                                        SHA-512:AB9313C898F8A9A39ABC923C7BE309EC9ABB3021F718029A9C733675E506AE54EAE7F6626759770CD0F3549B1D874AED3F746881DE08F5DC8AE25F6FBC534F26
                                        Malicious:false
                                        Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................*.......*...&...dt.s...I.......I.qk..B.....LZ.*...&...dt.s...*...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................#e.Z+.......N...^....................k.N.#..F.#.........f........................................I.qk..B.....LZ..................#e.Z+.................#e.Z+.............*.......*.......*...........................................*.j.....*.T.]...*.......*...B...*.H.....*...B...*...>.).*...J...................;........4...4...4.."...............*...*...*...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........*.......*.....#.*.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                        Category:dropped
                                        Size (bytes):59832
                                        Entropy (8bit):7.308211468398169
                                        Encrypted:false
                                        SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                        MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                        SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                        SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                        SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.291107992930122
                                        Encrypted:false
                                        SSDEEP:96:vsj9W/893WEIpX3p9exARMzFyYyxy8QyByYyK6y7y9:vsj9WUZ+X59exARMzFyYyxynyByYybyu
                                        MD5:BE54E7FB214F7F24B24216CDD51E2D25
                                        SHA1:C6B45C21B97E244A713D142F5D0A4DA4118A6F3C
                                        SHA-256:193AF3FB8E30EEAEEE73751E03458FB742A5486F96D86CE4D0D0E90047C7A3FE
                                        SHA-512:BC98AE163087F468D44E0B10F51E1E03F37EFEE7CE9DDE1EF6B20C0DB695EABFE9786F8A025AC95BD218539F6B4F7B35D6A93FF430E6546F1BC46CBE6D8AF97F
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................F.......F.._E.....2To.Q.I.......I.qk..B.....LZ.F.._E.....2To.Q.F...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............O.4.m..+.. 'v.....N...^..................F.y.H....a..$........H........................................I.qk..B.....LZ.............O.4.m..+.. 'v..........O.4.m..+.. 'v...........F.......F.......F...........................................F.j.....F.T.^...F.......F...B...F...C...F...>...F...|...F. .3...................;........4...4...4.."...............F...F...F...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........F.......F.....#.F.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):33032
                                        Entropy (8bit):2.941351060644542
                                        Encrypted:false
                                        SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                        MD5:ACF4A9F470281F475EA45E113E9FB009
                                        SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                        SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                        SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                        Malicious:false
                                        Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12180
                                        Entropy (8bit):5.318266117301791
                                        Encrypted:false
                                        SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                        MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                        SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                        SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                        SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.360387429598308
                                        Encrypted:false
                                        SSDEEP:48:YsLbdtGeabLvtt+1DEPEczowLhrX/VO9cs7p5FrdMrlEzijQXppc9/8qRv:YsdsTbTtmEsAowlXc9cuVRMBCcR
                                        MD5:52619FEB97C7BE906BA4FF4067C00CA1
                                        SHA1:9EC1950B902391A0B57E4B6FDC3DBA00AF7853F7
                                        SHA-256:2AE9DA082E221BB70DF4348D272E5BD379A6A91BD1965943D480ED17B8EAEFC1
                                        SHA-512:3978E63594A61744F6C00E28F15FDFEDCB22208D77AD72CDA780849F8A5F01B95B3DCD96B746C42C3C182A11889C10DD02276CD66E5E0A09D4EB4E5FB8547E27
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ"......."....I..U......"....I..U......"....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............X..w+..-..F.g3.....N...^.................i.HuhJ.80...`.........f........................................I.qk..B.....LZ............X..w+..-..F.g3.........X..w+..-..F.g3.........."......."......."..........................................."..j...."..T.].."......."....B.."..H...."....B.."....>.)"....J...................;........4...4...4..".............."..."..."....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........."......."......#"..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2104
                                        Entropy (8bit):7.252780160030615
                                        Encrypted:false
                                        SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                        MD5:F6C596F505504044DF1E36BA5DA3F09B
                                        SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                        SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                        SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                        Malicious:false
                                        Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.346629680861192
                                        Encrypted:false
                                        SSDEEP:96:WsWwhfV/F+LwnE2olXSyl99soRMQAX8/0Lg+zRMLKdG9:WsNV/QtPlX3l99soRMQc8/0LjRMLmG
                                        MD5:D6E387F2D9D20B4EC6357B0623E82E3C
                                        SHA1:E1C75EF8E8859A79BEC08AB9C491BAAEBEB99B73
                                        SHA-256:E79131D6FEA5A255AE30FAC4CDB1B1FCFD8FAE5C0BFA8A6EE34A79509FA5C5A2
                                        SHA-512:AF3E4B3E16F997184812A6B8A41A7B54F95A24A2AE018C1865E2298E4A5657CAB9EF97A710833E7A52E9E496635343DE421946BF13596A7F6DD7DD6E233E2A48
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..........m>e..u.a... ...m>e..u.a... ....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............oc9.......a.....N...^.................*.o..M...m............f........................................I.qk..B.....LZ.............oc9.......a..........oc9.......a.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):14177
                                        Entropy (8bit):5.705782002886174
                                        Encrypted:false
                                        SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                        MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                        SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                        SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                        SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.349503812365783
                                        Encrypted:false
                                        SSDEEP:48:kxswqwsyLhjtqFtEYXL7FGXhuH9ZsdpyNrdMr56A1IFXlY9sGl:Es4LhjgEQgXM9ZYgRMj2W
                                        MD5:F66C84152F111B71EB65E1606EF25EFF
                                        SHA1:301DE3774C4B9BB1C2A120D06AE2F5930825BA2B
                                        SHA-256:1DF7116CC57433FE655ECFE0A769A6A58B80A7F1C444831E44538551C548FB46
                                        SHA-512:3ADB6B9355DA9E9A2F74341D7997982E7978E46D847924678D0AA47BDB165872A1E03A6AD7340396936E7DEAE119DCDB6FEFE3FA9BC8AE33934AF6C427259240
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..c.......c....;Unx..|...c....;Unx..|...c..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'......................o..|.x:....N...^.................~..A...2#...........f........................................I.qk..B.....LZ.....................o..|.x:.................o..|.x:...........c.......c.......c...........................................cj......cT.]....c.......c..B....cH......c..B....c..>.)..c..J...................;........4...4...4.."................c...c...c..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........c.......c....#..c............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                        Category:dropped
                                        Size (bytes):36740
                                        Entropy (8bit):7.48266872907324
                                        Encrypted:false
                                        SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                        MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                        SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                        SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                        SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.45287248405264
                                        Encrypted:false
                                        SSDEEP:48:tszwsqolVtrMtaf/W+8ELLjZX8Pk9VslpyclSrdMrrrk1FXVVkxo31LPtQEg:tstVtQ458ELBX8M9VkzlSRMreeE
                                        MD5:1AAAED02DEF049DBC28F72797D4284FD
                                        SHA1:0A19731B7ED61C541F62D40A225CA94FE117096A
                                        SHA-256:37C4DC74A4876F3B448214551FEE598DB37DF72380F3C054163EF7DF7DBA0469
                                        SHA-512:1D508F59D7C0072D33BC2750973DC585880A35A45450DC9CB163A2133110EB7592FEA151C5B9CCD8417309B0F77617794192470B8689827A79207A87B93BD363
                                        Malicious:false
                                        Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ..9.......9z5?..>.l..`...9z5?..>.l..`...9..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>..\.....2F.......N...^................o..#.N..C~.1..........f........................................I.qk..B.....LZ.............>..\.....2F............>..\.....2F..............9.......9.......9...........................................9j......9T.]....9.......9..B....9H......9..B....9..>.)..9..J...................;........4...4...4.."................9...9...9..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........9.......9....#..9............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):53259
                                        Entropy (8bit):7.651662052139301
                                        Encrypted:false
                                        SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                        MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                        SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                        SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                        SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.289947212557227
                                        Encrypted:false
                                        SSDEEP:48:KsDVJmB6Wo432Wtx/WJEXDJYyXl9ndsMpyMSrdMrVl7J7FXSFPBvzLW2fvB:KsMo82WbWJEXlXl9ndVIRMvN7Adn
                                        MD5:33DE14E3B32AD6A06F69BB0C1B669428
                                        SHA1:28EEE5BA3F1081499B623C11BD9CEB379E6472BE
                                        SHA-256:452AA2047DA7004F3074FA62904E69B46DC11B89613B61EE7340D79EBC41C700
                                        SHA-512:30936782456AF1B7585956D900D543A05B79EF02990C2258E9EE859710DA29E1F86F0067767AAB80A3FC615F5F2197E5D0319B288A880A8261570341E1395542
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZI.......I.....n.!......I.....n.!......I....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............e.......;pC...i....N...^...................i{KA...5...........f........................................I.qk..B.....LZ............e.......;pC...i........e.......;pC...i.........I.......I.......I...........................................I..j....I..T.]..I.......I....B..I..H....I....B..I....>.)I....J...................;........4...4...4.."..............I...I...I....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........I.......I......#I..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):60924
                                        Entropy (8bit):7.758472758205366
                                        Encrypted:false
                                        SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                        MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                        SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                        SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                        SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.337530009469072
                                        Encrypted:false
                                        SSDEEP:96:seR0s1R7b+cMTNRE6Xuu496696ZRMdrR7bSubOEV:sq0s1RfTMY6Xud9F94RMhRfScOE
                                        MD5:94AAE242A446B6C67D738257F906C931
                                        SHA1:3FDC4F2B09F496E058DD71F537483FF652485A6A
                                        SHA-256:F860063579B6A88D8C70E7C5FF90AF35D0FFB8DD2FA461FA8F277C1EB3FB7857
                                        SHA-512:D358D49919007CE32F28D87F4D0D5D8BC848FE9F8EEDDD45D9D9F2581E12715A19DDE9BD35D5EE8740DEE65E71A1895617B3501410A95D75D27690575C906ACE
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................*.......*.rA...4...!.c..I.......I.qk..B.....LZ.*.rA...4...!.c..*...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............$......#bj...!.....N...^................5}.j..F...VEWy.........f........................................I.qk..B.....LZ.............$......#bj...!..........$......#bj...!...........*.......*.......*...........................................*.j.....*.T.]...*.......*...B...*.H.....*...B...*...>.).*...J...................;........4...4...4.."...............*...*...*...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........*.......*.....#.*.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):515
                                        Entropy (8bit):6.740133870626016
                                        Encrypted:false
                                        SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                        MD5:E96BE30D892A5412CF262FEE652921CA
                                        SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                        SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                        SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                        Malicious:false
                                        Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.364286324947276
                                        Encrypted:false
                                        SSDEEP:48:4DsAKkB6ctSenaJEPA8OLFXGY9dsIpyVrdMr3tNxFXGwrckJ6pg:4DsYB6cUJEPiXt9dpgRMTxjJ6p
                                        MD5:4A94646F33734577B7BEE4D92BB65125
                                        SHA1:74ED0CF6E4F954C620B5A84ACF476D2CAD752144
                                        SHA-256:55ECC3583FEA180DB7C04AA90019F9CB47C890F005CC53730324ACADBAF19903
                                        SHA-512:A712BA4FD6D84E5DB98A789F16A301C7EB41FE116C9CDF8864652B886D98C24B2F85F9E17223A3D7D0936F28A7C966884D844D90CDED395F95D2708042BECEB2
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ9r......9r.Lw49.+M.N...9r.Lw49.+M.N...9r...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............s.L.....<.....5.....N...^................IL.x..F.I..v.O.........f........................................I.qk..B.....LZ............s.L.....<.....5.........s.L.....<.....5..........9r......9r......9r..........................................9r.j....9r.T.]..9r......9r..B..9r.H....9r...B..9r...>.)9r...J...................;........4...4...4.."..............9r..9r..9r...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........9r......9r.....#9r.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1547
                                        Entropy (8bit):6.4194805172468286
                                        Encrypted:false
                                        SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                        MD5:0BA36A74DFBF411FAB348404CCEC3348
                                        SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                        SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                        SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                        Malicious:false
                                        Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.313814051565508
                                        Encrypted:false
                                        SSDEEP:48:4ttYl0s6a8dt6ZSJztBoMNE054jeXRoC9oohUPpy5rdMrMgDoFFXpJmtfScPWbV:t0s6Vt6ZSJzFEsXv96PURMMrwtKcPWb
                                        MD5:5C16867BFE5065E47B57B107341EA78C
                                        SHA1:CAA47C45790F8313FB16FAEB98716972917FCB55
                                        SHA-256:7118ED2CDD46DAC31B0E1DD7D7E957B9533A0F4BCA28C4143F3DA5358AD01B79
                                        SHA-512:54D2607487B2E223E66E138E8134EF59EFD5471CC5EA3734BF95FF08230A8C8AFD6AD350241521D4339AA946294A71106735AF9BC523078D4519D35F8F3A62AC
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..V.......Ve=.X...C`1.....Ve=.X...C`1.....V..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................4.BrkY....N...^.................:><..N..Te.hF.........f........................................I.qk..B.....LZ....................4.BrkY................4.BrkY...........V.......V.......V...........................................Vj......VT.]....V.......V..B....VH......V..B....V..>.)..V..J...................;........4...4...4.."................V...V...V..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........V.......V....#..V............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):95763
                                        Entropy (8bit):7.931689087616878
                                        Encrypted:false
                                        SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                        MD5:177DD42CA99CAA2CCBF2974221680334
                                        SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                        SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                        SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.355674070677948
                                        Encrypted:false
                                        SSDEEP:96:6sRvZl0uJEEy0bX39GgIRMmXGZEvc0tU:6suubycX39vIRMmX3
                                        MD5:9CB38BBACED9F867CBAD9DEAB5CC9D8F
                                        SHA1:A4AF79972C0CFBF64A97646F98DE30D20D407525
                                        SHA-256:004932C0DCE8D3E1993BF27A96BB5C2D0123E5B6E0EF3ADCFDF62C949BEBF1FE
                                        SHA-512:9C949358DBDA9D8DC49D5425080447F201A6BA0759C8512B0C9721BAAC5161260347EADA4C47A40092F7B4B371EBBD500440964BCB2252F64B3C2F0725716CC9
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZE.T.....E.TY)|D...+..:W.E.TY)|D...+..:W.E.T..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............g.4`.;^#3.z<.....N...^...............?%....F..,.{8p.........f........................................I.qk..B.....LZ..............g.4`.;^#3.z<...........g.4`.;^#3.z<..........E.T.....E.T.....E.T.........................................E.Tj....E.TT.]..E.T.....E.T..B..E.TH....E.T..B..E.T..>.)E.T..J...................;........4...4...4.."..............E.T.E.T.E.T..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........E.T.....E.T....#E.T............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):67991
                                        Entropy (8bit):7.870481231782746
                                        Encrypted:false
                                        SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                        MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                        SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                        SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                        SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.310538260832272
                                        Encrypted:false
                                        SSDEEP:48:V6smuR/C8klgteKgVEvlLRDXBG9AyUzpyE8rdMr7k/hlCFXh9k/91APk9:4s7/alg0REdFXQ9AFzURM7EKqMk
                                        MD5:7332376606E73A490C8171ABD145773C
                                        SHA1:3B76EDE61A4E949C6B75EAF2BB7C8898DCBD6EA2
                                        SHA-256:387B2E38B9052DE13ECE65651C2B5E20A991EC2304FEAEF9792649E3D74EAE54
                                        SHA-512:D40F7889EF5D7D0F1FEB8183CDB10F44C831ED9A734EBA3E2752AA0DE7495655CA152B55F646182B1AED2FDFC27AF837E3192A24FDB395D4E63FAE107F3B923A
                                        Malicious:false
                                        Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZD.......D..R:....'....z)D..R:....'....z)D....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................l...c.j?.....N...^................I...D.....@..........f........................................I.qk..B.....LZ..................l...c.j?...............l...c.j?..........D.......D.......D...........................................D..j....D..T.]..D.......D....B..D..H....D....B..D....>.)D....J...................;........4...4...4.."..............D...D...D....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........D.......D......#D..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                        Category:dropped
                                        Size (bytes):22203
                                        Entropy (8bit):6.977175130747846
                                        Encrypted:false
                                        SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                        MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                        SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                        SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                        SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.380132842191146
                                        Encrypted:false
                                        SSDEEP:96:tsNlBYljLQMfEDtXLv9i1sLRMpB8vBc2EOjY:tsiJLGDtXLv9WARMpB8G
                                        MD5:1DE1D00F46E0C5C516A0B5097B073C9F
                                        SHA1:50552A89A93C00B5975D5F8B2BA2B7D56B09B458
                                        SHA-256:554B5155607E9876C36CD95131BED59A2E42FC01C2DA75FC19A87404581CD273
                                        SHA-512:1EA2681A256199088C24342DFF61637006BDD4C5FD322635CA355ECBC89FC957FA319EA810988742C7B15EC07663CD836A2FF6DAEEF8236637CFE4E3D5E351AB
                                        Malicious:false
                                        Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ,.,.....,.,..R{....a....,.,..R{....a....,.,..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............-exl....P........N...^...............Q.B6...C.uQcI.f_........f........................................I.qk..B.....LZ..............-exl....P..............-exl....P.............,.,.....,.,.....,.,.........................................,.,j....,.,T.]..,.,.....,.,..B..,.,H....,.,..B..,.,..>.),.,..J...................;........4...4...4.."..............,.,.,.,.,.,..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........,.,.....,.,....#,.,............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):15740
                                        Entropy (8bit):6.0674556182683945
                                        Encrypted:false
                                        SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                        MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                        SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                        SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                        SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.303739949571902
                                        Encrypted:false
                                        SSDEEP:96:yBs2yeklKJOjEj3vXDEu9KkwRMEk76ECHVebSrjECBw:ys2yeklKXj3vXIu93wRMlrCHVebyjECB
                                        MD5:7B848F2CCF9A4046B80447E979135CCB
                                        SHA1:9835887F1CA58A8760F36440EECD3115C67BEA3B
                                        SHA-256:F7D7D6D89207A5C88B013FEB8B3EB04F078F87A50832E18EA084F2BD12D80665
                                        SHA-512:50B52F8BA55E9FA4BBFC070531AF5C87A19ABC293B7A695D7824A734278F732078F1007C4022A0EF2FAD91D071DA2220F6D0D032839D6AC8AC5F4DEB93C0DDCB
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.Jk......Jkq..o.+.y+.^A..Jkq..o.+.y+.^A..Jk..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............z.........iV.......N...^.................<....L..GU.M.(........f........................................I.qk..B.....LZ.............z.........iV............z.........iV.............Jk......Jk......Jk..........................................Jkj.....JkT.]...Jk......Jk..B...JkH.....Jk..B...Jk..>.).Jk..J...................;........4...4...4.."...............Jk..Jk..Jk..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........Jk......Jk....#.Jk............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):86187
                                        Entropy (8bit):7.951356272886186
                                        Encrypted:false
                                        SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                        MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                        SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                        SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                        SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.657919914084602
                                        Encrypted:false
                                        SSDEEP:48:eGGsJczIwxAVSqtC2kEdzbULSBhrVXA9VUMpylrdMr69nYkFXQoHS8D9lL6HM38o:Is1SqAEtU0JVXA9mM4RMYRKcZ
                                        MD5:29E33347D96DCA6F214B24C6A146C153
                                        SHA1:DEE781843C5294DBE752137A6632C9775AD7211E
                                        SHA-256:69E6159DB28393EE7797C75202EE7B2209B47568D6106415CA44952C26AA9560
                                        SHA-512:9853570D9703015C8291F8C59486EA228F9289B6A42005FECB33F0A708D60BFA4339687C23C58F00BCFC6909217370B4E23A9BE243242FA2477E761EF90F4946
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ.U.......U....i.8s.N.Zc..U....i.8s.N.Zc..U...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............G]..L..5...e......N...^................{..3.PF..a$Pl.+........f...................................H....I.qk..B.....LZ............G]..L..5...e..........G]..L..5...e............U.......U.......U...........................................U.j.....U.T.]...U.......U...B...U.H.....U...B...U...>.).U...J...................;........4...4...4.."...............U...U...U...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........U.......U.....#.U.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):11197
                                        Entropy (8bit):7.975073010774664
                                        Encrypted:false
                                        SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                        MD5:DDC3CC30794277500EFE4BC6667EC123
                                        SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                        SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                        SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                        Malicious:false
                                        Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.329415016079728
                                        Encrypted:false
                                        SSDEEP:96:ys3tQGx5BEElhXlcC9m04RMYpCaKa2ajxanaKaA+ala:ysuGFRlhXiC9X4RMYpCP7sxCPYg
                                        MD5:9BA96055821169EF185E7AD5ED814A77
                                        SHA1:B4720AC50BFF649EB2FA97B55ADDCF995CDCC9C1
                                        SHA-256:FFA8BE1E99065C93140119FB1314507A79CA29F7DBDFD852AB6C733359AA825B
                                        SHA-512:965BCBE2A8B476EFB77FEDEE7755244D65071BF94E5893A148969885B0234377AFD4D519AF61FDC797A6157D2B493306B4ED061A8C99809FA42CB9E4A5154464
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ>l......>l......9.W>...i>l......9.W>...i>l...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............x.E...9I..T}.....N...^...............[/{gmLvJ.g..j.........f........................................I.qk..B.....LZ.............x.E...9I..T}..........x.E...9I..T}..........>l......>l......>l..........................................>l.j....>l.T.]..>l......>l...B..>l.H....>l...B..>l...>.)>l...J...................;........4...4...4.."..............>l..>l..>l...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........>l......>l.....#>l.............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):19920
                                        Entropy (8bit):7.987696084459766
                                        Encrypted:false
                                        SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                        MD5:1BDAD9B3B6DE549162F9567697389E1C
                                        SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                        SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                        SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                        Malicious:false
                                        Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):3.042924858655932
                                        Encrypted:false
                                        SSDEEP:96:VswInTuPL1lE1tN0fMXrYv9JmgRMH8CVc7BU:VswiTwRy1tN0kXr09JmgRMTc
                                        MD5:F93783FA8D7485BE016C024B88CAAAA7
                                        SHA1:F8F5CCCF3E6364C4A91CEF5593DA0B379A912AA9
                                        SHA-256:1D88CFACF6E4BC4CBD2C5DCC4C29B93BB799F12F484814A29751E0521674E8C3
                                        SHA-512:CB8BE299C27D10EC331CA233CB1341AB10B31A8F81E35920543192CF6AC748A37FBABB06CA89143D13B3B1AC93DFBA99730B227956E4D2D7ABE056923FBB1684
                                        Malicious:false
                                        Preview:2...>...........v.......................................................................................................................................2...>...........v...X...2...>.......$...v...<....I.......I.qk..B.....LZ.cl......cl.dw..<..p...cl.dw..<..p...cl..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'........................"t.(.....N...^................Y.5...C.......a........f........................................I.qk..B.....LZ......................."t.(...................................cl......cl......cl..........................................clj.....clT.]...cl......cl..B...clH.....cl..B...cl..>.).cl..J...................;........4...4...4.."...............cl..cl..cl..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........cl......cl....#.cl............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):179460
                                        Entropy (8bit):7.979020171518325
                                        Encrypted:false
                                        SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                        MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                        SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                        SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                        SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):2.3646346206177595
                                        Encrypted:false
                                        SSDEEP:48:Kj4u2JPdCWlfnCHQlFObDYpl9YNlXT8lp:yqn62Spz
                                        MD5:E5BCFADD111CBDC4457B4348A81A7779
                                        SHA1:9720EB4552E183F63943DBE0F63ECCC23D9D3B1A
                                        SHA-256:1010ABF3F190CDBC7852BE1DBFCF2F54D0B17D454477B2BEA0F9280B080ED2E3
                                        SHA-512:A914BB1A2DC1432C3BA6F154EA300F2F08024F6257468E7C8EDF77AED1CCE081F5C754DC6D4FA8D02555479D3DCD07C7B0F2EBEE7BE38C0A73B0B91BC55BEDBA
                                        Malicious:false
                                        Preview:.................................................................................................................................................................................................................5.......*...#.......#....c..S...#......Ak=.+.fr...........>.#.+.Q..T.,.........D...>.y.................Cl......Cl..................................................Cl..g...Cl`.....Cl..1...Cl..A...Cl..Z...Cl..a...Cl..k....................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y.....................c..,....................Cl..1... ..$....S.t.a.t.i.o.n.e.r.y.....................c..,0............=iY...N...;hF.&...........Cl......Cl...A...7..h.............Ak=.+.fr....2...........T...................#....Cl..................................#....c..,....................Cl..Cl..1.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.344478256010167
                                        Encrypted:false
                                        SSDEEP:96:0DsFHSs5ekE+Xia9tpgRM9RuiTUfdi7i64BN:6sFys5M+Xt9tpgRM9Ruiidi7ihB
                                        MD5:592F69561B6B602FF350404832F938C5
                                        SHA1:A82ADA11F705F36D6C5CC8DFDA50552079B67FDC
                                        SHA-256:BC1E51200A086EE579B2D95D58E98DA8C01C1B4EF8B55B7C2ADEAEBBD359C3EE
                                        SHA-512:B60AB05881EF33A8188307D239BDECE1C98FDD22C426FAF8811859D8E69F5B8BFAFA72BE94A9C9D473C86FC9BB7B8CA7B7B9F49725AAFA62B0393FC7CF62974D
                                        Malicious:false
                                        Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.........H.]..a.9L....H.]..a.9L......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Y.H..R.............N...^....................}.M................f........................................I.qk..B.....LZ............Y.H..R.................Y.H..R.............................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4......................#..............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):109698
                                        Entropy (8bit):7.954100577911302
                                        Encrypted:false
                                        SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                        MD5:8D804A60E86627383BED6280ED62F1CF
                                        SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                        SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                        SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):4.317427797395882
                                        Encrypted:false
                                        SSDEEP:48:MKssq34Ob+V/gtRyhE3yP9XKXc9NsEpylrdMrZw6FXatvVAQirO1l:MKsshOb+5gehEWXKs9N9YRMlK5U+
                                        MD5:EE1ED05389F8C15D519E82DBD4268814
                                        SHA1:4C634EF5565AC7EE74B0637A39F1645187025AF3
                                        SHA-256:AAAE2D669705444558164904888759FA19B202C3C2B3AA4E8049790D45F82049
                                        SHA-512:0016CEC215C4086FED6934C2C2E72A42FD869EAB846A69FC182406305D7D9BCA728FE491415C4D88C922416929138F887FABA0961BC68A97A80749FE5667CE4B
                                        Malicious:false
                                        Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........e......f%^.....e......f%^.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............c..n.f..F.Rv.z.....N...^...............(..$D..G...A...........f........................................I.qk..B.....LZ.............c..n.f..F.Rv.z..........c..n.f..F.Rv.z.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):41893
                                        Entropy (8bit):7.52654558351485
                                        Encrypted:false
                                        SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                        MD5:F25427EFECFEE786D5A9F630726DD140
                                        SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                        SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                        SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):3.2906106048148978
                                        Encrypted:false
                                        SSDEEP:48:G1iDrnYzFX8y0q8j3CEDbPUErl7v/uDFSm9E:HPWM2EDb8EpAcmS
                                        MD5:98FF8354731EAC4D9568F94BA4615877
                                        SHA1:69069EADBC3F42B2E013A7512F61210B16C9A74A
                                        SHA-256:F9EA48D180C0A39A27808B4A5F07DEFF2FB89EAA3F6536B95117B15D5B8F32A9
                                        SHA-512:AB842B634F129DE967A1C1FFF5EC5CB8BADD7A480B223C80C951FD014B297149F4B7C19B9462457FB9506C5682E516ADD4C64DEA4B0D008869215B021BDC52DE
                                        Malicious:false
                                        Preview:........$...........t......................................?....................................................................................................\.......................................L.......L.....[.9;,.o.I............'....4...?.....'....4...?.........C.k=...u.b.."......Da.].E.........D...........................................................................x.....X.........4...............$..`.AT(Q....DT.9..}.T&e................4..(.....x.(.....`.A.....`.A.T.IM.6..+....D.......Da.].E........2...v.................................D.}.............................D..........c..,0...e...B4.$........[.-...I.......9......................}......}.....I./.r.?|0...........C.k=...u.b...L.....[.9;,.o.I.L...QE.T..."fj..7'QE....Da.].E.........D.....>.......4..........C.k=...u.b.."..Da.].E.............................}......L....c..,0...e...B4.$..............E........................................0...........e....4..................T.o. .D.o. .L.i.s.t........s.)..O@
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):12288
                                        Entropy (8bit):3.8889914652809128
                                        Encrypted:false
                                        SSDEEP:192:hs/YU8Tbw3aXEQTMlPsRzSHKs7yZ5KOHl9+cx3f:2c9l80RziEL
                                        MD5:7FD1330FE585C1102AA23D87957C47DC
                                        SHA1:0EA6E0B8C0A79BF36832ABB539FD27935082C502
                                        SHA-256:29A30E2915D3E8984F7CEF6A073A5171BCEB3E16AECBA898042B03642FCEB632
                                        SHA-512:C6698306D5BA05EFD4DBFC1C6CAA2F5804144DA6B9B4443CB351A19D885CE91B3E0E095DE60FC8DD9082CDDD8EA379AC6BDBFB2CC326AD01361C1FA52747A27A
                                        Malicious:false
                                        Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ4...;...4...1...%w...1..4...1...%w...1..4....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................-I...5>..Z.'.....N...^................|.w..2E.;....k.........h...L...............................D....I.qk..B.....LZ...............-I...5>..Z.'..................................4.......4.......4...........................................4..j....4..T&n..4.......4......4..H....4....K..4.......4..$........4..-4..J4....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(4..#4..84....z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                        Category:dropped
                                        Size (bytes):68633
                                        Entropy (8bit):7.709776384921022
                                        Encrypted:false
                                        SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                        MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                        SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                        SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                        SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):4.078485555171257
                                        Encrypted:false
                                        SSDEEP:192:lrbxBCD33fmMIhQs/1YExIZPaGFPFw/ePFyO3MhyqBxVhA7c7nBAXK6BCIUHRJBd:xuTh/SOZPw/QyR6c7nBKyRJ/FKuSzlZ
                                        MD5:FD4A0B25E9092B544E76433C16B3E78A
                                        SHA1:0F7553FFFC9F4811DFA6AE967392822B02C76387
                                        SHA-256:ADCC7770084532909A5C84EF73B526D07825C3DD1878398A839A670C6C4BD0FA
                                        SHA-512:292388A6FC54C8A63343F8CA7BDF5E3D6B8A024344D43E107115FFB1A1D74B80E5967E43F3BB1F85207AF16FE1BE84E8229FE0335263362451AF556344262210
                                        Malicious:false
                                        Preview:^...>.......L...d... .... ...9..^...>...........d...h...@...@;...........................................................................................................................................I.......I.qk..B.....LZ...1......5g..?.N.b._....5g..?.N.b._(.... ..#B..$..7..... ...I.qk..B.....LZ.I..................................................................... .$..... . ..... .$..... ...)... . ...... .N.&.....'...@.....'..2....z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y........................:......z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3............ ...z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'..%......z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1.........*..........%..#...'..&...9......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                        Category:dropped
                                        Size (bytes):59832
                                        Entropy (8bit):7.308211468398169
                                        Encrypted:false
                                        SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                        MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                        SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                        SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                        SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20480
                                        Entropy (8bit):3.2366154651249484
                                        Encrypted:false
                                        SSDEEP:384:7iHlZjGILpmflgnmpGUTvbRJGPb2TxYw:7iHlZjGIdmflgnmp/jbRoPb2TxY
                                        MD5:70AF205212DADCD4FC1C8A8AA7DC4E3A
                                        SHA1:B429CB836F0D7355EB78176068365520F085AF1D
                                        SHA-256:7EE48CD888F869B015BCCCCC555E5A13011CB208FD2445BA1C94F091A6D3CAFF
                                        SHA-512:A79A5292FA202CDD8E57DBF59F3DE113F8042441DC84E15483ABC7661E365F6D4D85BFEAF2B4519CA4F33D3961BA94F32B0C50616DCEFEB2C0BAD54349AFF58A
                                        Malicious:false
                                        Preview:2...>...........v........ ...-..2...>...B.......v.......@....,...........................................................................................................................................I.......I.qk..B.....LZ....P......".].....\q.@D...".].....\q.@D.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............n.p.....6..i...n....N...^................{..Wd.F.bH_..3..............................{..Wd.F.bH_..3..........{..Wd.F.bH_..3.........n.p.....6..i...n................................................................................................j.^.....T'.......................-..................... .L.........3...I.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6................3...9.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:modified
                                        Size (bytes):53259
                                        Entropy (8bit):7.651662052139301
                                        Encrypted:false
                                        SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                        MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                        SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                        SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                        SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2278
                                        Entropy (8bit):3.842171829753914
                                        Encrypted:false
                                        SSDEEP:48:uiTrlKxsxxMxl9Il8uw+26Sp4ZfvrR1KbTOSCdG2d1rc:vAYG/hqfv3KoI
                                        MD5:66A6914EE07C74426654DA8096804296
                                        SHA1:5F2FDC333D00C7B7AEB8FD780741DCC85F2B9A91
                                        SHA-256:48B7F9431EE59C76F0F3F83A0435CEEC23230FF427C473BA196D7C2C9F41243F
                                        SHA-512:E427B740AF47273BE68C97FBD6B8B154DA4F56873C9B09BE0BA09015B1289095468D93A6C7A5C1AD9AA4A61ADC81334F6E494E328AC8AB85CB332DAA1059399D
                                        Malicious:false
                                        Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.W.N.v.q.7.i.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.u.j.V.d.y.L.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4542
                                        Entropy (8bit):3.9942339784481136
                                        Encrypted:false
                                        SSDEEP:96:EYGz1z9qZrTEWOnyoBP11MZ11MLg46NFXzXi:Ebz1zQ6WNu1Yi8BDS
                                        MD5:AF97F0C9585F5C89D47E3F60C2DE328E
                                        SHA1:04B5E3EAB4B63F4ED1A32916BA42447154AD2AFD
                                        SHA-256:40BB22C3BC1CABD90505747A0B3D1D31E4BE7CE319BB4374CD2FF586D899A3D4
                                        SHA-512:A0DBF1AD197DBCC7711FC6D362F27606F82A97DAC29975884D80191FC908DE49E367AE5FFE320DBCD443D48F71A48BB758085EB5CC80A7BBBBF7452A27344928
                                        Malicious:false
                                        Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".a.R.E.5.p.K.b.i.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.u.j.V.d.y.L.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8425
                                        Entropy (8bit):7.975092661506633
                                        Encrypted:false
                                        SSDEEP:192:hjPM3BiT7SSnG9Sz2ZqExE/mE9VZDxLxc5TNa83lDLzW1HP6VUVNRKqbn:y3BAuF9A2ZqznvZlLiI83lSQVCnbn
                                        MD5:14B6038F0669D899D2D2FA12812E167D
                                        SHA1:1F3F1C49F783032029C5F80CEEE7B64FFBB14F3E
                                        SHA-256:CA8E744A6E9F423B5C18F3C55FEAEB5F53765A077B1D6D377E3B334DB32D2652
                                        SHA-512:02EDAB278FB8BE9C21696C494E75AFBC07B212A8F79272D030C10E851CABA614428181B0D284B0B5E51D86EC88025CE72452AEFBDA0862EF5D3738406D54B2A7
                                        Malicious:false
                                        Preview:.L....K.....0BAa.+T..}....t-...W^.zB..%.[!.....I*KT...o.@.Wl>. .......l...))gt.......W...y.K..5(=..f.hB../.+....Nt...j.].a..F.......t.&|..!....?'...)..}>8&...;.3....%..a'......M....|..!.F....>.M..u.1Q..i...UC...R.`Db<p..Eh..+q* |.;jEf....7......L3..Yk.....g.<..e.#.O...|=.........Q.............,.0s. 8.[V...R.Wj..E.....m.u......F.....v...4#9..1..Y......;H9.....06.:|........T)1p(.........|Hh.u.p...GF..7.....zS5o.....`.6.Hs...p....@4.....<...r.v.r......Q.R...~:...?&~R.>Fo'...fX X..0$.C...:....E..m.`w.j.U......#^5..e.f..K.~.q.b@.....rAn....=QF'.)......o...blq.pB...\me}smE.m....n.*Ge.D5)abl0......pc.u....<1..&..W..s_.~.....j&.vD.PE.t/{W..w.m...F.Zy..w..........He ,......nbO.V.L5.x.[;.T.z`....."...>.P.9L.x..%.....k".;.. D.d..1./..R.......S.2..G.qP..x...V..r...kF..@.....!......6 ..w.v..Kf.Q.+%.hI.Je.&}&.6%.3..r@..J..f;...N.g.WoB.6.B..Z...dBQ.j...b..F.#..CR.........q.B...y#.",....l..g.....[.P..5..'.+..q.@.........~~.q.3.......d.h.I.........O.`.MN
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.97380164139125
                                        Encrypted:false
                                        SSDEEP:192:pSs4bYo83ltgZ4ab1HyP1sl2PZ69/dBIyKpx6BwrWz:pSsUaltgbZc11g/dBupEw6z
                                        MD5:E7F37BFAB5AE88865AB0484209F0589F
                                        SHA1:AD8D33324B1AFBB891D26DF2CAE66D10CDB83CCA
                                        SHA-256:049D8F7DF7552DB10751D10A4599FA9724141318C11331A25678ADD908A26B23
                                        SHA-512:68CB752D06C5105BD84EBB83FF3505D6D531431DB102F5320AB3AAF957591CD29FB1719187AE40B86C73CFCEB60089F9E393BF8DB42C568742FBD205BC7A2141
                                        Malicious:false
                                        Preview:......o..R+...D..F.6RsV.?.....c%m...)..r..y[b.Xk..S.4Mf"..7...4.........>.L..u...,.D.'........8.Y5L'......7`.wW.(c.....m.|.]~9...|.d?.}..fl_.h.e?...a.aP...~(+.C)J'43.d.!......4.^X.O`CY../-.5.uU!PP.|..B7.v.....IVN'..,.pT.Y...so.2.J.b.2..v..:`}....5W...xY..@.f:=....bA...X.e..s..c;.=.G.2..D.7E.B/....]}...f...lr..f...OE...'../.2......M>&..+#.i.p.#...E.zZ.^Y...:..Wz..z.9.......b.8j..k....-[.R.f._..4...v..c.a..)........."..r.....,.....2.{P.....x.'..).W..T...4....._..]X.FL..}?..ns...0...c%.5[(.C...tC)"N....J...U....>....s..K..N.j.:.[v..D.A..C...:...EE..$e.EYg4_..v..?...``.C..X....S....{...s.X....s...{.#xI@..~.....k.......?.1Sw.f....w.#.pRD.#..h...A.........M<-n...N.)!....g.n.]w.vQB.[.z..X...+..[.....0.X..j...../.8w*':.Y.....q.W..{....\.#..FV...<#.*....4.|k..M..N.R.N.n.. K.sK.q.C4.")....3#S......)2[.t.......wUS.OI..Lm.\...r.r-oJ..:...*....."..pz.n..U.b0...z......\f-..N.........~>.A.K.P.q?.......L..?.S.q9...k.F.i.|:A8....#.xY.T.=....'-.~.v....H2
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.978338542398545
                                        Encrypted:false
                                        SSDEEP:192:zzXq5YRAmkzEDZqCZsQ2AOuM6Z/o/GuziEdmKJ:fXq42CZ5Z4+uzLmM
                                        MD5:D139C9A4D687DC4E59D9F07084CBC888
                                        SHA1:6AB4215FD0CB4B22AA3F9819B2DF20F6CEFDBEC0
                                        SHA-256:77521FA942A5155AFBF9F56C033E635965B22D5693978D2A4DB484ADE52EA77F
                                        SHA-512:7144C5429D1104D27C780557027BB5014CCF0D7B92ADA4576523932399492BE3BBE659DFB6F8BFCB4E406AAF5A4A3520F71800501D9DDF06BF76E8AD9DE832B5
                                        Malicious:false
                                        Preview:...z!.1..u .c<6..)....v.m....eg<U~.7...8.}D\w....'7..L..6.&...".7....b>,.96S.$..I6}..9......n..RJ...l.l...2a....f...@.0.....V.U.Y`........K"...?.N..^.6....%NB.,.0..?J0..t.....N..%..Q...R..+.e.;R,u.H..../F?.#.4...V..0.w.j*......".....q...|.,/P[..N/.]...l..v...j-.....1B..5>7.u.X......(...e0../A......I.....K...&..U........6\.L........-...>.h*2...l...M.},|..V.x*.*..~..P6......KJ....:.m/..D...+....t..?k.... qf.S.Y..Y...t...-.X\..5...k...;..g..:z.*.T>!.?....P.....t.y(.bT..sT.....z.._.5........i-.IJ.(".9p.........T.....?.]m..C.J.j...+.p.w..i_?sh.U.).>/.......:fw..;...\@.....H..o.mT..../H-..N......W.....j..).>.8...O..p.l:DD...w...<.E......,.'....0..Y.....o..4..n].n.G...5...a..V.8%.*.@ m..<..1.~..6..`C .D:..-2.z..O.w.[^<6F.J....Y.....,..t..U)$QB.H[.o.f.......&...z..1.dp.M.XC...C...oi])."]Y.\..H.)j...#7.$g.._.ZM)8M4....g-y*......b.a..).w.{t.9..~m....../..Nn.2...o.34.fi..y..}......q.0...f....b...(.Pj.,.Zr...R.....{.....).R....'...6J.)MTvEJ.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.978122086670971
                                        Encrypted:false
                                        SSDEEP:192:D72HZxDCgS0L/4+xv0N27yF8kJNABJDx2gOPRPsy35b0QbN:D76nDCUcEmag+1x0ZPmi
                                        MD5:86364B04929F34765E1D69522F221136
                                        SHA1:92F4BE19D334AD0F921D1AFC4021924DA8429C53
                                        SHA-256:BF728BE43FCB514A77C976BB5575F73C6E71BC00FB84F9FCF0F067205EC63C2A
                                        SHA-512:F08886DAD7BD85F69AEA7026A7AE881326508D4FDF13C765313D7F0E8CD6170BD836AF3CB402B7196BEDE5E73137EBDE1064AB8DCB2198C69A1DB9A117CBD129
                                        Malicious:false
                                        Preview:...T.d8...2...y.u.B.nE...f.>...9 ..E..[.P]~;G8....;n._6.}..k.}....t........pG.|...*x."7.u...Y`.hs`.^...b;iqo.8...........W:2F.....[.U]..2V................K.v?.HJ-\.`s...<.x,w>..~JC..\......2w..6.e,.qZ.|N....y;{.4{..M.5..H.9B/.5[..*.....4N.dKl.....~5|e.J...k. ...W.}8]W.<..".#.....F...\].C.Z...... ..L..R.q.I..+..k+.).P'.w:...M.?...\._t...%Z p...y.]....A.8.J...S.0....$.W......... ..i.d...;...../..H....&...u..[..Y...BG..6....P...J...7/...j..:z.=.?.....<.s]z.c......4..I.]..z]m...V_;..A...6;...;h..7f....j7....f ...y..^6...=......F..5.....f...Q'BJ.c6...3..rm...",p.....#..E...s.-.]u....3.m.7...N%W..G...4*....M.......0.7]-P.#.x..UR.j...t..3T...a...*......k7j...@i.}.P.Hd;..U4...s.R..h....@.......FW.d.}..b..YL.2'..YrN...Z.&~.2.S.Tx)4..$^.vA9......-.U.E....YC..&......?...7.!.^G..-*.}u>=.Q.a~.....>.g.d.m.....s..~3.f...B...3n..y6..Z.il..P...q...DJ..)".....M....L..'&......,..;..3[R".O,[S..\.:.%<M.i..+..d..k......0...3..*..g.e.|[...[.R...B&..i....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.980854383103784
                                        Encrypted:false
                                        SSDEEP:192:maGktgtacH/nskTbZGH7lnGTkT9zIpP4/S4QT:VgoO/np+lCkTWpAqF
                                        MD5:219B7595E5351D55482D9DA3E4808B76
                                        SHA1:DBF2A825C28D0121E0D701F599AB5E576F1F5BA7
                                        SHA-256:5C1A764679697BA55C7A68B060C84F5D667F7415B4D6F98313475688DEB866DA
                                        SHA-512:6D8D1CA5E826C0F5126D95854C4BA272FEF50BAC08353FC29D115CC51E6FBBE488B0DC768B8862497120D05C0CA34DB10D077C722423A7B027FDDA9888FACEA1
                                        Malicious:false
                                        Preview:....q.... .Ha...K...7W.u;.g.q..."l...M.K...N_..dj..../...#...U........2W-.BJ..]`m.(.10...B..B-w..lQ.... l.[.T.R...&.P...j..X.6......T....p..@...%..N..z.......).I...z.,@y...6..I#.:...u......|.Zy.UF.vs...!.2.E>$..%.K........4{......X.... .!...$.#..i.Y....o4.[.|...T.,./.Z2..U"&.e...Plb....+3.h.B.Q.Li._......$........UB=.N.-h+...K./.#+<..]..W....7.,..'...$.N...k.fb%o.Fz{:$Ld.M\.....#.E.1......i.'b.c.q..]}Q).C.....C...].?..>.rL.>.|...&^..TH.D...?..)qt9f......f|.W..+s{r;.{.t..n2.h.Q'\.;......T..N:.:=.....'.;.?A...|.<.+.}.*....8..e...F.y..'....@.=k..SpG8BoC$b..O[..mE.^Q.h..g..K..1v.9;x."..?h...3.D...+...|.EM....^..C.9.......d..\.%{;...9.t.w..=.......|.f.....V..B.xR|.c.$0..@v...#[J3.p.~$P%UD.wM..+2..-<..=.q....u.Q...U.:....^.1.....r.<...c-...s...B.....b....m... ...U...'b.{.rs!..7l*H....j....."y.3nm..U.(q..]..,R.&..e....7..\.UA|9.........../#3..d_L..-.\..W....!......+.<."."..xk..O.C.*...HX.....v......\&...`..6.Q....^..]..y$..$.?......&.J.(..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:true
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.977880197775819
                                        Encrypted:false
                                        SSDEEP:192:x5nqihOKvJzaKtnorByScwhXzfpyExdMnGtABZ:xsiRzto8SR7YAdMaABZ
                                        MD5:1C711A01BD4563216F8DDB84F8F47493
                                        SHA1:1F1CFC65387BF7C5FD01512918ED0AB5EE6952E4
                                        SHA-256:4886FE8532EE2392D6D67DC686C0059F29FEF5258204587DC083524F07B69FE0
                                        SHA-512:3EDB25880778F3A73C1105D1B4E0ABEFF564CA6741E03AECF2112AAF328202A109D141426B0070B0E360BB7AD6D5DC41D46DF5137B97FC7D76E963B131E6C894
                                        Malicious:false
                                        Preview:#x~.4e3.i...E......%.-R.....t.m.J....G..Z.R.(!P?.)..(..[W.J6.{.%... ...s....,..+.........~.I..$.,.X*n].......Z..K.6c...".`9..FZ;.d8.......O.[...sI<p..1;..X.....|.Q.M..hUN.gV..m..z1V....`..Db..RND..r..qi{.+..(.w.w\.....B...OV&GK<.....`@64v....Sq ...w../.1Z".9.X..e.1T..x..L..`....1..3..(......R.J........p....s8.B.z. .w.V.T\..{..G1&.A.X{.2.A..S.pzPl.3...T+...X.=b{E.?h..n.A......?.......y;...!.../~V.3.8;..5C.uT..[....((..i..NjYz../....2....AJ.@...<.OTM......n.a.........r..{_%.-.p..].^b.@.F/Z....2...U.9S...G.=..$.T5.9.@k..1.........V....Jt.#..;2._h......H.}..[QljT......6yl....~..N...>.......^....h..-6~.4..O.,.......w.C_.....8...~V.[.4....O.y..2'....d..,..%U.F..........L.%V.....h..y...&FB.$.....&.!...$.-sf..,o......G....5|'...........O.HjT.R....5..d.".,....k^n7......*.6.E.S...+.cBJ2._wQ......n.....8....=N.........d.(:.......5..o......#O...=i.^./|q...{.,*.u.......g.....w...{n.....x........D3En........I...l...e...<l.. ....;.@.8.b
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.978788122954795
                                        Encrypted:false
                                        SSDEEP:192:MUW2ElkoWNMtPoqBT8vHPfwfxu1T3UCphtbNLUr/PaQYd:M2Yk9NMvK/Pf0xYwCXNNLUjyNd
                                        MD5:853C4BFDEE3F591FD3824C8FE57761C1
                                        SHA1:1FBD351D130A07C64AAF3CD0E369EAB7756AB1D6
                                        SHA-256:7DB9EB8201179BDE9813B12603C622A67D541103C958004DC863BE85DEAE6F4A
                                        SHA-512:E883F8E178E60D0D4184535DEEE4EEA7BE23485A104C0AD346AA1301FDA5C2CF889D9C029462BD237B9FF53FA09C39486B4A5BF5B92A88CF38EFA5455B3D3E05
                                        Malicious:false
                                        Preview:..!<<z.,.....V.K[.....|4G..S.`-Y.....XX..-..).$..M.X7.+......tK..H..W5....Z........a..`|.....v..T.+...O.l...e.U..7.l.y<..i.r.ay..Va. z.D.........1*..@r5D._..P.P..$.CF.....e5...}}h...l{..3.H.*J.3.8.ZF.m.?..>.T.....K:.."T4fC.p..d.5...bS:#z..!..R%...A..} Dd.sh..&.s.RnC...d......p"g....L.>q.........Dy.2..8.G............7...M.FM...3sM.Q$...AD1.Dk.G...p......v....#6.\.%Tkjk.Z~.....z.$V..m....F<..XS.......1..c.....\o).|af.6BR..L.....~(.h.,.....!/\..X....Y..'..p........#.{......i..v.,..K{.(....CB..V>." .....-Mig..~..Xf.o..Fv.....{..q...M.Q...LS..^..D...-c.2.Z..=..@......1..^.....&..........ME.~.V.6.|'ww.I....h.;..b.".1Q .B..-.R~ob*....5..P..!n.uj...........{W.\.....JT..,...4rn.U./.S.?.,.....j1..2..H..E5.F.....Vd9w...S.p..v.4L....dl..g.t.dM..T..]........(}.Vh&..?..6..R.B...cM....6.$.h)..."6....}#@m...6.N..X......l.vy@..g.).>.v....}..U.......A....A...."3.........>...........u...-..q.a....:al...p..5.F..(.........(.n{....1.^U....?..+v...a..D..6..5.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.9746996710771025
                                        Encrypted:false
                                        SSDEEP:192:B+NQUuCR6LED3cCVxKf2sSBgzfwDbEIvNdRvpnwygr4k:25uXWDVx02JgEHzNdxpnwyo4k
                                        MD5:3213854E0F19BF1A8FB0158B1ECB537B
                                        SHA1:0AD7D282FF37DD64530072AA0B5937F0318BC0C8
                                        SHA-256:F2DD809E6E65B3736EBF24248DBC27D21F5119FABB9135E78D503DF1475450D2
                                        SHA-512:DB33C8B53E12BE17A940A0FC44BDDDD5614732DD2DF93BA186D807EB299F804F17954B07E2878444B53084B9C68834DEBDD84C6F656F2AE6354FF72CEE4628B9
                                        Malicious:false
                                        Preview:.Xf3...:.%L..N.p.d@...5.....h.Dm.lX.~......]4..O.+#.D...Ub.......v.Zy5..Q..zi.......Ek-*2:...{.88.../~Cm.........5....p.2......9.`M...p..^.\......]...B.._..m..._.a1.-.'..Po.c.....n.X..g#...G.]..oJ...<.k....9..G/.hd../}A\GarW.<Y4..E[...T.\P.x.PT.p.m.q.ym|.r$8;|^...i..".B~..t.__..;....K.+Z.......7...........G(..v........"5..7=e..j..8.^.y!1..[O..S.`..&.......'.4.mX..5.0\....X.a\.>G.O....#e......Y...7Q.j ..w..s.l..N.+?...5~[....J../.h^...d....(p0.c.......$._.>.;.3._4.._.b.`...D....5.Ph.m'...n&...tD...3.....7..)6hB,.-.#VR....Gq....~.C...r...b..77-!...V........;......qGM;.w!D.T..Y.. ..y.H...5h9y.b.$< .&.....+.#..=.nU.t?.S..dC...C"(...k5..U...1V.6zA..?9l.u.....E.f..,.....s..h....E..`.i.`...n.Y.H'..).?&D.$:......a\.._..eQa.3...i"G..A.U.t.....0.7...d;..z..7.Z..Xi..[...`...g..J..C....x.\G..5.,.YY...>J|....T...4....G.H....z.~.....da../.....z....kb....+.".n..Pg..}.y.rA..0.n&=j...MP$.. H..R...W.c.HC...J....n....c1B...w......9.n.q.[...HN.>j.._.x.{7^.}..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2639
                                        Entropy (8bit):7.929532539055027
                                        Encrypted:false
                                        SSDEEP:48:JKQtEiPqVO3Ryg8A/RV3vN4KZcgijyFDiXQANL9WMHLy4zI0sXv:JFgVO3gG9NPdiOFDiAAZ9xylD
                                        MD5:9D7C06E39ABE97468AE9C17EE61CDA6C
                                        SHA1:0949BDACB6ED93E8DB206EB2CFFAA13CFC15F513
                                        SHA-256:261097E2622447DC157A7D138CD7E563C52426AF1EFAB3A3C060616C53B1550F
                                        SHA-512:5DC88CCADE6D862A283B7C7EB7B279CB386412E20540622FBFECEF94EAC693AADAE22ADFEBE9F09966D06978AB7F7EAE16BA31FB157896BD9FFD0A630F1067C0
                                        Malicious:false
                                        Preview:L.m....V..........u..K"....#.....i..}...%.....2.=5..c..;..}.-r...EC7....'..6|...X.'U..9..zoi.+v...bQ..P......'...6..nxk..'p..IE.2......r.L..P.#.....n.-...F^....nX.^........9I......7..y..x.7c-.4.."u....Q.....m"b5e.".E.. V..3.......8.z2R........-RZI..z....l.3....8.IOg.hA......l.8..~.. X...l.(...A.l...8.1.....g.b.z.Y..T.K..w........P.].........h.~...H..m...L...7WVx....j.K....^T\..k...}....?.....(H!eG{?..D uK.z..XY.\.8qS..SF.(..Z.'..X.?pa........c.X2v.]H....n.(3a..=.7.|...8...D".....7zs.<.Ff...VE.'..8..ar.....>......g<..!.x.<....s.m.Ix.......'.."rt.uJ?Xf...+})..Z.T.XX.eO..m.o.}...j.....T..%k..'4.h..`.^|..0Yt..".,t...VN....-........o~..i...d..:..*?.....].D.!"+0......R6)`>A...%..QVB.+...(..>2.Sy..l...Q\..-_..P2.Wu....`]....q.%.....1...z.A....:....OL..a...n...]y.O..;5q"...mV.....T...`.$y..uO...Z......'.%...G.G..I.Vj...~...N.H.A+...$.;..Q.......% ..h.#.N...pu..7.;..?.0..<Y4..}..#.90....#zY....H..P...b#...%.*yM....p......y........x.5...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1866
                                        Entropy (8bit):7.905437522778468
                                        Encrypted:false
                                        SSDEEP:48:h8ebz4xR/7VGqby3ouDxM5wSYx9eYW9SQjZAg0VjaF2HGxKXv:hNH4P7VObDxM55S9ep9SG10VjaF2HGxs
                                        MD5:99F768010DA4406DC23D31C1DD60EC2B
                                        SHA1:EECD698C7EE0315B4684057711BE0E26BB62683E
                                        SHA-256:A61F29A914654AE949983E09B1795383B7721FC5A50E5EB6733F4C5D3183296A
                                        SHA-512:3B75C6AEBE1C5FC4AE0C34DBE18719AA5E661840BA32798A01A000497FEADBCB372F0C58004E4CB7ECA27D1CC44A5C3279A647C441211103209D61DF07785A57
                                        Malicious:false
                                        Preview:f.Gn>.:....@!...`./ .r...E.\9..^......P.al..8..`..F.&.4.7..o....9..+pD.6.bG.~}...zk.6...D..){..k.<...L..P...3.../.h.z....G,..@V.AV.s...$<.t......>..-\.."........NG.....J..O.;.47...../*..U..|)(1.|W.r..:~5..,..|Z.Z.4.k...K...A:../...$\...o-...H.vqH.y.t..c.3.g...$....O..".....l_.}\.s..F....."q...T.R[n....6..-........<O....g.>Q.,:+..vg7....c.F...v.m.....2..&_x.w..>...C.5j..Z.WoD.. ...6p..@w.t...|X..%!U=B..a..v.h`4.H.eU..D..Z.%..O.........@.J...O....UR641.k..S2"9.l.dJ..iE......8.1...9..tS.w_...q}FR.`...p...U@y..'kq.{...pT$c..".&..]U..rX.m..G..Mi6.8..Te.E...>.TQ,).l...m...]C.GZ~.....-...'..,L!...6g..,.3a.....C..^.h>./...k.)...F.....3..f..f..=..E...B........G(..j..^.^.....U]I..]..p..".Z-...AXu....[...:.r..o+X...F....S`..6.........S..w..Q.%.f.....e.L...M).....{.....>!.nR.T2mH..3.L..{S...AH......S.f.!.`N...."..hR..O.g....?.S..+....D..$..R..}..>..r.x..i..l..&.b...5.z0m..C ..._.+........+B....{"<........Ye..="3x..r.{..kW....>.........Bg)\.).M.......8p..,.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2647
                                        Entropy (8bit):7.9325746248076525
                                        Encrypted:false
                                        SSDEEP:48:SwpnhxL8tSF46c/BIgchQ4rGUiCDJiBCJdg+DtVbOZl8Xv:SohxLu4oyBQ4CUiCDTDd
                                        MD5:E4605FF46EDB278E2F1E0E0805D06503
                                        SHA1:790222D5D6620CC61A24245ECB0196D770664C03
                                        SHA-256:4852F06538966DFEE1FD3F598843E6359815427789F96E1E69E4700FEFD76EF7
                                        SHA-512:A9D13AFA722C9D3778F3A5D012A449CA31E188D182889EAB2678EE52CF79E3C8E0B68A652CF75061D82F15037823D8A463E8954BB18ACCB3902329940DC16A9D
                                        Malicious:false
                                        Preview:.....5.1...p../.I!.9.7.[J....a.K{....O($~.p..o..|.v..M*..q...i.....{vw..].).....j......]J!".S.!9.6......Y.....a$L..).T.1..Mg`..k0..E....`..b....?....W.b&(.^..*GaD$.va...#.Z6.`..r8.y.....4R...7.p.7....H...EQQ...s.....t..g..U...?*@p...h=:m.....t.m...c.0..d[{^..&\......_.,.....h..&|(.2.}..........M.Q..|.g..[wU.......D]...q.&.........1.F=r<s-M.E.YoA..~w.... q....B...e......X.v..?_j#... ..H'.1..G3...O...[*...I...#.q.g...2"P"_0x%'b...o.#.E*....=.."?8F.f3.E4Nz.....h.KKf....#nH..K..L..%2T'Y.o.-.u..m...3c'!$c%\.....k.Bc..r...f=S...U....>...w;.Te..;....w.......~.S....j-g=...Ez^+.{.r.Z._.s....~....J.. .....W....)....... h.+.e...y..T.....b..]....../x.,rq.K.z....I0..I.=.5...V......{...>..:.#'...A^...3...pk?"Z.*@..\...[.......Y.../y.Jw..De..C.R....Cr......%.<..._.5V.e..R..#..n.......s..u..1.\.N.Q.8?..4.:.....I..HQ.b5...Pl..5qNb..rz...E%..C!...o.j..e....7.....o..T..(+...U..!...8..7B.'.E^./.%h%..DX..O..K.:.,...:(..WN.)-......P.gKyJrY..X....l...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1816
                                        Entropy (8bit):7.90967695216178
                                        Encrypted:false
                                        SSDEEP:48:mN7dFx9rrQqH4yEvJzKb6601J7GEIO8neTfXv:mN7d+5yUzb/GEl3
                                        MD5:38D4FFF5089D0590F9327E976353C888
                                        SHA1:D4810FF3C1478812D256B1F9B10F03D295556863
                                        SHA-256:5BAEFC3AF7081EE6CED319EE6EA59804D239A7F35206193CD654A8BDB6196F6C
                                        SHA-512:3846D09ACCFC3468EB7E2D5B390272544A8AC232D39034AECA62C1ACC25D65589B24D42904E9908A7DF9AA1D6E67A5004FD90D45F8F89E866072C6DE6F9BDEB8
                                        Malicious:false
                                        Preview:..Q...... ..,.p1...V..9.r..ni..e! ...6...)J...U.7&..q. .2!~.nM8......i.?.+M.#.SMJry#.}/.jlW.....C&..d...y....!%.=.3.v.V.JM..H...&.u.....B....S%..4..M..W....x..f.W!..k...c.....z..S...p"e..U..P....".........q*.....$'.E.....i..V.l..(.........tDU.g.EY1..7...T.......rO.|.r....]...I.x.....g.;.,..!..|d..."....1..ta...A...#.......{.I..../..+:.@.N........v......k~MVj...{.!t....D}.<...'%.t..u.#..4....Y..(..~......o9..6.G?.....uA1..%$...@b+.,?..'..(..M..(.J.O...3......g.R.F....A.g...:{.@..X.3....DO.'...n.....>_rP..M........A...8.f .n...QI...K..nC.........(r..-..N.......=+.3J.'L.....[.g.djU......\t.W..r...5c..:.5..E}...7uF..P.H..A...2.y.W}r.}f..p.r.*.s.N..2e:7M.Z..QR... ..U....=...V../*phG......".../.....".,".`K.=..:.K...2v!.....l.KO..&..<.t....,.0A~..I...c..@.._...%.v.....%......*..$.c..5.........Fs.!....\.........V.m1.3........=....>.`.9....f....k|\.[m.uGk......]..T.<(.(x.#.cI........kR~D?........h...#..1.G[...t.Ap]d.:.^..K]......<
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1799
                                        Entropy (8bit):7.891283091390849
                                        Encrypted:false
                                        SSDEEP:48:cib/mjN5KQVnV8E0SXRYumFJ9X97EH8by5mcSbQXv:ciOjmCVx9YumT37xby5cG
                                        MD5:B5176CFB7693AC2A5921A5BD3A6FDE4E
                                        SHA1:817F40E5FBB1BB9671DDEE8918F2DEF4672ABF8D
                                        SHA-256:4643EF65F3392FD9C7F548858A6B7FF475CACA2CAD2C4B15216252DF79B2BB18
                                        SHA-512:6D7B86ED7F11E253CFD62539794E3B085120040AB4217D5FDB2007D1D45DF8AA2CFAEC154639E4641423CE781A6D906E2B24DAC8316070A2D245520ADAA3B269
                                        Malicious:false
                                        Preview:.f47v`3.p.....B~_3...9F$.......d...g...k.@.u`.}.......jl.n.ci...6..os./_Zm....kv...F...4-K.@.m.)s0\....G..=.....&g}R..T4..z...C-...7..+...}:h....E....j..D_..@D...iP)..M...I.(Q-.d.b.......e..~.Y.f...>J:.......R.>.'..G.../.O...bC.X.:..cu........%H.-.7.$...t<.'..[.?#.p:J.NBB V....(g..2x........O*;......}.,....K...8....d8...k...|....@G.h.5d....[...>Pk..?.N*O....L.7J.3SB..ba.. %.r.-..@.........v...a.).'....n.........!.a....NE..B..<.o..J...1Do.9.........l....Z%1.....yu._C.......{...re...9.s.?.O...z.'.e.K.[.F.Z....,.....t.+......<;.|..O.p.K.....aq.eJU."N.L....j.99.i[...^X@...-N.U.e.*T[<.........I=6.....#.x....v_....^B.B}..$...&.q...b.!.."...B.{......u.u...;.}.6xlp.v..!Z./K...G..4i.......F..C.9....:..)........P/m?..I........[..:..lc.s....k.c..>.3.L.S.E...9!g..:.U2H......g.|6....H.....+.X.DTA,....e#..w.y...0Q...>.(..0..7.;8..u.. ...09P..J.T.C.\MV...d$..$`RG.....e.+....0/+.V.....f..<;...V.C..E.....|D.......[./...r.]qE..mp.Gl.St..<...M....@
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:MPEG-4 LOAS
                                        Category:dropped
                                        Size (bytes):1352
                                        Entropy (8bit):7.874174423460882
                                        Encrypted:false
                                        SSDEEP:24:QyFWAwxul9l8AkPg0mVwPQcqbZHogTniFncIn+qRvsmQt89UcX2oT7:JYxul96C0wl1HOFnz+DG91Xv
                                        MD5:222DA417EDBBC1F6045F82786F6650ED
                                        SHA1:AEE548FDF674C823C8E0B1C4C1BF1549498E0C95
                                        SHA-256:7CED4A7B7AEAA4F1765DE070EF3892DE51B3F41AA19BD62CFCE5B9735D1132CE
                                        SHA-512:B6356E65D35437BB910E5D0F6B721928F9E8302914EB34EB266CD401F61B8AC2E39276449195301AB20FFBA7E2666210A0B69783442CBFDF41CF3E208D0C09B3
                                        Malicious:false
                                        Preview:V.P...+............U.....ys.~.7[...k\.......}....,..0a.....'.7..P...k...:.{.Cm..!.......m.]..8:...f#....*K......fL...O.hr..19..g..h'}.....v9OoF....J...*.."...>.&jl7~....=.......x.33..3..:.......ni....@.|O.....x..E...`g=.......v....Y.Z!.%..J3.Kbt.......L.f ......CIC2...hT...'.E`..BAG..im.....Sd......&..U..eZ..\.rC.{b.\....t.c.....0....SKl..n.....-.l.iG....I...v.........:..@......;|.{"8+.E.c.<.}..5.....{.r8.s..g.A..L...R.`.......?...w....._#.....d...^.z....Q..........2.~......^M..'&^H.....*.ZXy....u.p.......f...a..O.<].5b.....8..z.\HW..%..%..L.W.....:...}.>...0..a....W....*f.........?..'.,.9.(..O.+kZ.....S.T..~./G'.*W.....dX....kx.`{....X...&......`.A...-...[.(..4...yO...8\?{.Z.H7@..q..??x.r.....Zn{..o.........:.r@U.VR"..H.>1xu@I...E.v.[...%7..t.].\=....2#..G.L.S..1.."E;.Z...j.1}..?.2...!4.%G'S.6g....-$...o.?..e.bv.1U..];k.z...\R.{2....6.C.V.H..5...6....J..'...1.UGiNk....R..4.E....B..a..._.k..Y.dn..]..Wq.&.L.1K.p... S......3*r.m}Q.w.F...)
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1695
                                        Entropy (8bit):7.882162826561592
                                        Encrypted:false
                                        SSDEEP:48:r1N4alyv9kIv2EgjZla/3UIrh3Augys7tIAXv:rH81zv2xtlaDrbs77
                                        MD5:F34E136F8CBCD5D58FC950A86F9CC5F7
                                        SHA1:4635788CC853ACB397BB05506090E7DDCAA2AF24
                                        SHA-256:BB36486F7E124EAA9DDE49A3DECE4512F6CFF54596919ED12535A060DA378489
                                        SHA-512:CB8A6AD248EB2D4E40312941B584571DF8C69299CF77AB81251935D4F88E5028EB10C34758150C3FBCBC93F567962115800AD66FC50AD6943BB5BCD4CB676047
                                        Malicious:false
                                        Preview:&...tH[.=. .3..._.t.]...X.k.....R.,.....@.....\Ft....7O.Io.1.b...L...%:...I..$.....Y1.:3....9p......M"...$......M.s&a...."e:N.....t....m>I.E..x..%.%].\|...txCv.JG.J..J.M.<....A,'..*.....{...>.....X.Q...X.uB+..%..d.< .....U.....(.._..x.....0....K......}N..z>jv.4V.$v.4[.:...C...[>..ub.5z.Agdu).|.Yw.......{...3x.Qp.M..*:.8..C'....JJ+...#.e~:...,9...!..;@..Jb.#..`.c.b..^P..&D...5..\..1.^.ct.p.(g..5F.t.~O.........$g..jbY....at.......U^../.........k...a.....]...t4.E.0b.4......x.k..#.^|.oD....}.h..;ya...]...<tR.Vz.....2u.vfX..r.:...]IY..)....2..Z..?.FY{.......R............A%.3.i9..B........,...&V\.\g)Y.}Qb.....U...X.........u.E._S......F]18!j...A..*Rk.`q.T.`.c;.K.Cu..M=*..r.[uL|.,....v......|2.,'&p,3..@.M............un.;....u^...|.^.h....)....l.%...pxwfLT+..n.I{d.\...eV...1........@...........VD.S{.?6.[3Y.....g.v...L#O....4V...KC.|g........L...qE.....IR...wf...#...6....Z...x..)T.=...3.h(....6........!`?m.....d.m}..A...+_
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1299
                                        Entropy (8bit):7.882772630715873
                                        Encrypted:false
                                        SSDEEP:24:+0CIiyGBf2Np7bhi9F7L1lhru9aDnju0LXWDUKh1tn/yX2oT7:+0RKf2Np7bc9F7LlrdXucXVi1pqXv
                                        MD5:D9CDDA931823072D8B5BE9B013BCD918
                                        SHA1:EC8139D6273A405570DC86C7E85F73A8233482F2
                                        SHA-256:E2C6B77088DF70BC6B3A660505E263EEC3ED82A272DFC7141F282475FD0B66D0
                                        SHA-512:D2AEAFED3285D9BDA37D151C7ACDBC3889FD941C294D65B206A169895990BA6D41C2DE719F306B1E5C016EC20FD744F7178D8D4F62AD5CFEB00DAC1C5BAE43EB
                                        Malicious:false
                                        Preview:.....~.aM........F..N.G.ZtX(..%.].&...w.....co.....Po..n>w..!',...[.....1.q...:Q....Yw.i...+TjBW..2..1.v..f....eE.dy..l.g...Z...s....r8W.@A."N.G..W..7.^......?........-..N.9i8.k".b!..-,Gs.......8..X....^...M...$O..J..H..i.b.Y07]....p.z..9.0......{..7.N.s ..+.xn6.s.]R.I....a;.".!J@..f...md....V.c..o...^.S..^(t!I..u....r..e..7..3R...iv...+_K..`..'...._....=..A..^...HIA6*........}.@..S.$.C...0..../%.h<Q.....0..:r.o....$W.YG..............N.!t.6...)".n..?~w.._.d.h&7.I.~D.G*.....'..vko..l..E...NCf`......J...?..._.>,.0.)...........H.O..D..&...L..h.b8N.........f^H..6#7...^z..../tS3.*...".J.l..gNTk9..u{..Z...=0(..S...Q..&..n.....p..L..k..b....Ks.=.T..........].......Q.Am.Ij..n..{...j.Fr..N:4=.JVG....}l.v...y..}.4D,P<..S.....u....b.'.>......)HMX....w....e..}........r.[....r...2...*DG...n.....H........!..X.sm.......3H....hoD.^.V....5.....OLM./........7....&r.f.Xqxd..t .u.T@VI.m.......L...R..Z..#...8.......b.Eo.4.E..7y..E....5.%.m.y^F..6
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.979221543402891
                                        Encrypted:false
                                        SSDEEP:96:ppcKNI7JFiK9uzg8oCXySYNflYOOqvzb/QlN5bHWJB6LsZjZpt3DuFqmiHrjCEIA:pLGJQK9uzRoCts2yszWBvKFPiLGXNBU
                                        MD5:587AFD137F2BABAB16182D485FE5A9F8
                                        SHA1:50BFB35147885BBF6271F5AF99B7D5C50961408E
                                        SHA-256:9B7A4FA87ED66630398E9F355553F15539ABE4B98F85A4D0962F12A396C81123
                                        SHA-512:8A3520834B685556095345D2EB641E540112E98861495C90E80AE0A194797B492E5A88FC973F02603A8BB587397BF1A002DD8F9B83ECDFFA84AB1A6BDBFAF966
                                        Malicious:false
                                        Preview:D$$.G".......O\.&B...E...<.ck...4a.C:wsZ...5..._..[X...[m-.s.$...=A..WD=g..........s.....Gc.y.z..G.^...r,..}.3J8....G../0....S.*..Eiw.;10.|..W..w.M./...V....X.s.tW....7.z...X..R...........WN......P).U^..3n..j0XT.}...Of...).y5a.....{.>l..."9..B...|>.X..8J..........+Y..-'#f..B..L....n..\...h.U.s.do.U.z....H..}{d..#|..t......./.J..O....jt.Yo..~.5m.......s~..V7s.[pH....}.....A.[.4..4K..h.p._)...lA=H....v...3.1.m.2w1x.U....'......8...(|..M...CX.5O.E..}..7.0.!..#.&..E.....8....Y.Z.......vL.2..S*..Y..u./..-.=du.*......j....Hv.:Ei1.m5*..f.,....W.../lt~..y.s...z<M...pSb..E&J.p..N..=P'$^..H&...a....c.(.2.......b..n^..b......6..Kkt....e...S.....@...G..F..........is...l....^<.W...P>0aB.O.Z..gf.............e.....5.....v.+...\G..........j....Z.L.P.<.#*T..8....0..$....H...Jf{..<U.R.3...=$J ..c;.d....z..(...~aE.A...5i..pu......Xx...X7.s..VG.......e....M.......O.}.e..,..}.&........A.].......:.Um(f.......{1.N..3....#i..g....KE..\...Gf.Y.\....kf..\
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1573111
                                        Entropy (8bit):3.620177509574759
                                        Encrypted:false
                                        SSDEEP:12288:veTLIK+WsyBAFGb6JBllg27Nr4Mgcmt1N2sLSMB/GqDZi:m+duuGmllfshcgX+aY
                                        MD5:44DC9FB06CDE4759A7ECC53BF7862F2B
                                        SHA1:3FD183784A435E983CF900765ACBA451F61305DD
                                        SHA-256:C089A332FD9D7D4F058227AE3F3B93DC0001BB8ADCDC7F2F7B5431E5E6CB7617
                                        SHA-512:ACF8E4F3699F25D3D546CA5C1B124EF1D5BEA0859F70F588C21CE6FAADAA9D3ECC513F1CD120B39C3063FD154B597D321C6FC36AAFF7CB990EB2CE330388A86E
                                        Malicious:false
                                        Preview:o.q..R..Vq...C.......U.Jq.E.1..b....k..i-..Q|.i.........e...I...?e....ztT....g.P.....7.l,..S....`.E.u.....P.i....c.y.Ny..>|...Z.}...UP..wg..5.+..4.rs."..E.r.a.r.<..v...4......J..............0A..4I.f.......}..}.......w..`O.].N....=^..y.s.b..^Y....%....m.|...n.+...4.Osdu..N.T....%....Y.kU.2."3..H.h..g.....e.....7uwI.D.....O~.W+..h...1..F#...7@YN.T.F..\.....a....m6.Ul.....O.....2.?...@.NZWHL....Be...)')Up.&a...W../......,..........6.hnf..]<.I.J.Yo..._I|.r.......^.# j.....j...X.;..7...:.1.S......0...J..=.DY....,.B..P|....i.DtZ.....K..=...I..2..>#.+.;..@..~.../-..u.........}.0. U..oS.3*....D..&.i.".....6....2.F.p.\f...).X.x......H.c.m...u6.S.*I..(.n.605B...$.".G2..jkm..i#.....l.h.i.<..jP..u.8....r.dM..|/...E...]U.7?..jp...^.m.f.....t...B.,.XA.} ....f...;.....v..?..(.}..........3....1...k...1+...F.._.3..#...........&.R.v...t...y..D61k.MC.H......".....HC..V..xROg.a..!. .....D.?.:%Q.E......l._@..0.._.....?.w..D.O......gZL.<.C..;.D.!.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):16632
                                        Entropy (8bit):7.9877787409813115
                                        Encrypted:false
                                        SSDEEP:384:fKKeECwk++gBUa/EB7YPxRywKIO2MoHVOFiEV:SKpk++g6a/ECPxIbMHKV
                                        MD5:1B4CA160B1F9B9B98B8A3571D99ED8E2
                                        SHA1:80E8E0205D29E9D7F12F2A45DCD2EB7E6102D52C
                                        SHA-256:91C8E0726324E74B24C6682C418D6D4C047172C0E7A69E6C1DFDC62C1B5119F6
                                        SHA-512:85D8991D0049FA3BA616371DB90255D4D42A2AACE205345320CC71D2C2F5DF2D7E543FA08C01032E8E9034D17953710E63536A078DC17759B8D34969D52ACD87
                                        Malicious:false
                                        Preview:[.J...a.......b....~A.,7....x."#.Y.Q(../..~KN6......r.8b1.wa.m.]}..?....o..:Q..w...%.P..f.&....D..B..WOMX../..<.jz'."R....i..U.R.U.."..".S..Iz.CHi.A.5.....M.........*.p.8A...|%.....f.tg&....{'s+..8P.e._..............A..'.W......i.x.B(...:.Bry..GP...7.V1.Oh.kt..+&..oR....N...,\rr.1.e.....O2....i..C.8....j.U.xh....a......3....[.6.....X.c2.S[J2.Pg.GiO..&..C..=..@\.....21..h.+M...}jXo..^..^.Y(.Hz&$9.e{D7@.e../.].....hJ..D.{c.C.}+.39+.~..c#t@?.&..X...c4 <+....<.<.8....m...D..9.F.|..wD...H....G....&`....Y.o..Q.T...8....9Ix.....$..|...........m.m....0.a$..Y.s`.....y.....K..E.....?.Y.rez..C{.!..~.#B)Q.R..{.s.j.O]....`..Z..P%8..x....Y..w.q?..Lq...r..Y.?..{....G.a.o..8....B...2".J..n...ENv..I~.S.`wl`<..........9.x}.].c97T..M..8.....J+.2.mI.f....E..0{jX......+..@<.....\..wF..Q..a1.jn..{,.q..!;.........9....L6.8.qL[...'.. DY.&.|h.*?.y.c.c......;/..S!T.P....,.C..%n`8.:i{jG...?@u"...-.Gy.......E.KD*..n.....t.|.D1..T...A......OjAD...v.Z.C...kO_U.}
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):107444
                                        Entropy (8bit):7.998183934667182
                                        Encrypted:true
                                        SSDEEP:3072:Py5zwoYG49wZXD00ADUhz6sw7LnKppTKW:PboaWDOqonipmW
                                        MD5:DDD9589D78AEB85255E4C0F0950417EB
                                        SHA1:5B06B6DD2BF87F40057B0AA7D376749289011487
                                        SHA-256:5F96340F649C1717E9FCDEBC0C71DE0FAE8F5FF8EEFA8C5B787B9C24A2BCD5DD
                                        SHA-512:0F5ACF088E5B31F733BFA0BB4877913143F62199616E3B67B4803E6A179152D360CD8F923DB5D89F58F064D4B9366E4E699E39912ED4409AAEA6E5FA6188DAF1
                                        Malicious:true
                                        Preview:..G.Ea...u...B.Z....h....T..h>.E....-.t.......j )......=.....C.....o.Tw?.vN..V..Z...9..._e+W.B.{xb[F4s....t....{.?U.J.0|.X.U....3...e.`..-`;6|.X....-d....Q.ok.H..j.0.&T..1.Bw..M.k......-l9..5..Y. ..../;}/.....#L..mo...E.(.....a.H..dY3L..L..>...B.n ..h.z9..>.R.[......!.M;.VcF>.....tw.....(#..D...o.V=....|..KgC{..uM..IY.y......XF...q"*.5..g.^...~8p.....J.O.f....gSK8.....Q.4(.<..........n.=..?..8I.*...Z.=...P.`\!]..j#"...0..J......9.Eh..2.`.}c...Y..Z..N.(..vC.......[|.ash.d....f.:.Ej..194h.f@.,._@".2.,....\E;Q......X....0.etV..V...H..r....A._...P....P......Z.....GWV#.....-...o...L.}..#=........d9.p.&....DN.?y.O.7.R.Xd....C..}.7..j>.U...@P..w.{.-.c.'M.C+..:.ch...cGi.IvM.. .ps.h...D..P.b.8.._...:.[z...?.-..M...6.OL.n.{.&..R9.U....J........b........C..._.=.,A.....8..h)~U.7.He.i.]...%.:..}Z.}m..=....'..r5.[w4]V#."&{4.{.W2..m.`.NW.}`#.q..d.X&..o...M.~b[....4..F@.I.UI.4...D<....j.....J^..........p|.......xb.,H.R..Fa.}.>.i..,...xu.0D...Ao.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.973258793851811
                                        Encrypted:false
                                        SSDEEP:192:qVeXvstSZf5Vo7RyO23GN3x+OcpgohiH50Fz0:XEtS14lyO23GN3gBpjhiH50Fz0
                                        MD5:62FD20052CC9D884F2C4B857C43364C6
                                        SHA1:BB99E0765D42DAAC7F90882AA079460481548EEC
                                        SHA-256:B94ADF36A6C1E4E45A34D464D75C2CDB67DDB21BD72DA5F1EEE25B0D6CA5D55B
                                        SHA-512:AFA3A2E9C3B88762401A7C16C25DACB37BF04A3CD2975D6C9DE41416493834BC667A74B964B9190BD9CFF132C96AEEF215A14A6CB5B065716836A97A5DE9F082
                                        Malicious:false
                                        Preview:..QG.$S.*5.G2.....S.....e.?,e.u.G.<.A./G.8}c.@..c......g.....eY'.C-8.k..g..........8.-3.. U4(.Q.E.'.s.....*.p.__4z&<.m.........Ch..MsY.g5.T...TH...Ko*....A../a4...[...G.&.u.H.....*.r6.{.ML...^S.r.e|i.Dmhg.F....N..E..T]n...O.......d..F.Q.6#1....@.C......a`..F..e.......5....E4.el.....>..JaoQ=.......1.IG#/.H...........;.r.....r.".$.)._..%iK.2R....3|1...!.......:B..X..6$......9.G4ip..s7.0PN.M0..s.c...t...vXy...ERk.......SZ....d..s).Ng..g..?.5fE...F..B.....{.:.pE...-............J...,..6..V...]...a..._...$Yp"z..../...0I.&.uC.v.BH1.>...,.+..y......!(H....P....v...!EH..^...%..jz..0......_G..._..].c..}mu,.j.=bi.(.F0....oG.....e.>G......&'Q...O?.....\.M.9R.{........S....@.eR.D..#EPj.I..,.5.2..W....V..1..D......;.....x....\.....kf ..k...d..i.5vaF...k.>}...&.um..5..O...Z.E....[,|\....:3..H.L4....7.....d....Q.Q;1.G....9dx.2nD.^.Cob?$....L.R.....!.kY0._.#Z...1.+..Ss4.6.z..v...U..).....>.8........D..V%Gm.e.M...i.........g...y..~'p.h....Ka..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8427
                                        Entropy (8bit):7.979118191599123
                                        Encrypted:false
                                        SSDEEP:192:xdWZi+6J95uZIy1kEmKqxvU49reXQ8BYhWM6mM/U5Ys8y:xdWZhUIpr7IU49UTBwzbuVxy
                                        MD5:5F42F654958F99B1BAD62CE895FCD288
                                        SHA1:FFCE63955B9B937CE0AC552D77329EE1ADC39F7D
                                        SHA-256:408F48E9ADBFAED804D746B2A8E4C07F56FE64F360BF2429BB928F159B257B97
                                        SHA-512:923186B1F502585C933A1201EA0C86AC376118A4BB0339761C5A254D1938859559860C61D907AA74B0BFAC9C01340162674D4DC6C90214F6193217DD076C14F4
                                        Malicious:false
                                        Preview:V._e."..; T.G..to..%.ucz1...{.F....vf.d..45..>q.5...Z...iy.2%;..S...m+..W..H.l..?..O.x....?_.Q.~^s8..O).~o.. 79..CC&o.l...]....^a!.\...2:..a...#............h.z6..q;.~d..].L.}.......]..;N.......(0y+......V..A..M...&..rY%..bC\...n.1..f...".36..L.C..a..$..1....u...v..S.37...B.m......-ui..I......X+....E.Sc......^.[..J..zx.h.wt......jS....d-..)./QFM......,+..z@i.7.....LM..FB.D.....P..T.W...=m.....D..3. .[Rw..?.8.....[.4.gP.w...&w.A....P....I..n....l%ju{1.b].&..f....H........3.x......L.c..H`:.U...D.y12Ux........8Q,v+jS...NiS~.ib.]...j...N..00..z..../.r...B|H.\.,.BU|b.Lt.|.....w...z(.e......z..M....,.;.0s.....C..g..9.n!h^......91.....h'.0.7.G.u......d.d.v...R?.*S.HK..v...@......V...."....2.>.v.g....>l..E.q:D.8.&....g.Y..x.o.+_......|3....RF.(..Xa..j..2......%......5.@..u...w?Q..1.![+..B...x.^i.E.D.......{.G..KcsW..-..U.m.....h..0..w..9......|.....k...D..{.).lF.L..}:..L.^.zT...5.d@.t...q..S"..f..+.2.a.+..wc"a6.....M.[.H .....\....1.......J.....+..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8435
                                        Entropy (8bit):7.978895100212336
                                        Encrypted:false
                                        SSDEEP:192:zgA9JY9o3CWlPPg7Okvc2l8SOKR6uuBcfnpL:MAHCobtaOSl8YR6uuBcB
                                        MD5:EE2BA7FA89518A5FCA7D71D11E222D20
                                        SHA1:01AC53DEC2430AF6051DFDA0691AFBFBE935E944
                                        SHA-256:66345AFFD631D653C3724219E8703CFC396FD795175F1CEDE601D25F20153CCE
                                        SHA-512:4D2E9EFB518EFFD262335083C2D957B6133EF963739578F4CF9493F711C2E108FF74F9F24562C71820779C4DB5219064A6324B68198E36AFA9C0D47431710AF1
                                        Malicious:false
                                        Preview:.0..1^..4.*`m...B...#..E?x.R.'....y..p.."..?J..~..7......[Y.1..t?;..6..*..^h.........0.....V.....k{}CHK........o.1i..p...............lP.Kn....Ul......../.....g../.{<.w...z.W...heI...4...#._..J.)c..&.....k.......9)E].x+T..7....aa......~.w..o_Q....dmB...TU...u,..W$.Spk...|&.j.$\..gis....y.|...&...F..~"..tB....z.....l.Z./.0.@.<..k..;......!...."...!.J....o...U>{5..\....s.h..2NM_Q..w..".>|E`..(.,p..u.H....O....u#...L... "..r.^.[_+...{.%...N.."..Y....Un..7...Qq/..e..CU.IH$.`.VS..B~.YN.. ...B.6i$..5.q...Xgc.:...0....,-k........ns.....H..=...@.......]A..R...N.J...3M..l+.j.,...?...j..m.P.W.....I.t...G.3......(.|BJ......)...s...K..:....~.j.h...U.......#....oM........}.W..}.z.u.....|.P....b...{.U...r.A.G,`..N~Y_.T...H..t......m;...t......^.(...:.D..;YB....Y..O.@.p.......r3......j.{.s.......@.......vK.....=Lou4.qo.......|...)Z.b3..W*..}...v/5...;.... Qm..m..../..5.*.VC.....,.(`.. ...t..%Iyt....&...D..(.."._/.S.....XY.O._..3R.ah.v.D.1...j......7..E.F
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.977207122306432
                                        Encrypted:false
                                        SSDEEP:192:EXlYMG10xSxPXWP8hsgCS6N68B+W0qYWnp/fvVn4GZhflc:x9OS5WE+/S868V0qYWnVVnPc
                                        MD5:94F2A73A29E1F4FDEE2CD9C98D48AA9B
                                        SHA1:34B36F7E17C40137A8E778148B322D10EF45EEC9
                                        SHA-256:73424D6580D526998EACA6129390B26BF30C76833E49C5E35D941D20A59CD224
                                        SHA-512:35BB6A2C16F80C335D0478520BEE276C46AE9DAEB461ADE214941FFC17BA114C3DD5053A4B50B47825525A244A0D61960C4F9DEFE5AE0B9741DC2E88A562EC2D
                                        Malicious:false
                                        Preview:..-..L....H...J.Yu.U.A.:#..9.%.wB.......<...)C...L..;ThK....$...@.Pu7:.]..fMI..j..4PD....sG..%.#.s...7......W.kt*m.g .<..C._..p.i2H...`...R.m..*..U..P...cb....8.V5L.....K..."..v..../c..={.e.I9.%\M.......>X@y..j3Y..B}..g.x........3...yKe.[w....?V..%.-.<...<.i-..&.........s....#.U...\..eM.]o.05......F\.j.... . .X.w.......,-.*...~.;[/|C...7ds.2.o..HG~Q0!..tY....X."..0....6...=.......[.$.Y..Z.7.||.?NZ....=).j..t..,.C._.W1.^t,.X..d"...c..h....=....Sw....P.P!.eT..).&.I.HV_1#.~.S.)!&N.q..V<.3....s.....%@X...../..k..:[.. 4A.y..8*..........%.>....d...C..c...@V.l..z.%.^..%>.=........ j.c...Vt.-.ps.{..'W...j..,t..i.K......Xu'o.'.x....p......g7..)BlM......Bj.<C#.n.B...c7TK.Cvcm0nd%...|...'..TD...x.F...C.....H4a...1...BO.....6...kk]..b]..X....ZR........9.|.,...c.z.tt....@;..........Y.r......%..s<.]...Z......x....zd.B@.'YU..g.I_a..U.l..g.....:f%....%#..KAh...`@h..4,.6.w.u.e.R...K?_....>S.G.E..M._...B..F\.&.O.>7+%4E@.g..]_E..\....[..;.cu3a.i..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.981821732886773
                                        Encrypted:false
                                        SSDEEP:192:eKmS2rAAAGEpHzHeY7rcIqG+yQx+X9cvBMqM/LgLPKODKP6Tn:lg+GEpTHeYXcIqGeotcfMwfq6Tn
                                        MD5:9D5975EE7404D2DEFB7F3C8F49230A48
                                        SHA1:24721D606A2DABD51B3BAB1F33803DC40F50F334
                                        SHA-256:696FC1CC54574147CF0C1DBF689B3FF5831928EDAB44E00F56F06C8065DAE05D
                                        SHA-512:FBCCBA69BD70C99CB178446F65C5B01422E44865A3049A2C339834DA8E6D4BE5931DE84F7467E7D54A22B2CBBC41C4A6170E516E23822475D73E7E81D7256420
                                        Malicious:false
                                        Preview:D+...'O&.J.......' 1"5.q...Ny....-.QS....{..>W.<pb.,=..Y..._.C3..0..7.7....5......z.}...<.St.a..`...0q.Uj.*..5.H.Fd.c.....}F$.....................-<.|M.......h,....N.*.........].dO.l>......=...!U.....zP.<.....o..........9.x..+.q........p...).V.DKi..U..u.<E.....&....|...2..1.~-..{.....3.P....J.[.`..K.3.BW.m.I.....x.)Y.0.c._.v..kR..E]..W,/.>....4..r...;..$Q...]..B.......8..M'...(..n..Q..O*.w)<P.m?or.0#......:&..h.\.R.N}....Yx...6=...9.X....G.........."......<..G.n$.....8]W...#:9...M.-..@...4..4.....&.T..........9p..5..m.J..^V.E..<._$...VG.p..c.((b.SyL{..6.T....>.....F5je.l(..A....H..T.......i.......$.....J.['.B...%.....Ol..g...F....^.W.z">...1.:V'..J.N.+.[ .]...Dp.n.9.].G.m.......W...1H..(w..h{..9Q'..K.K.c..[;...7 .';Ik.x...)fX[*...x9....i..8d.6/........h4...q..wt.....O..+...o...M.;..2......qF...Q.i..Yy...`....).\n'......H<....g..G$...4....T:...W.....,V.S..q.;.o..VVA.....}.14....Y...h.h..x..5y_..K.......F.)....;.;Hu........
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.980066489486332
                                        Encrypted:false
                                        SSDEEP:192:NJsgYHMttyqm8uBWFPgAEUBs9207zMYKxGEq891:N7YUPm9s/E+s920hCt
                                        MD5:C945D9DF553F7E3294F9178E89CA50A5
                                        SHA1:7D4E3E76E6835C8DFC5365CBE07A396273138193
                                        SHA-256:5A3D5747101DB1E73578319ED1167384F6FD73BC8D67E5967C1349FD581DA660
                                        SHA-512:749AB25A1BB4346E968E5889283E5A20D183628A136FC86BB3AEDCC929D7485732F8EA2A526D639E28FEF3652C780FA530246A4862283B9FA403CA00A4DDE832
                                        Malicious:false
                                        Preview:B..ZU.!L.S......&F...........8o.X..f~...F..U>..A...MuaI.E..<.....7i.6{v!}.CG...E ..|-....Gg"....._.G...sP.....R..q....>&!...............q.1W]..A...-..r....f...^....u.Q....`...7.?.+..w.OW.x1...!..s..n.....G..r`W&.........\o.!.b..B............5.VRK.x.....d8.b?+.~d..S;...$...>.l..*^J)}Bbh..h@._.$x...,Q.......UF..O...f....bQ..H].y.G.........jm.....".q.z..4....w.^..@.WO.0...ed..0g.....a.g..'F>L..z.}8H.VD. ...$...8....n...H.Q.f).s8.X.{..G...z.....^.SJ....n.P.J....#\.P9[..7...FZ.X.J.-..|V..mh./....1..z.X..(..,a..*..hL5sxE[....g...D.i..yv.....T.....P.|..@..$L...'\..C-.#..z.{.7'.).x..iw..Ur.....+..}./Q.V....t....==............)5}.|.>b.=.J....W.Rq....(....aKn...oF....VB......-...?..l..D1.?..E~.o6{h.ZKo.p.Pq.NS_.-.|.x.... ...U.$i.dG..\......8Qztd..*.Z.g|Dc.GvG.zQ(,"..ae.;.8Sr$.`hg..@..].Q.g_....$....dXf$.b..2z(.^...\.o...L6...Z6.J.U.Z.k]d+...=...+.J..K..*....=.j.I..`...>.....M.....D,K.....A.8X%.T.bc..........R .x.0..U.......hl......??B....~.....>N
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2713
                                        Entropy (8bit):7.920425539089753
                                        Encrypted:false
                                        SSDEEP:48:31diG1fvZ1aVyWJb+u3jZHOYYWgcpDMj3tbzRrY9NhZ3ns4UyvQXv:ldiG151aF+yjZWNsMjdbwxTm
                                        MD5:CE6D1BA9DB711115AF049B79F8CDEB5C
                                        SHA1:5505FC4E97D90DD411A080D4F1B7599E8DA629F4
                                        SHA-256:AFFB0B651FA6C0AF4EA09E3A4528C0161A3DC4567C1A8FC702562F8AE7A45CCB
                                        SHA-512:755DAE51FD0C16218A13DD9307B5A47505B6DCE455BCDBAB11AF8197DAEC7679871C6668871AB19C48E713F8E06EB22892EE53AD9155C0F35E322C41F733270E
                                        Malicious:false
                                        Preview:.....%8.OUfF.T.Z..!...~.D.h..s~?<.\..'.....OH..|.J.N;..J....Kq..7...\....I.....t...R;(..7....d&...y p.y.M.."....0.....Sj...FF..u..h..gO>.x..7.....3_.lg....1.[...Z..A.&\;..w...A.[....p.|.P.....\..z...F....).......G<..u..E.r...l$........JG.R.2..~.K..{......:...O..8..}^.U...nO7.?a....W.Q...O.%..T.....o....z..N.j)..?..2..d...j|y.^.q.d..K1J..=..{..D.R?.3.F..B.|..D?...6./R)4{..N_.D........i....-..Z...=.s]..:....1..<......a&..e\PI.9: .9q7L..T..#%.~.3....)9Z?.o.w3h.a]..C.XI...1Ll.L...\.*c.7.H...U"./m...71W.n*cH...h.h.....)f,9Q!....n.l\b.x..U..i0..q...#....F.;.CU.U]...U..W-..8...C0.0.mA&p. :vj...kw...f. C....V....HS..l.jfA3.xLr.A.yN~E....Mo.T..}.ym{.`...2q.]........y.k.Eh..(....B.E.....y.9......Zq..w....tgJ.......i7.J..xoB........E..1..c.0...O.......;UF.4d ....h.it........T.t.'...LDk.=.Bv.!..30 ..w..u~...qU.'...j..)S....S........8..."CO..| &..6.'.{Cv.y......<....%.i.Xu...$YCWi%.X..F.d.......0.c.{...^H....h.~.x.\..."!*...I..w.,.}..X...L.../..[W......
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:DOS executable (COM)
                                        Category:dropped
                                        Size (bytes):2033
                                        Entropy (8bit):7.903001770829159
                                        Encrypted:false
                                        SSDEEP:48:A7oI6ouwhfhHBfy2TdLbYrOcHp24yhJkJ5TXv:A8I7XDfy2TNcrOcJ24+JkjD
                                        MD5:36CDF067CB7FE25D8CA77DD9B4E2D2CD
                                        SHA1:A72CC305AB1F9118A3E0871D29B16192E47F670C
                                        SHA-256:615CD4A898D1470DCEFC055F22D0C303AF71249C26DC6554901F01008F4BA826
                                        SHA-512:85911B47379C258F48D2C3184CCC382F3C91B04236E81A922C31F55FD4216B94D2FCFFC24F04C6EE7877E4418ED72FBFB238C3DD172E8C932490A67F8EC75D55
                                        Malicious:true
                                        Preview:.C.t0.aHH ..s..j..`.....!.x.P..w..O.-....p..wKiw...t...U.p.....O'7..3f..].hg.....ic.>.......el..?TR...c.|l...U.G.]O...].mxn.`q...6F..,..r..sG*.'..g........H.)g..H`....@..2.u.h..E...."...s......A.V...Brk....g.#N.e..{....?........d....f:>._f....).....:...}.....E.s..%y^.T<.<.|..`.|..}+..0...r..XT..y.....}.(.D.....j...Kp...@.K6..@..+.n`.......5...~yJ......6..P.3.........Q....S.........yj.w.9Vd.OZ.......1. ......d.M.o .Q.*.dq.(........~H6B...!+..%..La..%<......>`s.hQ...<..D...=.r2f".E...6sw..Vf.....(G@..8zN..u.....p.FU.......asZ{.....N.x.....S....m...`.;/D.A<h...)....&.D..\.].$...^f....B.ED..7u`...&z.o.....k....Uc.....]_..TN....P.c.y..k....R.@+.....8F.(.f.s3.C.....7..C.O9...\..(.l..L.....i..?..*. ./..8..JK..!........i!L.;Q.W..y..IH.J.).Nh...&.M.......,...i...../.z.(.8.m.x......0..Z......'..6.8..).x.o{..4....q0A.dV.$._.zP.~.S.PF..N(\.:.L[M..=o..H.....{D.n,.R@/M.E.Q...7r_.Z.=...om......f$..8..E...k3..B.=... t.0..y0....dE......N}...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2035
                                        Entropy (8bit):7.910964681823145
                                        Encrypted:false
                                        SSDEEP:48:gvfS1iazvKyTyvquBaexAPS2i8Epq4u7sXv:AqCyT6XcexSK
                                        MD5:4698F2A83DBED0694C6D3365C63876F6
                                        SHA1:446585845D24380961206A010D8FACB7A48C283B
                                        SHA-256:2B0B1D57AD46D69065831FC24F0F7B81D9DCACAE0B77D7F0A68754915E35A1A9
                                        SHA-512:4884F2DBC9706EDF806274A25763D6941AEFC7ACB6FAC722FAE67C8DF460A7E7B4D579536BE38FCACEC3EBF581079565C9FD52A90DF3A959118DE06A59C08DAE
                                        Malicious:false
                                        Preview:.......0......M..0.2.[>..y..)..?y.x.b;T.]Q...C...+...d...V..-"..4..h.G.F,.T.<.+D.$...P.......Z3VXWc.E...R.+\.<......g.l.,...%..}.....25.E:..]...!c.,9.V..,.loQ./v....27..U.....f.u.*.Bq..}..%.h.$9.F...Hu..8.i..PW.g<..$g..\6.YG+J.$+.3.HI.k..*0g.T.@v.+b..t....H....O.?@..n...$M.j:,..`.....N.7..r-;..UY.R.>.#./._..'....:....,b.2SA.3......-.$..uZSr.p..G..G.D.C...d8...=..0I..e..U..n._).`[.d..SE.......{.....i.^.n.8.....d.?..q)X.G..`2.@P....?........F......}..s...(m.tJ.8.*...O(.[..k..l.a\..j..%.....YCjL.Q.%.0..5...l.....J..m..8o.3.IC...'PUD...{.ZT#*U..2..............}.h.is.?.Q..lK....?....O.D..... ..=..:....3.O..[.%.....+...&.......AS.3.%+.i.np.4Ej...x$JIJ...2...w.Kw.{?;S....T.$?.y.&..A..&..s......K....g.gU/v.Z.%\.m..jq.Cp..Xm.f&..gS.3...E..6[W$.Xl...G9..E...[...+.....4k....N....,I9.7.%..oR.. z.@.zw...."..6.../'~............-.a....I...........i./..g..............i.../..C@....Mj..(t..+q.0.y:$...*.....j;b.9..tDcS.&.....2h$%..(....wJ^[.Z.Q.F.h...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2033
                                        Entropy (8bit):7.906948332303028
                                        Encrypted:false
                                        SSDEEP:48:XQjywh2pv88fV1YOfttPlxuvMkp/OXV2+T/dd3yJCNBxB1u8T3wj5LXv:XQeO29j7ptPlZl2Qld3yJCDhAx
                                        MD5:DCF3193BDDBBFF8B851915E42B7FDE48
                                        SHA1:5651622A2A91F2C3F3639515BC3317F118055C5A
                                        SHA-256:3BE53BCA0C8B793B51C1595FADAEA60F662BCA0403373522B72BFEA4338E58C9
                                        SHA-512:C60432E3A25F688D2093DBFEB9997D9E634B6A995E69ED2442E65DCCB5678BB28D8D66194315060FF0D944CC61B1E869A520A8F6C1EBBFE7BF42D10482DEA825
                                        Malicious:false
                                        Preview:...J....-...........M..+..Ts..?.......6...H..... ...29.]....Og..fc..|P....w..o...L_&T..C'.o q..B.....[...v.1...........'H|.1.V.^.m)eL.|...../B.._3..h'..{..;.l.....`.3.`.d1.0E..T.......4.N...PX.]..%....._0...BM.b... ...N._.....Ou.).&...)H1.z.n..D.D..<..o~.......r.;.T.;..{.EJ&..!..+/.}|..0U.E<..1...(.c..aRk.G{4^0..LV[w.>..P.....l;.....a...k.h..u...$..!....z.........E.A.#.N.......<...5...AT.1p.C.|.nW.c.Y.....O.Xp.7:..,..H.0=.P5.......4.J..X.,{..m..:H....ec....A[.r...Vnj,....O+.m.p...|\8f.-MI8.....*.D..'.=d......{.8".....*........W....Z..}I..zis..o.....O......&.>.j...}..Y.|7....&..<.....@.C.(6.....,...v..A..%.[........mf..oe......F...T.n...A..........!r.......#..F\w.H..Db.#R,s..J.].........Z8..u...2...k}.~c*..LC.....I..Eq.%...C!..........yle.al...j..m..QR|.....+..(.}.]Og_>...[...q.0..4....8.~.#..)..|D-[...!$./[...nvp.w.v*.d...C.U.".B..].C.~........4ZB..o.'..a....~m^..+..&...ro.y..1G.D..I...o.&._.l,#k09.z..1......N.eH..w..:..{.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8159
                                        Entropy (8bit):7.974067450467522
                                        Encrypted:false
                                        SSDEEP:192:KzoSe2w4QrGQX2colItiv45HnyfFjxtHDK1zlU/Wwl2uIA4y+:cDwbKQXiItqrF1tSa/Fl2uGy+
                                        MD5:9C3A3FA6A25A2796AB0A9659CFFD339D
                                        SHA1:FC4E25D63D30E70A45F59EBBCCBBA909BE1BBF85
                                        SHA-256:BBCF4B64102AF07AAFD60F60E31DFF9A4E045E7B3E755B4F4FD6D919BD3A6E37
                                        SHA-512:4324D028C043BD59AF62736B8A4E215B06F8F35B3E601AB45CB7B3FD52D806F6FD00EA4DDC09857CDE8F0BFE9ACEC5CC4B55A2DC959E152EFF0CA612F98E1B86
                                        Malicious:false
                                        Preview:........;=A..{3.(Jq^.+....~#*...N....U.X.%./N...}.;.E.WG;..~_...N.,..bLZ.3.....K....}......S.x..&..^.....f....Z..."...7..6_a...3..O|.&..)..T.xmIi......6G|..."..*..Y.W_[.B=.d..*.S.'.$..dw...*.4....m....N".2...MY.t@..........\.-.DRO...l.U....~|.v0C.%9N..fW.....X...-9.....1...N..~...3*%N\G......i..C....g....kQ..<.6}FC....m..?......3}...9h.t..>p..%....oQQ.r:h.....1i....\u.9.7Kb..jC.......a...q.....>........@+l......n..z..O.tN.....<>.>k.S...T?...._.0tq..D..h...%...F.l.;.z=.m..`..8......#..~0.4..H./....A..t@d.>..B... <.!s.-...<o.l..}.S..&B ...T.a:..x.gr$q%..pf..mC.+6..I..<,P/.......*...B...l...F.q....k.,_.......s.4v....i..;.,`..,G.]s...Kf)..4...Gz..R..+$........:.x.IkN=#N.W.......c/X.kx)T.L.^.K........#...!...|.x...{...F...w......I....Yn...]..MB.."eS..d....*.....g...=.0...C..\fj6.:..@...2...g....T..t..HH....J...e...;.......7)..M...p"n^.c......Dmz...1...X(1B..=g&:..A..I..0...(..P..Acz .fJ....J0.s..{....6M(...4.(...1..t.a.mfq..[X...K...>
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):38452
                                        Entropy (8bit):7.995769152138295
                                        Encrypted:true
                                        SSDEEP:768:1WLO0sCJJqtL2mvE66qSwOhsnpslEZvFfZV0fF7AZLBRDhgMeW39M:1GFsCJyshsnpvFf30fBAZlh6Meq9M
                                        MD5:9AB291905927507532E59ED0389401F4
                                        SHA1:B51BA50D943828171EBE4ABED2F82151E62D0E28
                                        SHA-256:82BE39DF4A9EE9829C9DCCF028A24FBB1471B5B663A5C29EF646A621096A0F34
                                        SHA-512:B8121ED1A4E5CFFFA6E67429632826F48CC8C97BA2A6C1C9E0256D5BB94CAE67A7562D3027A8C8591E2259CC224A603EBD71CA1E44CBC6D780444669EC254901
                                        Malicious:true
                                        Preview:.bz.F.dJ.!.cOL..%...;.c.gq...v5.D..'l...m.'... Z..z..5..9..V2.:.....k..e.X_.I...p..._Ax.q...Clc./F.C..`......S.......3..7G......`-6.,....w.y.+......S...D.]..;."......h.~p8...V.9X... .....E..P2".I.m?...X..$.~...K...m..... "j_'.b.7.R....&;,.n..2C...d..]..1.e.XM...k.!.5h5.fh..O.k.....k..v....9.*.28..nPT.V.3oNk.....t.*.q...:.9...O....m.f..V.......-......%.....z7.$........k..O..]c.....\{....i..B...C.5..T.0n*..\......2.^....tL:....{...9...XE.5..".8.a|EL.$&] ..Y..|.....y2..(7.#.-_.j.I...Z.E..]'.HKV...S0.....a8x.m.A....\..PN...,#.7_..A..D.R.9....oz....y...j.4.W\~|GMU..n.<4"..Q.RL:3%|Lp..\e.b7.......w.i..;X.yX.-...#.....G...8A;............29^...?^.....a........~.P...*..u*tii.L^2.j!/I......T.A...&..S.N\...@.7.x...Y....i.8#575"1%...l..,..+...X...H...F.d....o.UH&Df..$.....Dpf.,._......&.Uc./. ......47).j6L..c.C.'!.I.pS...1..l;@..\.rR.i....zu$.9....:o..$.p..<..l1...<.f:...m.=.....Z%......../ jl..l..=g90Y5.1k.Oz..g(.r.....*^6..K$.]...`#.]..4l..7kh..o
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):38180
                                        Entropy (8bit):7.995044041366362
                                        Encrypted:true
                                        SSDEEP:768:khRVjIeiQraOJL4yl0J5GX1TfWyUihbfXKDHvpynqvWDKk+MB5h:k1IqrvJL4TOZWyPh8HhBq+M9
                                        MD5:D1B626455AC49C378C4D6BBD93C69A80
                                        SHA1:9BB9E7B868E787BF7C2F75BFB947E5BF3CD65AC9
                                        SHA-256:23F8FC6C134A7C9416164D4123C543129A8F21EB5D116C7864ADDA24756F28B7
                                        SHA-512:29C61A8EB9A726B6F091703E63D0B755ABC2373474ED896BF64C26DD0A8857ED60E049BB0D36E032C1F74929BD96F04F215761BA64C7B8C9975179D473E813A4
                                        Malicious:true
                                        Preview:1....OG....6jL...........h.X..:.4.Y#..o...4.U^K..97d..MU..b..@_..1..3..NMI".U.B...S..a/.atj....b.=.7Uo%U..`..+.p].......ex...C.Q.i2Q.._..l...)Je.M.{f..t .T....ns":.ga...G...9.]..g......\Z...C..f..%~..\..|.0:[jb.Rxg.......R.S.[...q.=...\.Fd#-.`.#..o$.e...F.r.[..=..}.S..F.....E7.u.V...8T.5o....d..`.9...Ye?!.Az8|.....(..!..d..t.#..........hF.Ym.z]>f..........s.}....9....2_.]..A4...iz....btj........g).Xg.....JW....X..z.._..t0.*.Ty..c.%J........U.......q4.W.9.hK..=.Z\.o.%.7.6m.Nc_.~....#.h............/a:BK'69.aU....!|..c>k.P.`S.....=goeU..#h.>..........(.Al..h.LV 1.;*._.R..JEI;1-a_.....I....Z[B...w.Sv>./I9v.......h.@K..u..7v...J.wai..5=........qV...w.C.&...U...7.x....3d....7..i5..D ..w....>@..a=..-+.p...;.|r.d..VL....C!3...s%..*t...B.$..e}...O!..,..F..U...F.s-..<..L#8.d..NA..j.-g..R....O.......@Fo.8.s...|M.w\.[D.....t..b.M.hB....=...n.....w?X...."[..../.[..N&.1.`.....3j...iBGs.Q..}.v.7..>..}p......'..T....y.....S..'..Cc)d.QC.K.......Fw...e.=.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8566
                                        Entropy (8bit):7.978153858965218
                                        Encrypted:false
                                        SSDEEP:192:VGkHz3V8uhTSI+3IF/bP6aLqZFZmLk+GJlqs8B5nLzC32nlLJ:3Hz3V9+bG/eaWPMLKJHy5LzCql9
                                        MD5:9D414544D723AD38C5829CDF6AFB7FCE
                                        SHA1:D83FD3C835C2E3ADA00055124CCD1AD5B9484EC1
                                        SHA-256:87D34B10B7FC991CB6954C364D7C9B82E905D84BC5647978C51A04A2603990E9
                                        SHA-512:AB19933D673FAAFDA976D3366F12A8037FC121444967B25642A49C56C116BE018EC51C4D93648A3EEF4C84BB48F99C32A364EB322CA115442510759BB57C23E1
                                        Malicious:false
                                        Preview:b.......&Q..p!.,.|..W?K...4.;........F&'...&N9..J=H.:..JSD....:]....d..T.!B..).J{c.v..*TY.d.o..g...|........T....Uf.4.%.x..l..|.\...!.u\h.I.O...hY.(s6..u...$q....a..~....a...~'.=.l....n.......d..^..w..P....;...mf{s.1."..U.UR.L...2U../g...DP1...3...r.........R.....G4.4..sO..k&...]J+.Q.....m...o.q..2.%v>.J.z...)>.{.G&+.....t.8..n9i..pr.'.0..xV...:>...<\.NF.......N../.9D...V.).../...o.}..{..C..S.W.{.q;......u.......8\_~......Y_.l.H.....;..Oj..h...(w..h....5]..Dqvw.$......g8..._.>>Yo.7.U..>9.....S.zT....hf.4$.(.EU...T..c..(w"..3..e.m~.. 2.]!.%..`.hx2..@.o.o....T...+... ..[.|C]+.@..C.m...jnHc$U.sb=..)N..gs<......{.I.S...k...t...{.l./..7.....W.<.:..). ..9.....^6..7.TS)O.s..mn...+..4..}j.W..\..@s...Quw.X8.TLnc....-...T)0....<O.......J.|<.*.G..>...;...............VU...p..:4...........s.v,..D.....(F|.4..Z..{-..R.=.i.$....ZY..e~7..M=.q.dW.j#..e!;.^.|.3..\...h....|.>.......1....M.*^.=.}f.W.......^.F.&u).TeO..J].3..$....5...M...*.Z......b..#..{ce.s..X
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):9977
                                        Entropy (8bit):7.980729481276873
                                        Encrypted:false
                                        SSDEEP:192:tBs3VVE0Bb7AtLBZCp65VAUSmPsKY70oRNF2aR45X3t1y1Wh13:MFi0Bb7mBZC+RU7R7297n
                                        MD5:EABD9C2B1BAB84B30C2C439EFCCD89AE
                                        SHA1:E09B6B29501B73562B958FD0ABA97915B2674E5C
                                        SHA-256:067F26768FF5D6ECB1BBC384A4BB7C8D6A9C4B256237348CBC44DDFE0CBDD92F
                                        SHA-512:86B72E89A7EF62DB1998F1651E24B40650054B266A56430B9C4E97360B1956BE8753A835A80A0F5DDFC283E5EF6F189B9AAD5320F31B7288A899D4414CD13317
                                        Malicious:false
                                        Preview:.F.xHT...."..H.-)Y....G...U/.^W.B..'.\......b.O.....N-....X.&J,R.+..[L...=.......^....Ui..:+.:..2...n.....G...W.]..#...h...[..7s.U..wi..g5F.9.d......0.!._.Y..`..5.m.0#.2.~..7..8P..<IY.F.J...`.%....s....Ci.Y$......8].+.X.#.K.o.um .FN.B......D._..........w.a.W]s..~{j.e.Og?.3...Y....."...1.....@m.B*....W}mo..o(`..f...h.....UD.R\....u#....`.....O.s._.c.;..E..SR.>..&..Bw...("{{..-......5F......*......:.,m{........B .*.q.c..+.q..>.I...r.`'Y..>.'............@xW/..|...4.....0/3.......Qk.C.3h..(%w....@.....Y...5.8 ........u{....[(.w.&d....W.Q.......U.....,.nN.Z.<^.{M.....x....,d.6.CV.....46.MLdv...vN..AS..s. R?.....Te..N...i[..........l.U..].!.......-....\K..).....P.....>.u07.*...3=...`.W.!*g.t.07e...u}.........."1...hk2../.gj...?.b..`.&J&.[.,f......H.5.....D.O...0.....836.hT....$_cG.>.7.".3/....(H..0-..........&..jh/.6T.w.}..m.1...=."...0..T.*.D(...1.....;G...........~...uk.[.`.BE46..r.Y..q...^.H..|)..g:.X5...e.TX..P.+1(.Z..e..........?.t..N.X
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):10106
                                        Entropy (8bit):7.981678633035276
                                        Encrypted:false
                                        SSDEEP:192:QNKMY4QpdjOiS2zCaM0o0+1YvDUzg0P8RgTYeRpreXZFDMg3:Q3K1Of2zCaM1Ywc0P8RgTJHrepFx3
                                        MD5:D952688DCC54D2C8F050B738C85FE17A
                                        SHA1:0035F35E0B8E3B200906A6119862730C6317912C
                                        SHA-256:6A1C4B3985750C2A13E73931C9FEEC1919C074D05290B5E43AAC239944145DCA
                                        SHA-512:87348A7DEA255E3D2D7B1E6180AC03D73A8280809BB116490ADF9A2687505E5C79875D652EA19CC627EDBE6B1B4170CB8A32D9058C21847547C1683F6D1AEB9E
                                        Malicious:false
                                        Preview:=..t7..'..a..[y....\.j...%&!..`.4..v...h...vM......f..#(....v?...jA..p~.?.K.-_....U.%..sj...@[.P.W..[..\.j....&X8.,.............%_#..y....);0.R.B....^.....o."....c.....C2?.<>=..8_;{.EN`....3.q...UpW.....D."..3U.a.s.#.MAN..4T..J.o/..lt._p.:......a&...S.........NCh71..m.}..u.|..G..Q.E{5f..^w......oQq.5..j.j.....%*..%4.!,..G._..X>.H.....!R6q..*...S..F.......TL*@..s..<-..CW. .~..3Z...&/L...i.k^...{.Z..$.@mx..U....n......(..3.6.&...E.....X.*.. a@a.Z.b0$...l.....R...R.."...$UG....%:...}18.N..0b7.z.../..{...Z{".s...={.I..]..Q....H.a..b$qFT.Y...b.zxg..........y"..C..x..nGwI..,d..jo.=.a.7..o~%Kx.8aGu.V?..(.7L6.uo.SA6..*.A.<y..8..Qq.J...%w........JA.n.c.C..Y.V..L..e..$..g0.0G.R..\...#.....<[-..t.c.......}Q..q...Cp........>..&.]>...cR)....1...I.y....upY.U.......|.....*]......?y.r...!g...U..6+`......FJj....f.......Jz...z'.....k.3?..lq...!...U.FK.>.ZI.....P.n...u..pL.2.8....B.\..r.B.+.=....l.....zf.?..$...z!..........j2..J......-.`....oq..j`&...(.{.M..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2037
                                        Entropy (8bit):7.900572205200387
                                        Encrypted:false
                                        SSDEEP:48:NxkrmffPeQ4duFKDRPWIqsTPGkirTlqFhOO7Y7wdZzgbAXv:NCrmyTDxWIV+TrTlqFJCwjz5
                                        MD5:4FBAF169D43606EE94277B5F0A68D27D
                                        SHA1:C47D3DB484155D55DE61694DFAEE9A0AEF1CC0F3
                                        SHA-256:D1E2917D641AA0FB1C40373E31CDE5FBCD3B60F8F48F666E78A255AE7546A053
                                        SHA-512:7605DBC4C4D9F9D933B7489B64FF1CCEB33DC6B694BED69D730BBF6475933EBED2CB235974CD04BFFCB1AAD97FBE4600E011F08DE92B4A2F08D340F6B728FDB6
                                        Malicious:false
                                        Preview:..6.5k......2.-.m..S......L>B...f.....d.ez.C...B.pn....j2.....-..W.C.?...b%UF..[tK.^.V.].]...R.Z.E!..l..hi{L.Ow....#..;.............B....n..)..C)......T4..49.....(...Dh!..I.(.. .E.%_..J.th......]..p.%n6....B0..r.p./;.<.,..v`MB....Z[.+i7..)..S/EC.7?.../.j.mI..5....#*.A...[....G.N....&.S.:zmV......[...H..u):.....DGR.:1.}..><.0..vy..w&.6.F.D.....y....c.... ...N.W..]..m..l....N.jF...C.._F..?5.R.q|5}.B..F....sr.,~=k..UQ..d....8...K.......4....1...l.m;...VoG...i..K..=..5..+.{%...N.....yQ...W._...lV.j.xm..b.'.XH..G..@.Ee.F.4.:Fz........+..@(....R......:......vd.[.@.`.q......#"Q....c..hs.l..[.R....N{3K.....K.cHO1..cfq..I...C...X.o.d.$..9.v7H..#.l...<..7..,..6 ..".&.L.....^Mu_...D.,a/..w;'.:...KxB..<T6..@..+k;.)....b.....:.......6.JB..V......_.l........]>}.^.l.vJd...L).sa56.....C.`.J.i.k+,....l....5....q...y.,...$.V........1^#......].l.H.1UBpI.J.s.m!..X.6...... t..9.I..=K..G.&.. ...*....k...D..j.N.L..+..>L...0.d......E.9.S....q..3..]-..!.'.l.y.L.o...>.)
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2031
                                        Entropy (8bit):7.895036289077857
                                        Encrypted:false
                                        SSDEEP:48:7rxoleSWpsw1fGCtOrWpC1ATxN8C66EIiCiIY0n9lwerXv:7dole3lCrWpCOj8C66v9lwy
                                        MD5:0B263890D6F307531F4FA67EE14CB835
                                        SHA1:851E43BD64F6FE09198C5FCDEC4D6BEB4E854E0B
                                        SHA-256:779B95635EADA14C2C9D82625BE85040A6C21C986DB5D724E167AE01881A786A
                                        SHA-512:176E93A5989C27A9DD254ADE294E2CF0BB9DA22DF5997DDA02D36DAA2726DD45E8E2D13DBFC2600A4BB37DF8D5B78C0FAB1653417DD08FA88E16D6582A8B8301
                                        Malicious:false
                                        Preview:...&g.Oo..m.E.J..ibK.i.tYd.....q<........u5u+.......?.v...dA.E..{.Bzw`..ix...2...E..W&...=.X..j...(NP........Om.2........j,....H...(....RB..O.|...Q_4...-..%....Q...k.7..J.X.qd.u7....9.. _..?$.-.-./....Y.l.Yk.....e6..{O...b.:bl.....o...I1.`.;2,L.l..1..|.J.V...K....*...P..D.)6Q/JN7F........J.....J..k9qc#BF.U..H.....,..4....E....|..t4+.S.....4A.r.Y.J....n.p....G.1.9.7!..%r:.*....F....#O.._.....]u+J......<...f.,.1.8.u...5.R.M..r.L...7k..7..<Rg3D....p.^..y`.......p.$..PQwS..$[K]....5^.=.;P.)&=B.<..D.9q...f....r._........NO...*.9....#IR:.I....9..O..zV.Q...7w.I.F.c.f..8.$...."*..{....#.!...ov.....t..p......p!..<.9....:g..8........%...a9rC).......&5)qv.&.a........K~..(..|....a.t.g...N...($.P..S.v.}X...8!.~.iC.k.T.c\.=}..>qE..xw....m....>,....j....k$U...c.gp3..q<.-..e..7j.s^..../...'.cFv.....S.2.C..m..!v....K....O..;...P.6...z..... $.....6.5...d.#.8Y|.....#)...J..W4.HNa;.&.6]...\.K..........5y....B.....(.g.p{.Y..3u.[.%.y...;....... ..z^..#
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2044
                                        Entropy (8bit):7.913207789520988
                                        Encrypted:false
                                        SSDEEP:48:DVi8woj1NbHCazLx9xccjE6LpxlF+SOgvhvP8L8qKJ/8Xv:uE1JCaHNd46Lpx9R8L1KVu
                                        MD5:DB52460C9160278CF57682A4058A0D42
                                        SHA1:408ED6BF6AD140797EE12922DA5AE8C13FB98D11
                                        SHA-256:863C0BA5815A610F9849A014BC032D780CBD47539C4391684CE801F2486EDD75
                                        SHA-512:9382739C6BB38CAFFFE6C97A696341D246604C5CB1E1502A33074CF44BB37A9D1F041CA6ABDB6AB7DF7D56A727335D3445B7AE5875207BB10081BCFDEBE28124
                                        Malicious:false
                                        Preview:..%C}...$=R.J.......t.3]/kv.}[...].N..z..?.....M.......C...D.....$....T.._[...p|..glr...sL.Q.p..'.....$..s/.><[.4 UJ..5.Yfm../w:...=I.......f.....dz......t?.H...g.t.......y..\U....I....0...U.7.+.)..D9F...m#?.}f[$.{..n.!'z)-....FI....I.....&.........j...>8u._.J....Cb.1....iq..{.X.S_..,.....Q..$..'C..5...kc...7r.j.M^...r r.&...q..O.oV.G.pd..K"..f"..f;..}1X&..4..<Ip.hB.bQ.(..iFN0N.l.A.e.YnN7.&...X..E....^........:.A0......=...y.6ug...9.9.VH5..Z|&^ .&h.....t..V.-_4RX............5s..}....Qz.E...}.`..v.WC';.:.xhK....u..i....p~]...K+.4.a.?... ...D.%#..Ax....B#.#:~.;rj.t./...oC7..-..A...S9.........u....N....J.B]....QC.rd.9..Sa....<....]g2.r..J.6.+N..e.xX..D.@..!C.L...5t...O....[T.0..g..99.c..T.0...>...x.^.xp...V...,..c....[.~...z.`.... ..W..c.a.]t.F..}.H..q.Q...x.!......q....J..lL..).*..P...<\..H,@...1WV..f.H'o.7...BJ.LQ.LM.$y.;f...E6+.$.].~S*.r....z|..Z..iG*...x..Pv...I..0...K.D#.....A..$_F...........w..!d...k...s,T....;.xf.P.[6.Uc.(}.K*.eV../..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2040
                                        Entropy (8bit):7.917241495431193
                                        Encrypted:false
                                        SSDEEP:48:scxjPUhvt4xYFUs51WXxSJWk7606Wo9GaXv:dxbrYFUsjmxX306LGc
                                        MD5:16B3270E2142F17C2B041D6FCC1C3783
                                        SHA1:EAD5E1E835769C90781676B8B460FCEDA1CAF9B2
                                        SHA-256:68F4C451E487A51FB27350FD409464BCB09DD7C6AE073363B1F7BB60554F4D7D
                                        SHA-512:9BCDE22B76F93FEFFF901FEF2B886563C59A1E3BC6D83FF4719F8D115ED50C89D1BF0FE3F78F861D0EA484E1A4B22A3742BC03579F76D46C4196229E4ED2EC5E
                                        Malicious:false
                                        Preview:....c........_....J.,..7-IA{0...Y.K.j0..yI........n.B..........c.S}4..B4..........4...m....S..NNy.........I....'...%.q...q.r|din..J.p>...(n.njG+...P.S.b.c......Yx.-...rw...y%g...r.(..j....I-.u.,[.S.....%....9...?.Bb.....iJ.~.Ub...Yx...:.6....Y...B....P..)f~ZM7..hC..g...n..X..'.~0..].0.......j.....T....e.d{.i.z...GIc.6.B...k!x...a.s.Z5g.K.J.O,U...;.+3h..@...~."`9H.7_X.p7){2...\D..uo.R.g7s.g...^.).m...L.$...e..uO....m..<...Zt\.....[.H..G.d.|=......*...?...|:.p"....P.....`....n...2....).K.P.....A.r..J.U.%..q/4..r...A._{..../@C.[9..Y.C...y.8).l.C....i..8....x.0....$F..np2xe5.u.%B..Vc.[g.......+.,.....w..x....H$."...+..}..-..:...7..0.B..#..._...... dJ.vM.B.W.T.I...D..G......A.......@... ...~n?...(..v..G..?v..^.h...M.$bF>...t.h..$..D.dZ.....!....OAMP...g.z.(..j..x. ..........0.\.DA....o..+....<......S)..ylL....]..dmv...u.2.....1..l1<k6#...@....."..W..."..\B.M1..H...z7....p..:..~`|\....{...2.&.....i.Ai$.o...s.a?....QLZ......1.......t.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2044
                                        Entropy (8bit):7.8966452835789935
                                        Encrypted:false
                                        SSDEEP:48:RC11VjrsQKNE5VqD8laCLwtScUDqPsMRBGI9Ejl2WNx9pXv:u1rK3D8lPLkmqPsMRBd9QfN3B
                                        MD5:AF905D7E6394B1243C9D2ADBE32B03E2
                                        SHA1:91F58E8E072E27C12CDCA02C0388219C815A8B77
                                        SHA-256:AF639C9069A4B710295B839783D8CA3BA51068D97CE47661A9925A05E01F4928
                                        SHA-512:D44E286D7050421C396AA47676D8732733E6894B5A48742836877363E7A32F1FC3EE5403C2741A0D7316B0A2A9AC0D702263B5ECC63A16D405E8649CE8BEC30B
                                        Malicious:false
                                        Preview:..uB.%..>.J..K^<..........5WB...q......,.D..?.a.c.I.>3.tl.3.o=.6 .&...dSu..[.{6'......._..7.F.n....xe^.....[[.+n.;..3."3"......y.^..Tk0.\*...dm$.O...j.`.kG......k.[.o.x[...XX...7..nB.@N.5>...o...Uv...7}.?K...\..$.R.../.....o..._UG.....H....U|.......lx.D......c.>S/...T.k....&..o..jf.[..$..........MK...kR....C.[.&.L.Tv..N.z.d..it...'....'e....\...<...k.J6..........KW....._.ui,so...q...F!P2eP.TYw.HZa.c..........(a.r.!..hli...0B>nT..Z+.SW3..n.........q..."^..>.g..yw..Z...>.Zl.gI.....T.K,...Q...V......F.">F.OL..qZ...5.U..n<..QR.Z...qcn.$g.qN.4....+.Y.=.H?....e.*.....wt.N.v..JU.....q..z.W.!+(....k)._.k.{f..o...!.E......T..U.n.h...~..........sL.'.#...J..6,.j..g.VZ*<f\.....B.?.tol.`...&...!.*{l. `-..S~KphL..Js+.*d...;Z.......}.....S.?......E..D.v.....:..r.....kk..1...F.0~%.....t....U.X.7.(J.f`.@.VRg.5kVm..>.../.I....).5.sUQb.E.t|..AZk.....T.D.N.fR.6lQ&....._9.1..<a...y.....uw.:.zCv..r).....2...eF....b..N.x..............#..4..2.KI.M{.KI....h..FN..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2040
                                        Entropy (8bit):7.914439630625217
                                        Encrypted:false
                                        SSDEEP:48:hvIOtntQBmCaBAHDxR8hPFx9BxNlWrZH9dnB7i8JIXv:hvIKn0vocdR8hNNlWr/JBiD
                                        MD5:55A4D24EB01D6CC96078E15000DB8ADD
                                        SHA1:FB56BCDF713F5585FAF8EF4F06BD9959F1E1608E
                                        SHA-256:CCC2B63AE70B78DB7EAEBB6D2702D4FF8C78A926D89EBD546136E9CD443962C0
                                        SHA-512:B66EB71190592CAF3ED35976415EED488659A670E31C9395E383B05DC3F5CBBCE7B6C0BBE969F5B7A154B7633DF68746708A02568FED82728DCD746FACDB4DC9
                                        Malicious:false
                                        Preview:.......A.#._.......4...2...o...&.Oz.....*..n.`.x.@`...x.L...i..mp.9s..tu.M..y.pOfE....7...-.d....w.A.#.J...n....3h..i.].....D..pb=..\}.v.....M....#L.I.$W.g.r+&w..8.b>.u.qb...iTp.xF...B...\sd.w)c.<.t..a..)R..Mg.|.(.....k...8X...5...3.(....;.C....M/.....U......'=u..(....4.D#.>.@../..5..-..!.m..D..8_..5..9.3.J.W...q...#67.....^......;...X.C.g..b..E@M.....b..&*...%+.34....e...x..~.Q,...!..e...'.D5N<Y.dIyKz.*.,*,D....\...c#(3.f... ....d..P...i.t.xS.7D....:......5&.....+_...?]...1..;|..&.....,.v....>....b...e'.....~..x.`'.&..,....;G.>!.fX.hmS2I.V......2nR...\...+Y..C$*s...R...`./#.......s.RG.:..I..p.B~,..I.!...[M...q...f.....0.E......;...G.d.}.I....!.)M.1_.F..PC...GD.._....'^..}"+e......B.M..PMy..H......H...E..2.@..L.-.6.0\...-,8.:X...03.|....}......5.+.\.V.......+..6..=.{.`.....l..o%o..-n9...].u....P.%..>7.W.8.q.st...\T...4...>.n.......p.dN....Ho.....;.m....z:.L.'.wi..+..&....$c..v.....]4yey....v-.ql.h.._K..n..H..L.....g.`..^.;!..|V,.B.B.Q..r
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:MPEG ADTS, layer I, v2, 22.05 kHz, 2x Monaural
                                        Category:dropped
                                        Size (bytes):262383
                                        Entropy (8bit):7.999204498612706
                                        Encrypted:true
                                        SSDEEP:6144:9xo4XKf8gHCcc3kdvcJfr+AB+pUZhTEzAtSZ4D13pmmuLaw:xX6i5URcv+pUnEzAND13Qm4aw
                                        MD5:D9C826D76899F422EDED8030072F2E8A
                                        SHA1:AB1D486747A6128C56F3BA6E32C3A38161AC3391
                                        SHA-256:8BA4CAE6C801637BC42852D4BB9437D54B4E04C524FC7CD065A20B7F3BBC120B
                                        SHA-512:C7AC1ED93244B3FC69F957DBA6ED240B4F839E0820C5BA75C1A64EDB0E3DFEC69A1A6271E1A2519123944AFCF98555812055E406F985E08E53C7D5172A014218
                                        Malicious:true
                                        Preview:....W..eZ..-mR.B.g.J.4..{....M.iO...L...../3.ENy..w.)_._v..r...M.#.k.1p.].|Ki_.>.u..}S4.^.....v....I........EdX...C X.MX6Y.N.'}.z{.].....E..?.9I....s..U..;... .._.....vO....|c.K..2_...M^A!....Jv.c.. .!.f. T.......6..7}...J..<7.O."+a.<(B..a.q.^#CBXNS..}..'`\..o.F.X....H.7K.W...o..^..u..1......CJ.H^(.8......J.'8..#v../:kE..c..O+U*..W....\.R.q..w2J8.K=..@+.....li.o....#.....{U.*.u.J....-..M...F%|x.V..V......H9..6.<:.J.{..Z.Z........"..'.86... J\.C..@.....-.>..f..^.KC..6T....9u6...Z...1F CI....B.A.....}..Q..#u.s....U..?T.}.<Hy......Yg......V....|....,'.?#............=U.5.&s.....;B.9...:.....]V.1.Qu.Y.).k..#9...."#.Y..Ay8.O{...F@...p._.3.Y..S..A/k!r..^2@.....:..m.'I. {,;=.....R.HlU@..^..p.xW....,..@....lV.I#.|..U.0.2J..8.&K.........j.?.^.=.l..V.....]...VyP$..G.^.K...H...'.F..N~.=G...HpeE.L.U......xW=g........X....{.n.9...ur..........z..5K...........Q....CS.T.....V......F../.}.`.\..u.M.M8|...."{F....'d.p.7....!.f..7.`..........1.5!Q|.<p:u
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.979476031626903
                                        Encrypted:false
                                        SSDEEP:192:nK9NAU4rJHNP+xxRL/VUHxYwaojTFrqngo5Yls:6W/FtP2L/DwfkjYls
                                        MD5:3679ACD58A87B6E889B3A73D50AE9187
                                        SHA1:A80E8DABDF806E876079C40871FFF584B343981D
                                        SHA-256:EC67EF5A10848147AAF3A4A00B03FCE6476C0FBB66B5467A51681D0818B94497
                                        SHA-512:89744567BE7B4AFA92FB1AAC3C7369A2D2EF38D54B29AFEE020AD079A5BC4CD5A45F273ADE334DAA5AC315495130AB11B81EAC6755F9B3E1C1DD2F5A20A5F1A4
                                        Malicious:false
                                        Preview:B..i..C[......R7.....rf.;....=#....."..k.*Zi*r...&(.Z5b.*.Ou.i.O..+.......2|..S...T......,.U...J9.\x.";..9...e.f.h...F.#6..SUgT..!..M.A. ..B..<...[...G.!.]...G.....BD...h..._....|.|.."..+.;#{S.U.@.F.},.{..+. ...........X/..-.P....o.}@d*.....q.cl ...-....J...z..4..c..rO..:.BWt.c....4..%.........m@.... z..A` ..:......2.Y...w..........,..9..I....eH5g.rSA..7.fbI)....$.|J.5zQ.'.2y.l"x..<>..V..n..Y.O...6...$v.n!.})@...\.|@...&.......>.....(."...N7.4.V...<Z@..51D....O).?9...x.Q..~t.....i.......~G.kv.k}...8E>...!...p.=P..;.dd..b..~.>.b....C.b.x.4....'.Q.h.im.!.....UE(....:..t..8T0.l.zB.U...W......6.iQ...7...V*.S../..dU..g-.......)J....i.k..4I..W9.....OJ....m.-.....Z..|.M..U....K......S..g."_. ./G.[.3...........0....8.....f&.....v-i?8.\.W.8Nyi@....\.Z]......W.R........OW".P.]..^p....C.+ 3.-.KK.zC..k{[.E0..3..h<...N&..]).d....g..D1/.9#.]dz...n.U9.....p......#s....22.c..&.Rh...!.G0...D@.9.!.J...w..h.)..z....A.9.!..%.#+..S..T..I..).P.-........M..*.|f3.F./
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.97777842374893
                                        Encrypted:false
                                        SSDEEP:192:rydtiHjdd2seLPovayfN6wuWFG2vTRST3fveHTwWqDQPMWRTl0:rP2se7oCBcVoLnebqazJl0
                                        MD5:1B1E7CE0A792EC3C18E4CC19D01BB5AF
                                        SHA1:9857D0DBAEFE87BAF1350FD67EA443F36D0FBA89
                                        SHA-256:5FE3894B3142D95BF6DAA1C84FDD8F92BCA5FB40DE710C18CC206D1B313842B8
                                        SHA-512:F800E9A60A8C857E8E6061C9DDCA6A60983F71A2D57A0619E0E6F0000A2E95115BA561FE2B0BD0CBC8160595114A9EF6F03A5018FCEEFB1440764B76198BBF48
                                        Malicious:false
                                        Preview:.g)F.p......u...V.I...U.]..em-.!....f..Y+wl....T...3..G..y.G..S*.$}....nQ.q....=^.....v.A.#7..~M;.H.`fnb.,..._oQa..6.[.S..{....=.Nc5.Z.=9.v[..3..?C.HJ6.u,.j..*...A6...wB...i...{.O......=:...g.uP.`r..o.V...gu..4.m.d.........c.s.0D...d\{.r.."..^.)....#i..@..N.P..L..........y...iRR.....K..4..#.[.R.a...u'..]jr..m..e..?]....S...!.{IL..}?t.Z....tvl..P...U.t.rq....P...F....y...r.[t.n.rN....=.....zt....G....;..-.v....D3...G....m/....._.&p....x........B....S0...a.i.c.....%.|.........p.M0"Ix...Y9.|.0.D.....lp.A.:.jI.2C.Z...*...0..UB..vd%.s..J.. ..k2X...^.NV...J.-...I..'....<.M(......y.ere..}.3...z.......-....-N.CC.N...(zI......6....`.|$i..=/.+k....\A5N..)#..".3.Da.m."sP....0d.lF.......s...G..`........V.....u..q.*..>Z..;...-_......F.....,d.6..(t7....u.6.?..r%...G....j...+..I..w..Q..6Y.A_........T}..8LB..uC.t.y..I..@.X?.^........j..h7_{Q...SbGT....<.... .E*..;..!.Tc..C.&.....Y......V?.K......JC..I...F0.. ,.@...o....x....e....Z8...s.$Hz|....r.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.979040075126674
                                        Encrypted:false
                                        SSDEEP:192:ZY1Rf0pYLVHhKC4ZGb1NTPHFdV2LJqQrPn+auNPlfRMqL:ONJ2E/lOPz1kd1
                                        MD5:D6D74009D64DFE9701D1A830B4825D0F
                                        SHA1:969EB66744BD66BBBC7E38C56B1B809BA3C46A1C
                                        SHA-256:FF0791773E1C70676270FF226CE91E5B3154128FF0E901620A2004302CE78EF1
                                        SHA-512:2A0EAF8317E45EC1C26F0F3684888E8F513C23929A91DA444F35B11BF2952C3C8A99BBDEB90E62732A5BFFF40A83B5FA9C0508866AF44185F3E94935A054CFE4
                                        Malicious:false
                                        Preview:..Y.77,.d..HS....T).r.E.1...J.3......7...A.W.eT.....[T.k.....<..c..m..n^q.'ex0...w.D..."TH~....FEKV.Y.]..o.."(_...E.......Hr..x...(*.ou.~?J>3b..+.....76.IP.. ...T8....q....Pi.%.......V_\..7.=....*p.*.).E^...).......QE5u.RB.....w.)..`._.%...B....)+@jrm.....7.......+.M.......>.kU0.U...E........Qg0.T..u[.apA.S.].4f..,6..z.?\.c.....@u{....@..#kIwpI......E.*/.3.F..]...2..w....t...C..4..f..m.....w....t=...l.k.H.......\.l...E.....Y2J.....*{!.\Y;._.........4.u....~.v.:..h...,..5;..C,{.g..@.rG.0...9.:b..N........\........R$..rR.m......C.[u..x5.....m$n..)7..mu.<..nY.w..v=..4...|..6J7;.;..u<.:$.%aOd..C.. ...L%E...H...3....3....H.&W.v.;.q.f[...gR.W.l.{O...S..$."}.....k..,..~.5V>wI._ybg...g.\..5>..Bw_V.,H<.....l..;..rF.G.v..../.x.=...2Z..U..*Y.P..3.T.n..D I......... .]89.A._....G.e.g:.....,..X.zE..^B,..q"hOO...q.`..U_).q...gg...p..e,.RR.....q^..y..>..V.H...z..Zh.%.t...Kw......@..E..sb.G.Mi.Y.......oQ.....d....j..N......*.Vl....i.2.7.\..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.978932441186068
                                        Encrypted:false
                                        SSDEEP:192:uoKmM6KGb2LYP28eBoq2H4IPv3DvnxU2DfRMsXXhS2:uVmM94fkBoVYC3762DpMsBS2
                                        MD5:06802C9329FFC647E457B392747EA1B1
                                        SHA1:A1A966FA382BF562185E1D295673CAB5DDBE80EB
                                        SHA-256:AF5D6FB141710589A12660E7B830F0A05F8168F847A6B478F31CE76634009A8C
                                        SHA-512:BA9C491AB7C58F1AAD30EA98AFE6828D10D2B0C999AF34029B7EFEDDAD6046B175E3A1472A5988DABFC25BBEBC0792D5D2F1B17A50B4615C96F8CDB6A8C5F8EC
                                        Malicious:false
                                        Preview:..._...\.s...&..)..2....G,.X[X.....b.3..._<V..t.C%.s.n'.l*.........-..5._.K...4ZR.h..........2q.....QZ}..V...V.O../<..6.X..`|.k...D.ag%|.7....(.R.D..6H..e.^....A*mT..q....n.........2.mG...S..c..8..E..........L+.j.......:....}...C.i..<b.).`..).....+v....7*.F.tsz...j....[.....A.@....{..F...1M.....s...%....q....4V..e..............G.E.l.B.TM.I.....M..^E..s.k.G9.O..u.6.>.s#8..8^..g..V..".*.M.........W]..;..lq.'.@...B.J....!.........).x2.m.DG.k.|:.f...Z..G...S...2..4~+{=..._.........:...XgV0.....v............y....Pdx.......1.4..g.1.jZ..0'_..#..+...."...WW...D.b..i.x.j....M.9.B..F.|...h?.}@.".:....[.3l.......J.>..J.............)p.#.....S.....|.v}j.z@...X(.... ..9l1z.a..:.Q.r.....G7c..m..%M).i*.<..6.=..u.F.d..A.....`9....4..s...@J.5..uK.p.5..zA..g._.F.3..r6.....40.(..dM.L.V.....m.d...)....^O..X.<....Y`.b+..+a,X41"t.[..9.?D`.1 |..).......U^....k.Tb.v._.E...l].A..#..#,. [h..%U...-rP.;.p.c...s..|?.=..S.M[..[......u..r.......w..d..u..P&.].2.Q
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.979212830351613
                                        Encrypted:false
                                        SSDEEP:192:VaebPr8HyUqjcO+2kT8Rre+xcNztOaO/R+2xzcbEN+4uqQag:VakAydg/TwxKuPcbI+4uqQag
                                        MD5:618B33A9BE45D0E6F1C68FEB9D257BCF
                                        SHA1:023EB874AAFF02CADFB906B6B6C2334863871E8D
                                        SHA-256:E97E78F3B75DDF82F4127B9A87138BDC489A277EED93BE27F0FB738C7168B158
                                        SHA-512:8C3B1D4B84DFE91F96C3F8C84A73B2FE01CAB36740483C4FAEA284533D911B69563AB9DBD0F9360F40B1DA518DD0BC755B3882482EB924D06277892CBAEE76DA
                                        Malicious:false
                                        Preview:...z./....n.K.?m).......~..!..C...$..h!G............?I...do_.~....j.."m7K..^:D).......J..t4.)..IA..@...v...4.z...U...X......1I..|+.K....C.1..C`....8Otd6.q...v.I,....>.-...pU.u.{d-!.nuv..etS...y...ZX.o..o9..}...>.l02.l.\."S.=X=.G..-Oa.0~.j.\.b]W:<....Ur....z......)..}#..J......lK.!^.Cb1.[...Q%...T...{.V7..{.........$...x...~.\..a......J.ZR..OeN<.ac"O.(JS.....U+.3B.E...C4.N...3..NqM.f..P.m.s.....?....uo|M.J.D.`....F..y#.z".<.4.s....;...>.k.......x...v}....L.....Y..._.+..2.D..>.Xc.dJ....Ddr.9Z.-. .U.O._P.F&......?..".\IQ..vk....?,.?E.5.l.'.<..xO.m.r#@.-f..v.6"....M...o..J...C.c.....~.msH3VX..uF...6.......e..3..MD. .+.......".f]-{...J...:S$..Dj6qH'@....4...U..@...]<x..x.;.Z.._$.fE.8.:&....4'...;@}..P.N$...p.j..S...N.....>w..............Y)jQ3...!Y.,'.rD8y.-Px.v..Uw..~.6........MK..sI......|.F....A.e0..9hW.~..n.6..4r...4@.t......*-.x.l../.H.....:{.RF...G.j.oD..=c......|8...$......\..a....e.A..\.>.S.......... ..\...R.. >._..$.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):33023
                                        Entropy (8bit):7.994880023837069
                                        Encrypted:true
                                        SSDEEP:768:2EMhHGN0SzOtvnaMB+Z2LQ3a7JnlOCIT85dZSYJoucQG6vAq8Y7X:RMhGNXzfMKVKtnYCPSYJoxQG6vAyr
                                        MD5:A6942F1A43098E4B1C84ADE12628FB39
                                        SHA1:3A2E9649B75D78AA84036DA746C98EC2DCA84D23
                                        SHA-256:DF43B31259EEDB861B30864E0B903E922B174F83165411423D0E8840F230B829
                                        SHA-512:DD0FE4F6A8EFC6025483B7A7BF4CE174F198D16877ABC86F71027E769525BEF0E5C2743ABC1034A8A1F7A4ED0A5ADC8A2968BAB10549BAD5695AB69C924A6B59
                                        Malicious:true
                                        Preview:P.....2..1...VC.i..#..Qd.{t..%,.y....,E...A.4...}n.zF..j.*.1%9....d.}..H......Z.0.L..`7.tK6b`.z..V'....j=k..|o$.=E.......*.].|K..Sx..'H....q8!:...p..l...\....Pc={`|...yiW.....J.!B.zZm..?+......p.7v8;<..9.*".v..:.E.{.u.>W..H.M.PG.v~H....yu-.<.B..W........[...kF...r.#h.xU.^....2.hxi.$.\JR*...A...:.F`C..f....:j6'....s..I..x. ...A,....0(..:h..h$km.......r...C.y..e..4.........H@..E!Rjiv....v.Mt.3R._....y.0.....sI.h..9s`s....W...sK^.....7}.{.....R\-v...U.JY.P6.....q....6.W;...9.X. .....tr......G@V.{b.x|.ZH.d.)...BT....Y6E.uR.N..Xm...B.p.lk....Z'..k.6....)..s4c....m.h..`>.{.r..O........&..a.$.....m.i.F,xG:...cTZ.....w...{.C.\p..{..i.v..3....:..L......,..Q..@7...Fd.4=..) .?:~..a.L.`l...x....t.5..P..$.l.......&.s.G.$.0....'>p.J.t?.}....@5.........'...g..P.A...T.I.N..&2.ab.t.&..t=...........XK.;....|...".6.L..V.<...f..c.......wX.....h.. .......'l+{Y&.3.D........s.......-.y.H.Q..<)F....s......d..%.=.|.K%j(.k..5`.).!nk.".A..)]......5..iM'..;K..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):1384606
                                        Entropy (8bit):4.28484318232884
                                        Encrypted:false
                                        SSDEEP:12288:8NI0EKdyZ6V95DI8G1q4xNxOKbFlye/XJNol6Pkbsg3vSeuumI+:6EKdykVnSjOKbFlyef4l6Qsg3vWJ
                                        MD5:42F2A076A94F63FC36DF254D9141F8F6
                                        SHA1:E43228278ACD0A0DB2711D25B6E5FB1330C75EDF
                                        SHA-256:C3297C51CE0E5600B894BE0E7769D1F59473C14C0F4C8BF065D90965F72C0A7A
                                        SHA-512:7425263F3E0C04F96871E30EF2C1FF0F71A11071A46AEEE9C8EC772C8DF109D46933DA53508B145BB7584A23E50F9F53B81787384147D0E55DD96B98CEC696F1
                                        Malicious:false
                                        Preview:.{..A.N.........~....{/.1.gj. ...d(p.g.ZY...LW.....].......#....t..AQ.X...W..q].(.2.uZA...pn..U;.e.......|.J.=..4:....|.p.\V....n.y.g;...H........*K..S..g._..*"...Q....$.F.e..[.G....k.JB..'f.^.G.K....Yv.gxq..|...w.>..;....."..>d>..`............*.{...:..F....P.H..|...m.#'.w..I.fgJO..E......4.k....:DU7....l.5.J.A...fb..R@.2 ..<.3..p.....L.V....N.nUB.b...Y.....t.j..&...b4...* Q.Wz..d........l%.G.r_w...-{.....d1..rI......[...'D.!~..C.s..e..zo...0......2.,%...O...M..P..x.g&.:.X...<.4Q.O.k......C.,..G..E.....-.Sg)...0.a.............h..]....../....F....^...e'."!F....DPe..%/..1d.e.....n.8...#~.jT...-E .|....ZrH<=...4_B..Q....!..CX.F.A..0).@{.g.........8......E....ig.s.LT.y.n2.Y1...*....mA..^..Y9....s..]!J....o..T...uJC~YLq.}aM..g.<..lit..Bj.2...8{....Z..o...N...&Zy.4....9....n..kC.. GC.g..b.F...S.y._..F7..]"........iG....fI...:.mkM'..5..J.04..U...PY...r...G...h....x3. ..w.d>:I.U...... De*w..f|-..?I.jB....0....s.v..R.......Z..W..~.e...$.| .N2.U.:+..y.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):4345
                                        Entropy (8bit):7.955465310031263
                                        Encrypted:false
                                        SSDEEP:48:Oo7Qi+L6wuzlQK09KZnf6PRnoCa5O8ml1gnU1qZOC18N83dZX1QEQk+a0tgUl0Gx:ZkBewOiK+oC4mlun6C1M83d1S9TOG2cz
                                        MD5:234B5571996887E8CF05EF387B4B6B84
                                        SHA1:03D0A4AAAB468E4C89003F4C633AF33EED3D1F73
                                        SHA-256:6480B8DD639EFFCBBE683CFE50A4A8B1B52E0337334DF6CD0DC114EB18D289EC
                                        SHA-512:E65202426624CF2F6EBD670ED3A0946E7C7B8C2D8CA0E36A27FFE1BCB5CE4B6D981C869FEFC8B200E34BBC0B1B985D6AE983ED200083A1C8460B0B6D7C6E225F
                                        Malicious:false
                                        Preview:.G......0f..t.>cA.D.q.....N=..I.....@...S.E>...&......x.:...Q....Cm.}<..(Iq..7.G.b..`*,Q.I%G,X.h.3.y X......nTiyIk1..._..e.......u.............$...r..`m..-.% P....'...+.....:.....D!...NP....s..V4.....m8...l........B...u.1-....."...6.S.u.4.X?g..c.........E.......#.&.......<^.J.n}.O....(.....(...Q....]...DU....w.`q.9'xh....#6..g.M.q..x.7..rESi...qJ)........:.b.n...k!..UI0..._b.^w.;u.q..N]...%....>\Ut~a..;......s..p)<..w.W...t..;...6b2...b.....'.G<..&....,...n..G.Ir.....n......oG.|wz...zMsj..0.A...w[..z.c...E./..u:Qu"...p.x.,....{....sP..+...U.3y.*...I.Q:{7.';...[..].b......Z.W...y.:...(.H.V.}..v...I&.=.%..+.S..d...j.....E....g$... F}..#..?Ag:R.....,r....~.>..iKO..a.?hC7...3=.._..W.>...q[r......3..Y........y...r...|..u.k..3....p.....E.,$...J..e/...... .dI..ee .)...?.Pe..8..6GcNHG.|<82...H..6.)J'...1)...?.c@.d......_.+......N.....?.)"..V..Y....<.......G:...=.......e .g.8...3..8WO......Z+.........B....E."3..>.a;......6...a.:.5K.P.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):65813
                                        Entropy (8bit):7.997392204322666
                                        Encrypted:true
                                        SSDEEP:1536:DCjo7CyVu7hRG0CMndpJS1pmAugtDKuVtbt15y85rW:Nw7hRZCMd2HumFtbJ75rW
                                        MD5:CF919498AACA75C3B100FE93F4FEA814
                                        SHA1:C8FBD92ADF8DAE139BFD020260DFC709C90570E2
                                        SHA-256:988BA73ED376F45C0A3FDBFB687B78A69C1C942014BE148E79099F419D718C41
                                        SHA-512:AB6D3BF3EE4CCEB0034339245E9C4BD3412B42E4A42ED88D61193F99232FE1FD234DD25C4600BB5FC7C4BAEA5C2A74B34FFEC3EE36FAB46E3E1C1B8CD26DAB18
                                        Malicious:true
                                        Preview:'..!...{.,.M.X..7...].. /...E;.;.O..4.....i.u...4..%.^.v9....:4a.F..K...X......?.9..J.....c.5/.n.9.S...5.h....0..4.{O.p.;...=F...o8..J.I...e..M._.a*...l.....WU..3..P....o...Y.:$4FZ.i9.....~.D......Knw.....%.....(n.iR...a..[.%.=<...@.'x...{..<R..2....a...;SXX..=..*....,..Q.%../..9."y.y...t.-d.Q..5o.+..!..d.;H."m.BP.X...Dr.......?..T"..Hm.{..8-...Rn$....`<......d..[...k.s...F.....Gq.o..M.j.|.]8..9vZ.9z.o.q....S-"...f=....n}.V'..[<m.c}..p^%Q.wj.{).`...).....'..V....um'u.D....,ck8..y'.]rQ.h.@.....'.b..omz:?.##.x.v..M..m..vP.X#...u..dn...V8.....p...4e.....a...@.F.r...+...6...w......Y.9.2]....lm..........A........"..,:.@...0..f._./.@.d..]O...fD:..-....$x..E..F.Q..*w.-..8..L..P.(..c..@4..)j.....s._...>.V..Um...M.H...L8.K.^\.[h..gU.._nn,.s...rT.5T~.l...4&:...d....+...0..H=.[-..x..t......u.6..y..N,"!!...X.C...E...w..5.;.Y.p.E...5>.Cc.o.?.,J`... ....v*......".8.M.W.Y.0......e.......{q.C..8K..l.)3.r..wZ2....6s.E..x.?;P.E.:.<...:........h..9D...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.977988910090857
                                        Encrypted:false
                                        SSDEEP:192:hRaATzWkdOJnftdlxEeU50bvAhnwLjCA+QNrHYHFzLJ:lWMOJVdlxEWbonwvBN8lvJ
                                        MD5:A6D97A69F96C8372839BCF59194AD1B5
                                        SHA1:9A27ABCD48073AA08232C89336778A3DC09EC188
                                        SHA-256:6CA13307C0C92463BFC8D8FACD396ACDE6C8E3C835A968E1CF32E5317E0B4CEA
                                        SHA-512:5106FA17FCEFC462B84E43E10427D1F1E042F0508B0DDA29FA4DBC765FE37F1257BC8BAFBCF1ED83579176BCB8673E4CA6FCDDF7D66DA1D1554E4BEA91BAA6BA
                                        Malicious:false
                                        Preview:.j4......Q.e..k.....:..g....$u...{.pK..K.......ZkS.$S..H'..t.....y.Z.J..1.T.IW.HQ..D .Gi.2$w.J....0.g.e...x@4...7@.L[O..D......,.uj@o..z2.P....O.|..b.:j/F.:.k........+....R.V...Rm.m..A;.d....LKf.....o..mg....)f.......%..]......./U.(....5`c;k]....K.<......x.....W"....m..S..X...J.p..c...`...;.7.(#cG@.....i....O.K..<.("G......."K...yN.;..TEW....UD..Q3.,..AAT....V.P..'...4D.Gp<Y..5.....,...T.;I./..i....*n.bjj\........c,..uk..D...5/\....<.A{.7/.x.^52..fW&.k.:T..H.=.c.o..sK..|..]|.7.:.C.....@ ..(..%a..IA[.5.zp....i..N.F.z..S.{.9E..9`.c.'Vq..B.T.......l.c.eo2..+......?s...Z.!.b....5.!h...zH....D.......!...<N.=.E#..g.qz..9y....*.....N.#6E..X..%...a...1L.L..y...%..g.....P...p.z..<~.}$.=.*..$..]..."..........-.r.4.W....&...%I......w(......u.k...4........9.....o8....=.O4.&v.q.3S.l.........q.+"Wdeb .$...w.f.L..6.>gPB......m.a....R.]..Q.:ito.9....:Mrf.it...b.......tqr<.. S..(.P..hi...O..Jd..s........Tk.!.P..w*l.....|..l...K...U.n.$t...N.Z
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.975891754826936
                                        Encrypted:false
                                        SSDEEP:192:GX10gX3r2ROPwSm4piSKfAkXVRs/oavXWDLlcH07eYO+L0CMB:GF0gL2APwSdpiSK5RsgavWf3aYD0n
                                        MD5:FFDD35EEF8AEEBD226DCC98FA340DDA2
                                        SHA1:E4AC595FA6870CFC534473990500234869C811C2
                                        SHA-256:E39B594970CACDE99D287B0291248574352CE04B72CD775DF5F05881EC442CC6
                                        SHA-512:A43BA3EDE48D5C6FED514F7F4E6C1E4D93CB20878D6EDFC8CD058B7D2AC7B110C47203F667D5C6466243870321F590311B048BA36850519EDE7D607D5BBFE272
                                        Malicious:false
                                        Preview:....d..P..$.%g....aQ..5...(.oJ..V.j.{.2}..X..|..@.#....N.5......q......6.5~L.zN@~|...}.W.l9.7.q0H.0..Z`.....&.Zk...f.......G...Yc..F.,..#..EU.Z....s=..v.mA..D......I....D\."..c8.1].m.D.W.."......R9..X..7Y....1..)(..L.7..k.0rnq.4..,...n..(?...\hd.k.R.#.x4.L.tj.!...._....TM,...%wm,.x.e|...d....\4......'.x....XN_..7..>>.}T.F.U..n..|..M.^...{...r.+.5c1..j/.C...T.>n;..4I.l..#Xq..b...gj.:.i_5.Y/)?2sh...G.Zn...0.e.Y.-{.e.g..]\....b...c,....6D\BX.z"<.bX.E..vZ...A.!v..m.t-...o...z.....}.P...K=...: {D.;.<......r\E...&.$W.G.....TpVh."......Q.tM,.j...yLQeU.{v....).4avHB.JQ..cc.H.K(.Y..}..LV..JE..W.uNe......(4.RU\...oMY...q...K.B..8.....Q.....)..0K..x.L...E..Z%.bRa.J..Y...W-w..b...TS./k&.....Z...c...]...n=. i..fT...sp.....t..8..m|...C|...b.:V.4..*]....2..m.I..e[}v.9..O..\...:..0u..U.r..v..jsP.@&...e.p.zO.!9%.g..q....|......*Cd.O.P.w/d2x....><...d.c.hX.eS..3'....M........d.;......XB.tQA.MDN.w>.....O...x....Dy6.s..OT%..Y.... .....-...{?E.k..w.7|.....h.>g..U^.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1573111
                                        Entropy (8bit):3.5996679542139325
                                        Encrypted:false
                                        SSDEEP:12288:gJFZpTwWsdEVzJTHxIuHoehMo7pncYgefgGoeDjG/wFc+X:wFZpTcdEVV9I5uaXnjT/lI
                                        MD5:26D9B179E5756E44461E18E1E9429D1D
                                        SHA1:978143AB61C422B060FDC0D4F6AFC9F49E9DFC50
                                        SHA-256:CB4D16403253D685C6E3D1B6EC042AC5B0AED914637DA37D724A13DDF68A75DB
                                        SHA-512:C2E6E17D74B0D8DCFDFD982A24C89B9E3FB816F563AAB6DCA6CFEEFC4FBD0CF78E6B07148F6589C1D1FA946FD2B0355CCFA9902C8910471C7D5359A990D57785
                                        Malicious:false
                                        Preview:..N....o}.D4.Qh...I....DP....EK.........(.1?U.L..K...5..8B...8!.(J.Z.....;.6!J.3iS&.hf....2.gp...3.5r\.....x@.}.5.+.o...z...n.....c..3.n.L...C.V..n.o..#...J..k..a ........... Xu..U'A...S...- ..q.cA..3.&4.GYW.......+.Q4....Y"..{7D#N]+F..:.7PH.7.M..s.~l@5k\..v..p3....j[@.X..!....6.[C,..5K}...Z>Jhu&..G.j...k...^.6.p"..S.o..C.^;...v).t..nx....:E9MF.l|.*.9.w....[..2.oT.......!....C_.....Q..u'R.d..5...<.u7"B.E%....[.#."..R.B~.Y$....Wl..b....t.1..<I...K.6......R.x.t.......Z...<.v......5I.-...Vyz.G..2R.'6/.>.8.B..bR..?...W...::.=.P..E ....U..vZ..u.[!A2.'?.OC\.1...Z....9...k../T.......U..,..)..A.Kpsj,..J3.<...g....K@..%......8.*.7.H.o....{........?.[...|.....-.+2.......\.........aB....~z..._7.tE.........s..!L.3>a5....z....N=......g.o.Q.f.....U..........o....74..*...[..<...%=.....%...%....T....k&..V.E.k.3...Ng...g.K.a..7...q!o:z@V......A.F.a.I.r.|d......_.....N}.G.PnO&L!..`...K.......`@.......X.B......"q.f....FCE..)...n.X...O.[.9...........4D.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):16632
                                        Entropy (8bit):7.987394751082191
                                        Encrypted:false
                                        SSDEEP:384:rpSLYOpxdxcPi84v3K2jXbjfYSruDHncELtCMcbgGLLGB0mrx5no:rHgGPi84v3dHvyDHcEJ4bPLLoS
                                        MD5:05738133E6D7738A4A6446F812E5BDCB
                                        SHA1:2DEE898DAD9DDB6DF4BD46478B33FD5D7484150C
                                        SHA-256:003A1145F898832F9006B062F9B5A095DCA8C766935676F4F28F6371D8D4F3CF
                                        SHA-512:424EE29426231581131258D15313A6701C6034CDEEF30C2F0055B2122901FDF4854A4973FB56027B1866A1802697A9FD1D2C346F5D1873EEAEB88EFB66EA150F
                                        Malicious:false
                                        Preview:........`..s...N...........J@...7.....].l#T.?,...k..........h..6..Z(....G...{.....K...Pu2...f.~.k...!..=G~.>..e.{P.'........QMF\a.F.\.KO...B.WO.m...H..Pb....|J../.T...$.....N.....We....f.o0.LL..^1V.....U[.+..50...".....Y.B"..=./.....Hh.9.+.nS ..).<..n...NR.x$.........n?X...1S.e.q]..T....>..O..l..(..m..8.c$d..]A.l...su..0.Y..n1...-...P.b.&..Yn.o`.....+o.7....([..|=."...!....3..I....J.2.v2.F.s^..(9./.*%1.<.6.mQ...2..<...++...O.F.iq.m.....=L#Z.X.[P..b.".#?6D.c.....vC.....\6P..BF&.5...<..M..w.,']..m.Z.-e....P|f.......*.=.J..k...9...!*.^.<.UA....A1.a-(.n.#.a....Kml7..W...,.,0W_....k...o.Y...m#2.z...F..t.....j.....s......[p....*t._...q.L..#..6.kT..G...c.l5.......#.*....mV._F.v.....".>*7........%..T.......u8..} w..6.~.b....../.{.F.M......o.n.N..d.}......l.qc....jp...k...t..|...>.8.^.b...7...(..b7..B.... dp..a..@.*Yfh.B..n.X.* .P.`.'...l..D..h..9.mA.Z7...7.8-r...'.'..n.l.w..a>..9...[E..{$A. .....3.......ssv. $.9mzp.x.........A-...K.2]1..4..CPD..,.../Z...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):2097392
                                        Entropy (8bit):2.84040651761033
                                        Encrypted:false
                                        SSDEEP:12288:Y0h40DFA8Ja7oCTgH9qWkvMdsAwXxtblpnJecmSa5kkSEDVN:c0DFBocC09qWkvZAwXxtbrJbaGMVN
                                        MD5:41926E23389DBF9BDD787C446AFE72FD
                                        SHA1:109DE68886F8F114423EBF2A9D525C6CA11435DB
                                        SHA-256:D4266E7B9AD53E1B52DFADC0C1B91FC5595CE821805E967B7C11440509908022
                                        SHA-512:2B0ECE0877B6C28E8A1A5ADB8C1D3A8340FD964DF26E9310B4FE3B694871EAA81D3388A28AE50F8EE9F2F383766479C8EF2C1BCB643C72BF6D224DB7FD1D9FBC
                                        Malicious:false
                                        Preview:n...K.H...&H?.HQ..H.^&.-e'...k9#a...J..B4r.}..|?...[T.e.pq.q.....i..3R(.. ;.......%e...3.l.-......:.9:..3..J.A.>.f.l".&.......*..{..sZ?."......0N...N..I9r#..S..".e..*..j.....UjP............!. $l.m9.....H.>.}..mDy.....Z.S2.D.3."M.N.q...;.TO+....7.....L..L...u.ZOQ...xN0./\.y.F5....5GlR6..b...C...8H_........S.._.-7j........z]..X......`O6.^.M.......w."..+.&.;=.s....W0.ivZ....|....kf._..[...E...m..}f......9$..3.=U..\5i.l.-..'....0.{.!.>.................(..'q.Lq.....F=.'.xy..R...t......K.@..o..`..>x......h.}\T.17-.6R.9.y..Wg$l......<.0..m.....74v...eB."..I ..3.a..`j........9.ku..)'X..O.....N..Z.-@.._.p...gJ.n.#..<'..S...h......i+........|.NWM.".yi....x.G..X..4....q.AU.U.01G.../|.D..p....P....p.....oi.E.-.U.../y%.^..W....D...?..L.$....i.h6I,0Y...7....9.W.)FOoEO...V.....KYxo.....d&n...X.s...;.}`5.=...Z...EK87Oz.......C..F.r....|.B/Is....`.....N.........}.$.....~.....a....-.{}f.J.s.' u....y.......,...'.Y..A\~:g|..O..W4.........6.....j.9x..V..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):16627
                                        Entropy (8bit):7.988773423278121
                                        Encrypted:false
                                        SSDEEP:384:BJXzrQUNMkStBMTdr+kzrW6P2E0AcdPHE:PzrQUNMk6BMTdxOE0PfE
                                        MD5:91B638DB7D6F76B37090325947F83573
                                        SHA1:D8EA98745261C01382F5F28B8F374001EE39B393
                                        SHA-256:2506690C2654F7EED90CCAFF909D1E16112B3EBC6AF9A38D03B4E14DCCB0E918
                                        SHA-512:43A1CF2ED62B218D6B9E9AFC916697B65821028CFA3E8A648F704C77FC98AC626ABDF5689418F31C6885DEE1A9C8910FC11F63A2C7527C094A4968DC60A658CB
                                        Malicious:false
                                        Preview:X.9...=K.;%v.E.....`.Q...J"GqW....!....EE.(...tf..xC..g.*x.>..S.........O.o.,.......p.v?...3..Ud..ybMg.Y^...Z..E..q..M?..1..X.K.DW.%...2y.].{.;x^.S....U.uh..BR.!....u.,...q.$.LM.9Y%..Y...9...m.)...{........=+mp..*;.....*.f.Ae.....(.m".........j...V.VE...g..v..GMB8..M(..4-.&-...d..............%..e/..}<......@7X.M.?.@.......e-.%..W.yY./`........J........q.K9...3..L.k.D>i.'N."..`.@8.....x....HG.8[..p.i!.$.9J%..).T.]9.[.-........E@/.d.(..p..P.H..fcI,.o.>.....Hm.A...~k....^F#..2..t\......m@q..pI.~,=..l.Yz.~......B?..%1../Ix.Dz....}.U..3e......?.e4.0.....B.\.y;./.......-...dA{.6..h9N".*...*...y..a.E^>.].....A.Su=..j.wY.JJEAz..7..Q4..8..h.Ko.....XVw..).^9...d3<~...;.Xm....?.&6....*c$......f.|......Hc.R..........Z.....u[=....3.5+..%..._}{|d....Z.[hXy.G....Hq......c%........X.v..a.ztU....*p.5.;..Q'..LQo......k...............7W....b..'..7...V.......i.Sf&...\........\.... ...q.....G..X.............L......j.K..0.F.G.n....}.[L\..?x.b=....T..-..g...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8425
                                        Entropy (8bit):7.978043288445355
                                        Encrypted:false
                                        SSDEEP:192:Y5UpAkPsW1RYKsgZXcyJe8kc0zQEd68lq9:Y+RYPgRjJe8kpMKq9
                                        MD5:650E999AFF6A045FFD164FC7F77AB699
                                        SHA1:98AAC4D53D1E19C3A00002C85EEFAA5449B622DD
                                        SHA-256:B7B930A3B98C54C6F1E86D23D5AA839C500CCA6184685F86B616BFAC88F297DD
                                        SHA-512:ECD5B60BEE867400C3D5DC073053C60AB5B9AF3BF49972DA68C8A587B549873997A4942AF0E4EF28E9D8A429302A245DE9D7752489F186C38FE9117CD6A67E46
                                        Malicious:false
                                        Preview:V..+.f.l..5...q.Q.z.{o.!Q...v.Y.38..T.. $c..(J.fP.G..g6K.HQ..........`.?}..H."....6....8J...a....?).3...z...E..AAZ..y.......>..^^.2....PR.|$.*).......{..`...'b...Y.&h.%..."".S..8A......u.ir..3Q-.#.R..?.b...\.......Q.[..M.o2G.....9..9..Mw.6~.Dh.'...).B/....A.?.z..7.[.....38_3..&..{..c&..e.}..P.....4..H....`.?..pkMG.....I..7.O..G...r.a..D......Z......b......E..i..xh....1f9...q.P.W.g.}..-.G.7V.M.1.....n;.0...).+B.@."'....j...<&.S.3..m[..3..*.}.~.\...........T.".R.5.-.5l.qu..gO+......%._z..,..r......F%:.IwC.R.?...o..8...I..c.@....?..}z/..>l.J+.....t.....7.Y.3.]-.oQ+P....T.7m.^..b.9.w.|.6ZaZ.1{@. L.....k:.ms.45...O.uZ....6.Q"....P.-V".$......,g../.l....>.`......|z..0.)H...C.@E..q=.....^-..0..i..p.Y...k.mN..I$z.$..Cx...).:..a...[.....If.3x).#....!U.O...`...(.N.b.p..B. .;L..{d..T.........O....R1..#.Zq.g..g.1.&.wq.....q.UP.i.F.PUN.....!.G..".6y.Z...%..$..J..Qq.N..j...:C6.P.U.SD.u..]:..Ng..Ki..;>..M......xqj._..6.}..GZ.f....=T.|K[....R.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):524521
                                        Entropy (8bit):7.99966741068845
                                        Encrypted:true
                                        SSDEEP:12288:ic2iKsG9JlO64uWzewMJdTB0Q1TRN9C3Mi5sQ/z8la0:ic29lf4xzexJ1SQ1TlC58lL
                                        MD5:66FFD71B69B732543893ECF259074671
                                        SHA1:FF43790181C3CDC3408D4C0BF1490EC4532FC2AD
                                        SHA-256:2692F4A8CC47C945958EE0562D1F4BBE6DD9787220A539D64CE8801FB82DFDF8
                                        SHA-512:639641FE32351808F48189A73AAD8CC213525F198BA37A101E9EAD4BCF15BE0FF550C49B25D5A876540571C04FE42B8EEBC7B4AC29013ADAE8F979766C071CB7
                                        Malicious:true
                                        Preview:....q.l.c._.....d.0O.8...4.[....RlP.....$G.1...an..Ze|D..2_..0.-j....Hm..I.}k-...h.P.....}./\.1.4M........lS>.Dri.....+t...g(l~.....3./.....-x.....d....C..x.Ua.......u.P..A.Jua"*..Ne.)^6....c}.vBq.."8.i.V..[...^..U....*>.c.....]...\..Vs..G.e...`.db......V....1..{a..u.f}....%..ex..].cR........o4.9X....jEW4X'P.>......9;..p...T.qT..@g5..P....HPWg...:...._....[.".,:..Fj.>.1b.71....^....Cy.W.P..|.%.&e....sH..F...e.)Ne...C..R.....%C..........)...O}.../I....%3P^+......J+.I....P..8.k....{.9w.p..1.5.g.2.c.y.=.;..}.;.$.{..>.<............y...+"..O......F.i_.7....P}).-.+D.4t/3E3..f.._[..C..:.,.5..-f.B".K7+.N..h...{=...#.E#%.`L.&..V...[Z.D.. Y,wUX.4V.SPm.+.`..O......Ih..\.............Xc..>.........~..[..r.Ug.?..C4P[E/L..$.8.....9...&ezJ.y...`s...L.h.)..d...9~......-.4.]...}r...R.R.b...[6..*.J..R=..Q..YL.;.Y(....7.'.C...i.>....E.v''.Y2....k...cc....?...!NkV $..E.W.....D...d.jP....u.Q..D... D.S..mSo&g.4..n.X...3...2........(?k=...P.kR...M
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):524529
                                        Entropy (8bit):7.999621037844997
                                        Encrypted:true
                                        SSDEEP:12288:xFK112Usn09dXxcc6UCJBponeR0JZIGkUpN3bEbEz:6c/09j/oGebGZ33QbEz
                                        MD5:513A30184E260D3C3BA40AB48223AC6F
                                        SHA1:46612598B58FA4E8C64EB3B9525DDB5687364A7A
                                        SHA-256:027B907ECA95C727A3CF284AB28558ECFCD6D052205C7E0AE1BBD45B12E85C35
                                        SHA-512:EF106E91A825FBF85646AFD2C2C9C2AABE7CBCDD6C2120EF1589CEA6417241F74D7BCAF6E1D5EC329075A494DCDC150611327508377FFD66593EFE7DA5CDC7D8
                                        Malicious:true
                                        Preview:v{%...$n..n{.G....-.y.m..RB.0Q..|...>,s.}..!.^$. '..@.d.=..y.E:.7.;.....%..KsQ2.Z%..J.b....t...........Dd76....i..,V{....{.=..+6x...3.g....X.QJ.x*...nZ....-5 .^.V..J......zV.u...v\n.}.8..L..*....zr*.F.d.}.3q.......|s.5.KmG....5..."......Q..~.[a...mt..vZ.BR~*X..98A../..y+....C.#.2. ..KgQ..lT...~ki.t.....3.==|...@.-P..2A.8U.....}....2J.9i.....~$.1G.-...N........r'fe.=M.v.<,.........iG..(.aUy.lm@Vw."o...5..$.....f.F......).T8o.l.>.StU>...w..H..5..7.R..UO..U/.......E.......h.g....SFm#hV..u...=...+....h....o.3.83.,...G ^b...gj*.r.&0..uF.. .B.9...t.L...s.-H>.7._h.7.d.I%..O..7p[.O....G1..x{.^H.).A.....H.D.V.D.....T..W.lO)x)....6.$.,..........4..gy8.......|..84...m>.Z....DY.eE...M.b2.M~u....,(<{...@...?.....+....n/.......w.a.%.]o8..a..Q.J..A...c.~...M.~.~....#..)c^..x.(J...#^.p...W</..H.u.$j..2.....x.TI2&.]$VZ....E..~.....V2......Q.w.;s`.G..d..6...:....XT...Y..9.....5{.>.u.W.!...Qw]].M.f4.H...y.-.:|I. .C.\.(:....`8..(.e..U..._3m.'DKA.H..:.vD}.....M...v..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):524529
                                        Entropy (8bit):7.999670819468133
                                        Encrypted:true
                                        SSDEEP:12288:xd4jljmwpj3WlBFbbSMH0JbXOBhaYxol0:xolCwpjIrKMH0JLOa0
                                        MD5:5470166D6ACB71F3F1F7F4F35855F63C
                                        SHA1:BE1A13829C22B81F2D67BCAF054D294E5F1DA09E
                                        SHA-256:4B262BCF3430149A069182FACE03BF058A95828BF792CD0ECA5095419C59AABC
                                        SHA-512:489BFB49DD42B34653B8850A51129C5054F006FA32D65B1952C51B4B8673AD1747D3F127DDD5FBD9EF5074078AC9BA87248E727EB336F85C8E9CA9740EA58C86
                                        Malicious:true
                                        Preview:z.zB.\'(....&O..w..3v.N..;N...V.l..v...}..8..p.t.....TI..L..^..7...kM.0.|:......\..&\..X#..U"TmMh..Y....k.*..V.1DT4.eq.+2....z3.O$fe...U...........)A...l.....S.q..S...bi.~qh."......T.jV....i..N_.e].E.Y....PE.T1.5.er.t'`.vt{.Q.+.5.H.......I.H...9.U..`8.....,.v.d_Gm...[..;.......8..[U...)....'Xw....^..j....:..Tr..4.[.m...p.A.qoS......Y..m...}..aXf.o...e..2.1|S:. .i..6..^....F.."...k...`4..PM.\...\Ui..Z..2.v..(.16.$.=T.._...*t)...d..fl........,<..<N.< ...h./.z...}1=B.....9.....<.....3..V.....}`.x....Z. .e.M.6...f...]...+..a....F...wc...e..Y&.}D_#xs,...*..haF.E....vY..C...6nk.....Y..D..?z.A](...vls....4.s....z.4O..B.O.....~n...k%.l.....7..=)p.w...&.q..(.......'>..:..`8.j..s.m\1Q......<.&V}.E..g..Q.6.r.......y.i..|.7......oa...NO...,.......;P..D..<.f0.s..M.@..dLhH._.mO..'.:.z..*.....>.a.*kD.h.o.M..MX..{..a.a@..^.#.A...t.Z.......&\...Ok"[M].%.l...t.h..?.`8Y..nt:.=..;.zp.c...MN*..lpW.G.B..fC...j.y......9....].ALk#.....b...5.m...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):524527
                                        Entropy (8bit):7.999627008717841
                                        Encrypted:true
                                        SSDEEP:12288:VOKnCeFMpSAEQ1zr2/TlySIFx7Bai4rvJndwXmqWI9:VOdbSAd1aTIjxlaZrRdwXmqv
                                        MD5:4CE45A0BC54670C8325284E30AD16DC1
                                        SHA1:2FAC4063EB524BD85C1A55828704D10244C4FD96
                                        SHA-256:5FB44FA0C40D697ED011D21894CF69040E64A0750EBF264B33387F504E5FAC96
                                        SHA-512:A77A878ABFB0CE26AF683B0070C355F1B8297D6AE44B8DA851AB5401A19455B47F277A2DB9161602E49FFE72FF2503BBD264173BA118E84E7162B715832316EB
                                        Malicious:true
                                        Preview:\W].yn.w....~....fC.o.z=..R.7.tN.#ER..........l!.....IlYB.{c|.Ca.w.....;...,..|.<Ou.....X-...=.%M.qx..6....V.s..J.".x...y..\......{....H.........}.7.c....U.....2.H.....8bjv.v.B4VO..E..!....a.I).t..m.......+./...,lW.M....U3|...x.....F.r...rRX.K..w....\.2..T.\.H.\..\q+.1.=;.N.g.:..q.#....U.....j..>w..........W.v.,....9i...rJ6..P.!.4...m*..|...Y.......(x>\...&.....Z.i.:....'.G08..e.G...Ol.F._V..1p........-.........1.K........hf9p....+;9.4.0U....w.0....@3i$0U....I&..cl....,..K$....l....1..?DD.@//F7.QKp....P...w..j.B..s.r=..v......%.......7..>+-H.Q....mea%.t.S.3.'..6..~....kD.C....;.).x....[.J...\...;.:.I.2.|VrH..Z........0..B.W9..Y ....Zh..3......[..Z...;OD..H...h. ....O........0S|nA.W....s......i7s.E^.)D..O..IlO.........<......b#....W~...f.... :J'..FZj..@....7?f.....n......w.."3....v.B.N.R..d.:...>..4..~.\.2.4..;..........].a..hR.6.e.s.............;..BkiQ5....o....'..ws<O.]w.........(........^..g..\/.Q:......znf.ExMl..T.q...O.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37245
                                        Entropy (8bit):7.995008248595456
                                        Encrypted:true
                                        SSDEEP:768:+7i/a+t/HOXI7k629zmVYg7CqWZCWOurJC5/dRMqDiW2gmWRqIYWVXVHkJQc8:D5pGg9WOZ5lR7cvWRxJrD
                                        MD5:C00473B44F735BF549A31D4A4F199620
                                        SHA1:8FBA1FB08AF8494C3FC880C1B0D73512D8D3C023
                                        SHA-256:02E63C67A8619D59B80A5EF6C49FD31656DCC8503C8BEF55DE4D230C6D3F43F8
                                        SHA-512:7AE8FA400D97C8B8EE7B02F3E8AA5F8FC3DBA164193C1903EB1AC72704891B3AE7FA561204FAA71C1722B0E76F4137FD173A3FFCF7181A573F671736BCCBD601
                                        Malicious:true
                                        Preview:4....%....W..R..L..V........vh......V4......x)Y\z3.{OE./a>.?M..w.*..g\&.|.}.lF..H.q..cJ6eu}?...FPQ.pN.G..1.bQ...C.....".....OJO..L"..:e...'.Qs.^.Ot...ax.....H@.+..7q.9.......p}t. s....Hb.~\...c.#.7Q.j8.XR...._..u;.........S.C}....,l..o.....0..E...|..oR.....p...E.+...SI.9....J,7..z.,p.fm`i)..mxs.ecL...~.D.aw%.......2d..R..B.....}.14.kn......<.P..v...)...P...L...0.+.h.c.=..T....2...eGN...r.V...[s....d...|..d.{..8./..4#.fv.."9..~Q0....N..;N.@...A.)..)}"D.<d..r...[...A(.....&Z.,L.{..$7t.0w.....j..<'..r..D..!Q.=.W'.x..-&...Fg...h)..E./ .X..PMWHr...G..|^..p...j_6.#3.w........u..i.roQ(..'g...f..g.."3..A.a=g..U.JKc...$.K..)r..;..%.K....Z.5........ ....;..r.0G*...Z.._'n>P.n....l.. 2y.....t...s..N.......O......8Z.U`.M......J.:..8.D.e.G..TU.$..M.\.Lq..c.....s...K.......^......yO..klQ.-.%..>J.IH..-0a(........<....+.,pA...F.*.~..)..Mv.L..t_W.X....k6).y.7.2d.8;y_NT<.).:.& qbf"d8IB'....V._.nb.=J..>.G.CH...D.a;..[Y.......o.x..RHHK#..k...O.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):37277
                                        Entropy (8bit):7.995643074408699
                                        Encrypted:true
                                        SSDEEP:768:1R6NZkBtlt8xyHFfffrO1XHxZc2jKDV9SMw6waPCyg9nnNnseL9gga4mduz:D6N2t8xcnfsxZc2mDbSMwRQrg5lL6A
                                        MD5:6DD949B4C32F65AE88A3FC18EDA73C9B
                                        SHA1:F7496F770D454D9C9F9E9FFF0196DB23CAB81FEA
                                        SHA-256:56C2D32D2BD0B516AABC0F272954D3EE4DC662718072A8AB031FF41D85FDD156
                                        SHA-512:F5872444357CD6AB08F465FDD873156ADB2DBF5444CE4CC10098E8570C27ABA5CC20F388079C7B8FA272B6BFD15172B84E1B50ED555FA21A15FF5A886A119E72
                                        Malicious:true
                                        Preview:..p..$.J......@#R*.69......[d...'.`U#h0.=W.B..>w.uK.q7Q...>~....Q/n.zu..R.ov......+.1(Xl<)`;..g3..@..N9.83:....$.....I.D.'`.S.}.j^........9...P..K..."1...5..}.,J.8..>...@.....j..6U..D%.D-.r..M..Hb..K...\...|...Z|......+r!R......8.2..t./R(y....k#..D.d..m.%...p..su..Z.?.A....j.<s....1%..v..{.87.'.....Y.;._..;1..JA...ME..q..q.k.i.<.).s..@U0....p.lD.m5.q...5uH.V......l..2..^.BcR.*~...C...bfiR...B....j..0..VOx..^.u...;@I.v+..P....YD*}9J7.F9..../.EZk&QTx..b.L.e.K.n..^..`._:.......>.k.~]9}o.W.w.H..Bap0.q...UH..o}n.}......#q{.M..V...3.....HR.t....C.;.y4......AIl.v.uP-...|-..n..l.bv.BB.2T...>.gm.{Bw&..?..[%6.m..7.p.",........<O...L.."...Y..nD.P...^M.......8K1...." ..`......I8....b..Ly@..+.,.. ...C(...W.i:....{........_H.v......m...........+.....).z......].Nf.+A. 9.Z..1)fg.<z.!...H.3..;.g...B...h7..0.6/;...1...WT...:.b'.\Kg^C^~0..0;y.Q..*..D.j....Q........c......~........tq$...y}sX....G..$.@0:.T.(..c.-"..?|....B.......j.n../n]...^...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37274
                                        Entropy (8bit):7.995272539207586
                                        Encrypted:true
                                        SSDEEP:768:OdfHdSgFm4QKdFIV69iW1qBh0owWi+3PjrnIzFjVdIBkjgayH3ACK1B0nt:OlBTIViiUs0R2oNVdIB/aSQh1B0t
                                        MD5:ED62592C1839A32A94E9EEC03C81ACB1
                                        SHA1:AFA00C35206E70CD7F7036A1FBAE88C3631101EB
                                        SHA-256:060B1A1E201C3D42B626C07A414AC10CCA0263E35B7EB96BA0786829494861B8
                                        SHA-512:D3DF22728DBBF76F460D26179F8D1E3195F085F4442FAB6B2EFC5D4F08439934C3BD72C29C696D9D6B2AAB13192945FF964657296852FBD1F1D11CE8B6FE60D3
                                        Malicious:true
                                        Preview:Y5,hk.j...(..(.;3....I;v-S.........4^....]..e.C..(X...._.):..[.|.U5...-...(?D.5..R.y.w...w./..5,8.6.......:.)t..:9l/..(..K.f'p..?.E..........&..*..>\.S,....,....z.&..5...zP...@o......u.}....~~.t>f$..1..Z..7.{h..3....X.1$,..n...Ktu............Y`...|....o,.o..B....}('.#o..u.PM..ZK.......h.}.d.....Q.L{h]i.x.#..t{...2rt........f.I...+..s...$A...~..jm..l|....3[..(>..../....S+i.RCT-D]...k..u%....h'Bq..Z.,i.P.>]..'.H..[..".m...u....J.....Jg...r.......U.'...&.r..bI..ag.Vj.>..l.y......].....B...7.%Xa^..u...+u....l..?.%aB.1.;...9h.....=7.!..w.Vm./X^.0.....M`h..g.._.A2.4...K.. ..V.L.?Q&>.............U..c..o.f...S..l.....D7.....w.Y"...vy.9.R..t..W.=$......m....F.7.&.x.G.....j..x..(..FZ........?9.4g<Bg.b..N{L*_...H.......q.._.AR[{...\D!...]...iB...,.\.Y..B25'....._GR......1..O.0o..b3...<._.$...3.v.....{..1*.''.P.C.$..._I?..R.t.4u..Y>.?.....".W)Z.u..d........d..X0%.q.....a..2..r~.....@..@..^h...:c........u.o)..yz..-a@.].}!{...#....i1...".|.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37281
                                        Entropy (8bit):7.995437888680006
                                        Encrypted:true
                                        SSDEEP:768:GCLaciqki2Lt1gtdxI3U6MOXu7FlfW1fmZs4Bg2fl:5LWi2Lt1ghI33e7Flfyf6/fl
                                        MD5:8C0F7FCA4C923CAE91D7368F8ECAB160
                                        SHA1:3A366E8D40819FFF86B02231D4ED81748D8D9118
                                        SHA-256:587562DE4D7C32DEA1BB62052020180178FE2256636526EA9496486905263FBE
                                        SHA-512:8D9DFCA91119054036C656E292462F1349FD709F83ABF1586B3AACC8C43EC8E17C5EBE80915DAC0E1FCC6AC362F17616218ABC4AA4DB1CDEC9A93D1F4500A57F
                                        Malicious:true
                                        Preview:..~:...A.O...Li>...C......t.s...l...R..E..K...b.~......'...@;.r....k..;.3Kyz...r.?...r..T.(RTS.*.BL8....P...B.w.............%..g....1R..e.1.|d..)......7.R..>AV....~.2.b^w$....18...lm,...^vh...P..L.s ....8_.L{...T..#..(.aYo...z..)..s)..$.q....\....?y...PTz.....J......J...-x.:........}.%.k...I@g.....@J.......q;.p..FR..)."k..L.5.x.3=.7..Y.. k@.8..w0=T_#..\....X.0..+e./]eu....%,. "YmV{..(.m.N3P......`a....,/..\.,M....dE.1Y..tnq%@AL.[...-sF.K..Y.*.~WI.......U...A...N..s.:....:ZO.#....%S..o..F?...%~.sQBTf.&.A.2...+....w..#.H.........r.8.+.n.......n..F.*.v.....t..]8......m...~.#.7./.r.d_u.yak...zNj.}.@..-..b`C*......K.x^.y=...c......;.r#.\A../b..q./....&9&F5..B_'.J.5.!..~.K..%(X..:.7...7.>...K....6....\,.|"..ih&{B...h.H..J.....u....a!..Rl..[..~.i...n^.=dGDc...p..#...........7...x>...6.......j.r_R.B/O..t.9..p..\....A...=....X.&....f...M.w.b.C..O[....:.u.(....4..Os..g..{........'.b.P....R.Q....{..e..:..P.p..p<...D9V..0.. ..g.Zy...i.2...E."c..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):31407
                                        Entropy (8bit):7.994608703288397
                                        Encrypted:true
                                        SSDEEP:768:L5DeUHFwFIyB8YXV6yAmBxzVCuuqk9NtSH64c8F:AB/syA2VClvLtSHxT
                                        MD5:20623B0FE95BAC450E88517D1AD9CDA7
                                        SHA1:35C953FACE51D75B98837B0DE66C4902C46C58C6
                                        SHA-256:1EE01B53E3F9A7D1407F689C1CC8395CFC2D7F3B276FA81C062A819B7B6F1BDC
                                        SHA-512:1CDE7BFFE1536BD00087AF3DB94243F4BB6A5D9EAED106E2736CAA502B2E2D27C3072E5BED3527603C0D1293370C458F0048E17BCCC027C25B2D294B8836C014
                                        Malicious:true
                                        Preview:pK...h[.d.<....%or'Q?~.z...L9...s.uh.,.#......$S.]#.t-...[..cRT...0t.V..w7X....01.<...........>...^..S.....A..nSw...2..L......Q{.....y.....VX..K... ..{...g)....>?..v+.........lv.K.Z=.......`..C.@$....<FRy..k...@.,.. /.+h.%..}....N.a...[...O/.7.!g......R..Ve.8.......@..'..3....Q...[....8H....q.;..$....=...{.)....F.........Y...g*...9....9.P.....%....Ju._BQ..{Lo......NQ.>.&f./.P......8.}..}4....<......"..s..&.p....q..i....L..9F/...sy...=z 5<>H..a...@.....a..|._`.].:.........y,...*..*..#...........R~.c..W.CZ...>.m...R...OS4..IL.s..-.L.X.P...1b...^.6....F.....@..a...cq.3.!w.z..Gp..........'....o.k.rp?....`d..G.%..H.C......x..}.....D:0<.....~..M.........j...k..C...#.......h......}..0`.M...{.-lE._......q...7D.k5P..Qv..O....2ecT...m.Q..Q3..7|..}8......3.s......5.....vQ.2u.i.g...5I.iN.$.J2.K......k....m...J_.. V...1Q>&r... p..X..-....I8...2..)......8......XQ....r....L.D.g/..B.[.G...e.n....b.]C,....'Oz...T.G#..5.[..9ET.PwH.HX)Rx......
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37281
                                        Entropy (8bit):7.994668444052822
                                        Encrypted:true
                                        SSDEEP:768:SngbPzknx3zOANb59bHA+sf1AZDllVRBevvp2WeJnVgiXTdKWhN+STh:O8knxDOeDbFsNAZDDVRBevhhopDdKSNB
                                        MD5:F079A18FDAF1DF95E237C1E013B33519
                                        SHA1:D2794F20984AE612F94B5244355CDD2A5712147B
                                        SHA-256:B5BCB5C601CD163877A91CF783253316B3BEE9E139F40E1BFCFFE277349057D5
                                        SHA-512:84550F4E8AF04F4A27522A346EC0F95ECDAEF1CB29D9A056C483C80E878F56D898524BCE2ED77455B352290471546B0ABDA4E3E82BFF464B27D4512D911B4A6F
                                        Malicious:true
                                        Preview:/......"......,W.<..o7.....#.^.t..0q.G..1...3..D.3_.y04B....:.|9.."w...1HF.3].`.t.=.!.HR..y..KZse..^..KB..._1D.e..'wfh2- \.;1m;t...W......i+#.g.D..).g+......J...Z!2&....~..b&..nhH....V......e......@..nR.!tP.q.`.j..G..:.~D.W.n4...u\...oU.S.VzF.8....2H~-.....].@3].^.......:.._.0.c....{....>..+......,lK......,....5..k.e...l...*}*..P..:..BfT.U.*[C7.z.+S.@<U2SlL.#X0-.D.......0;........J.<...W%z...m.[...;._.{.$./.&.J....Z.Rtq....JI..W..GY"%q._.<.j.7...Hf.A'k.>.p.....VCB......_w..Kl..95....3.,.JcMJ..]Y.......G...'...|w...V.j..x..nn...s.....Pb.."B....rw.$C....e.....Y\..xY.{+...0...x.c...=?.q.i.-.%...x....$..x...E...>s.N\......2{.;.&Z.D`.3=..mz6.{^..QB(....w.di.7.@.+.f.;.......9?.*^.f..3...!w.1..........kh..e..MD....S.pY.../...O......V.x.yV.....f......F......?.o.kRo.....9Ek.5F.GN.?.?Y...A6.'D....G.H9`Qs....j...6....Mf.fei...*-|...@Ln(..8 .U...i...oP...2wW......'.v#.r...+o..&.........;o.....f. ....,..0_.......; W..d..{.#$p.m...(%.d|...(.H..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8180
                                        Entropy (8bit):7.977361302125049
                                        Encrypted:false
                                        SSDEEP:192:ETLcJijxB18wAQG42s/YklQifaJOYf4Wo5BuelLodQME:ETQKB+LO1wklXac8+5BuaodQME
                                        MD5:8006DC4FDCDE799CDB2427D6A5E480AD
                                        SHA1:44DCDB12A795C7AE74527CBD0A63E49B68E7FC2E
                                        SHA-256:61F9E273B99C313988B893A07E7A874A5719EDD2B223C47A1A8CE603D8ADDDF6
                                        SHA-512:9364065EB3B1B25D1645BC7DCFA2A357515057E9857C72860F0DA5850113882F5BC26C1C9ABFDC3229974291918176F00175F79FC3FE72D7879E204D4BE1A70E
                                        Malicious:false
                                        Preview:.H2..^.[tu.W.(........T..gL._._...l..V...P....n._g,..R..3qA=..;...|.oI...6........Y!..sY....7....~:.R.;.!...'.m).K7....O1a.....&.EU..e...U{+...zAE$........y...#....{...C.E.i.iea..O...v.?."..Y.G..m...d.,@.];.._.JW...:-z.1..^V..~fRs.S.}p.......H..m3B..XXJ.).....|}8..n..Qj...A..+r..6K...i..F.&....u.......\.?.....,5`}a,M...Zz.@w...u.....r,...A....B..0.Qkr|...Sq..p.,...*...N.D...0f~i.......!.VO...T...k.b..[)...M.$.=Z4_.....c...N...$n......x...SRf.......H...1.Jp..:jm.m.f..g..6...c..!XV=..S(t....!..!D.w..K.....U.\V.......G.....U....i"..7e...nL.........!.cG.)..=d...P{.....H.Q..%u.:...R..%.Of.g.($..~..n..c.@..=..m..L.j..P....s...jSc.QU........"..#.rG.....l....]5.v....C..j...>..F......OE}...`....V..O7..V..*o).7.{.=.5..?....s........f.1.!.7.,T........>...,....&...Z.....2{..@....sB..9......Z.#qC4B)%X...(.....rt..[...s|.>I.I..i.es..h..HAH.Yv.*.-.b....z........Lf8.d.......Si..ux..J.n.>....^......!.B..$lx..x....rw..5.@Pd.......n..w.3..S.#..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37285
                                        Entropy (8bit):7.994407139143055
                                        Encrypted:true
                                        SSDEEP:768:Q0AuDwx+wOV3rarkO+5VCk3d+9WvOFHSru00fv:Q0l0x+wOV3rOad3pOJSq0I
                                        MD5:77160BF11A8DEB03450656C89C7963CE
                                        SHA1:36CD56964D6FB8BB4E07C75C690FE466FE805235
                                        SHA-256:5251039066CEE85366927145EE40A832C96918C3ED5D26150814192E0EE61092
                                        SHA-512:59492D1906A344437E947FF43F6630A06E0C1416B2AED7A39427B128B46495865508C4BAD3FB8FE138D9DBBC3BE9AC73329793381072CE8CAFDF0C6ACCAEDA38
                                        Malicious:true
                                        Preview:4.w=.c'...G.5..3...N...Lb.....{.3\....."...9......{+.q...4..Bu.Nh2-[...!JI.....W..`.`..N..........Y...B<0.n.F.H....t.........f. ...c......4....tM..*..m..*....S.g....&.F.....S.....r"...J-.Vk.@G.....jq..P../.Y\..f.;.7.D.C. ."0.u\.+/?..q.;.RMN.4.{V...#\. #!h..<...53..w.Xw.....u..I<3..r..e.X............<.k... @c.bh.......v.......-..W+..NKa.......e.O3uc...,.|......lr..<uh6.......^.l..8..n...T|..}...`..P,=............-RoEk....v>../..9q....+Z.3Z..u.....k....O...9.....d.z|C.G.........R..H."..."*4.....2.#O.!1Q.v9.....=XN.R.....`.....1w...ot..aF...]]....KM.X`.C.....3.3&.V.E.'FY.....l..N.>K.eY.y.Oc...<.b5...$...V........PZqS1.6/..r..nO.....=9.........O..3.+L.E.........T...t..0.ioE%..Q=#...S..b% E.... .....I/6v;...hX:Dc...g|...@....~._n.......h.=(..@.....o.[.......o.9;.A.S.y.H.....N..;..5..O...t....+.c....q!.....sAo...{....E.ua..........zl....T...V.5..C..`..Z.eq... ..c.Ab..S....=U.+.. .W......:P..o..W.G...e.;o...;|t9I.Ir<-....g..0.#".V.c
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8168
                                        Entropy (8bit):7.979210606491471
                                        Encrypted:false
                                        SSDEEP:192:wTfpNGeh/nbXf7gkS2IR64nEot/kw457v:0pNf56XNEot/kBv
                                        MD5:7F60066E8FCFE972B6DB80307F650860
                                        SHA1:D9E71C9B347C80BF6649B48113F87EB6470F042D
                                        SHA-256:82830673729480AA3477237F52A03DEC37BB726DB665277F083FC6941F095C46
                                        SHA-512:A9184266A5EC8E9A79520BFD2A348FED40656602A88B8A2C14FE41027F79EE5736CE5F78675F322C6695054E1A48D9F814EBA688EBF856AF7009E9FBD4F39E5F
                                        Malicious:false
                                        Preview:..(...BC.Zpm...9..c,.H.....:.{@T.r.~I.Q"......#Zu.l..BI9L.....VD.4e.NV....(]......L.....g.x/.....i.kT.c`X.f..~...fw..8..#.....3...M3.a..F(...}:..(Lq.1B}.`..>.J..d.r.W.S0v.:"b...] .Fs[.....o.Yx.....$X....*.....d....n.Mf.a=.J... .yMq.X...R../.....7:l...h....m....sK=....Jx...xv.?....2.....2.R.S.9......lX..p...........z..e..(.....1..Vt.=$...G.;...O...Gd...L....h.....B..@...d>lN......d....a.C.....'r@]..=.....9&.....p.@.YF......R.B.......8.lm1...b.Y.M...f*X.$...=.E...ul_...+.WWq..E}...V...e..Rg|,w@b....A.w...p&...K..........7..GT....(.3..u.Ae.!....^.w..LX..B../.....;.M...v.{.:.....4.p..p.n(m.W........O9....!#.8.R.8.'.\(......l.=:I.Y....g,$...C.DL`..'e.v..?...,E.x......}.&r..Q...A.....B.~...,b...."...t.^CG....)..,...`Mq.6...y.....d....k..:,........%....]....G..........zT...q...K..A..B...-......(..,.Ae.Q.&...)PQx].....4%.~.5+&z..h...0.Cj.....*0.b./..e.b)P).A$Os...@qvJ.....r.5....8MO....%.f.....N.w>...DZ`.g.{...P3....mT*9.e.*.bH.G$......
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8183
                                        Entropy (8bit):7.977272382708317
                                        Encrypted:false
                                        SSDEEP:192:54pTbQAQm6jXmJgnoIvm/GufBDmqb/+U5lArxRVbXhUO:5QbdXk2JgnP0Gufbbb4rdiO
                                        MD5:ACA26B8B1269B91BB6F0CE4B7C7E8451
                                        SHA1:629F19EE327B8022A6BF98C589E1EEF891F87781
                                        SHA-256:37ED52B6944CA0B55C1D13551863DE1CF2AE555DC4E13C8D2A83C178CF7425FF
                                        SHA-512:2AA09D130095C8E37E4DBDB669FD7397BFD6A28672256FA0B33C90A4FFA79A7A5D9A285352F54946A7C76EFD3C4A1158904180DF181A8230105FA36ED6F3119E
                                        Malicious:false
                                        Preview:V>.}H..Tc$..k....W%9q|b.......s..2...d.....b...6}.....7...@.(...7W4..2`..0Tu/.....99.2.&..........6....U..7_*(.R..#D....4.#.C.......Au4....VD.[z....."..(.d....1..hms..e$4..v*....&.....<HW&.?~.......lGl....;.LD?HK".#..Qb.$......<Qg{..PW....'.........4...%..m...xZ.(.....'.....a..L*..0..q/|m..=.|..x...-.w...\..~.0.xT.|..H....+.>..b....L.......]C...*Es..&.....Fm..jTq&.j.&Ca#.G.I.q.X..r....}F5ys.J..}?B..2..G%..s...w....g..3..a..bL.A.../.v.$...]..Zxh..(zIPy.....d.f..D_N....`.8....ra$5.@.Cm...Zn .A..S.1.Ez4.o.|w|>u...k.~i....CU..X.u.C~......w.CgLe,..G...w.3G{..&J.g...`.............D;..Y.Ua&.....R.D7q..jY.X..q".?.b.6.i#w._m.....|.M..O...t.r.....h...@&.@..XyW.5GH.x..M....c..;.K..p.EdV..{.[..}....C.<.^.p..~y>.....A.E5.x..v...Y.v=B...2.cr......j.#$j..YK..O."..Jl....r..B.ZZ...(...J....!7..j.Lwk.$.<.9b....S/..r$.x../..H`...E...G..'Tt.!..U.K!).<f.3.)...W..z.t..U7.'.....>.Q..h(..h..Q.I7%.#.+Tr./BO-..[..Y...J|ed....2=.t....9hm.0.E)......p..-....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8170
                                        Entropy (8bit):7.979078455976466
                                        Encrypted:false
                                        SSDEEP:192:Ss4R3Xek3BYyqW9oFc/Ug/6IGLVgaaBFLe1etFAzSuV:QZXekRVh9dzGLVTaBFa1eTADV
                                        MD5:A2F4C581C74F28110D2F97AA3ACE18A7
                                        SHA1:8D80FA11464E2EB897B374511AD067DBD3F4841F
                                        SHA-256:386D32758A6B8C2EA5A977F43CF213F0FCCB4CE0421E3279E98EC0A1B89F92E5
                                        SHA-512:03BB6EE19A597DF7EE5D6D7979B1D273F44922CD186393D989BD98F27338B110B762120A3306AA6BEB4B2AB41D92FD4F46A74A13C0D1AA4EE88A99DFE0723753
                                        Malicious:false
                                        Preview:X....ri.p......7..[B.I.q.r....l.........O...t..Y.i......<...vd.....X...XW}Z....U}.r.E.dVi.v..a#1..9.y.H.......,..$.|.(./,..9.b..N.0....*Iw~5...T,.R.]...y..&CE.7....S.......h.I...z l......\...].M....d....;...).c.....@O..=.l.4..!)......3v...P...,.Z.t.%..,......;..d.Z`A.?..<.@..v..U$3..(VJ...9T{GNt..D.A......u/..IS....5.:.p..6#.{...N.#.[>.?..Y\...9..&.c..B%;.....,~..|n......Wx..........].A8...o.(j.viT......C.'...t0.%.. ...J.w.G."..S`..9P..T~Y..g..j..Q..o.D.n....n..sv.n.)<._.5....~_..1"\..8.J...w....(.6....../.7..cFb-1n..m.5..w%P.6..+.....=.s.2.Z.k.U..xB9.:h.......i....~..&..G.+.{......*...\..$.D..{.......(....bS.T2.p...Go.....\u.AS.....-..a.7....p.M|..;........~W.....w...Sx.WN<f...|......Tac.wGA.w.hg....5.-<..J4p.i(G.$....F...4..%NA......b..........+Qmf...h.[.D~.[..\....0...w ...{./.P...w..<...Rz.K. Lc...... ..@.Z.u.6c. .......M......+R3.Q...g..{...n....;.g.?....m/.c..S..V..4.I...=.."..#!.V.4.fwS=.^.4..;.B...i1#..s..Ff.....}.C/i.F..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8170
                                        Entropy (8bit):7.975767605295485
                                        Encrypted:false
                                        SSDEEP:96:Iwn3xJ9A5qrufwAZz8H3YwBig906AMeiFvf+K0Z6BGjSlP8HF3bZw0aFg5DEArop:b3xJIqiC2WK+ojAwo0a0Eso1X+2gTe
                                        MD5:2D1121D4F68FE5AA5CCC6241D8C31684
                                        SHA1:B304604A7CC99718C7A3C34D62053E261DC32D47
                                        SHA-256:2B4EE41D22056B17B13E7E1062BF082A7387B64965BBA17D6E98F1D7CB56DFDA
                                        SHA-512:478A4E137ECFE7D1B2CD48C6298D24C0E27C8CCDAC0A51F92D33CD389BBFBA53ECF1C69199B01139C69DCE360550FEFEDE08BA07009414ECD68DAB4F4E10CAEB
                                        Malicious:false
                                        Preview:o.=..#...l.b.E<..`.....FVt.G.K.3.}!...K.0k.g..........#..s.c..5..i..I.T9{.@...Y.4.;6.......?V.G.Q...;w..f#...........N....7B...n3.I.H..0.@...n*.....d-..R.5N,..U.W3.....;..yOM=O....}..|X.&...RF]h...=..q..,.<..L..<e....&.......'.,.....'S`."y....T7....B..[..EX.|...*.....s.yqh....g.....P+....-4.[1...^...9].~.@...w.*O.P0...[2..Rf....(TW.}=...n.....+..&'8@..gb....1.p.]....."AFl#..B.0Z..2..R.....t(.\..p.-.n.7p[a..YT.....7..Ig...}..a.....Q../5......j.#@a.(..........8.xzs._Cq.6..Pi....!.3.`1.^....-..K.*Q...YZ.3.P....\H.W.......&5.3FBY....0..6...P...z...4.E....LA.?......%/<p..U....P..)0.?....b.]...\'.k.. .A6...;.&.`.....5..M..Z.G......H..^z....6p....!.F.....e.|.6.M../...].i0J../.1...1>...}..<.+...-.}Gx=hT..k"..........!.....7.h8.^...[._.6.yj[.F. z..@fg.4.K_.o.<.kx.;. <..0J....!........M\e...2.(. ..)....q..?3<FL%..._...3n.....l....K.d..M.....J.$.i.lg3....&+.1....W3I2.!...n4.>:H"....`....H.V]_..y+..Wm|.j....-....P..`{:..KJ..FQ.N...........Ku..m>T-K...J5.R..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8170
                                        Entropy (8bit):7.979436021104471
                                        Encrypted:false
                                        SSDEEP:192:TqdwpNCMq3sYEFWuHWKpO2LbHl4s1YkXuPBgk:U5McYWcE23Hl4s+kGl
                                        MD5:6B43AE5AD07EAA6E6CC46C0B4EE35FE5
                                        SHA1:131555C161AB52CFF533FEF588F5DCA640DD0E90
                                        SHA-256:B92911A8E9EBD8EE39E11394F9D8E112A3AB451C8973FB8B2EB1573ACEE5274E
                                        SHA-512:DB96445C07044C1FCFD126938A514E90926083BA67D15C410CA4B97C72332AE4E4B74095AFCC47B36750321A5651EA0D0282AE1E3F9B57D7F2D5B05272D65508
                                        Malicious:false
                                        Preview:...{...h..8......2.<....X.H:...L(..6y....wL.|A....y_..Ps...t....D.6..S3..z.]...QH..c..$..@......=V....T9.UW.....q.^...U.P..h3.....B...B...............a.`.[..-......M.i....6.?.jS...?.".M.}....6.~w7u3.......1Q#..;c/.N.......mM..O'..v.$...U........J...m...."............-....$W..x,L...7.>B..^o..C...0...K.Aj.;*5U.s.Y........h..T..../....\)......a.3n-...;l.......4........A......._...,.*)......E......ym...hJ.t.Z.!I...ss../..R..#n.h.. ..z..h......s.....l..p..x.....$GC..e.q.gu|......i.....?.t9t.$..U..B..W.R.(...I.x..%.AMLu..ru....s9.....'..S.........j..xc...v.6.[........,..\D...BT.i..=xE.Y...........N.L.....A.d.7..r.JB.{.6..r.V.P.....).)....................GH@.....&...N..I.j.H.b=gc..o....._..Y........{...N....#Wi.e...g..R.?.w..Y...h.}...(... ....g#....|jP.):<M.,qp....o...+p.,0..b...8.E.....Qj$..n...I........!{;.....ta~J.*.O...A}..|..<...Qge*N..n..S....0.......{....b..@....:.ED...o._....q,/Q<)..[.Q...p..r....8....l`........!."..Y.....@[.....s..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):7.975673030847398
                                        Encrypted:false
                                        SSDEEP:192:5kJTcWfM5cwmD2O9JyKNVSjCjENW9zQUokfxTpmxtQ:+TcW02wJNSsC4NW/ocpmxS
                                        MD5:1851C6B372B034D32EEF2CCBA143938B
                                        SHA1:735EAC3A2E7F0D4348C120C75FE346A74BD4C393
                                        SHA-256:EBAAF190D9F6B2CB2ED3F1CDA4B3AB77741CEDBC186CAFE1882D50316D7FECAC
                                        SHA-512:01EBE8D7607D646D3210888147EE36CDC5566A343F20EAB55909E23C5CB781683B81A8D2BAFFE66B9777A8C8DAEE66EDCE826917C863AEE7F05F298D0B7C82E2
                                        Malicious:false
                                        Preview:....^ F}..;.c......@.[-......W..K.g+g.U..C...?.eT^..I../\....P.}{U..HC...L"G....O...{...#s.V...=..........V.......F...tU.Hi.[..C.8.....=jk..m.t.@O/W.Ns...1gE....I7..o.(H.Eu|....=..u..e.Rd.....w.....(....{.%7.@..Fa..%.s..v!......>.$Z~...". G.....D.HA...d$.Z<z..m.....|..ls!.......tLS`..0.'...;I..o..QA&.X...B.....S.H;7.?......w....0.R...9..r.L-.Qr...FH.V..V...$. .............'...p.4~....s.r..8...-d.,.K.g..:..\3.M,.Z.<"..(...,..e...-.u........O...........RZ...q....J.c..._...t!dj..U=..".IC.7.`B*.z+...U.p.U}...*...F.;>"L...<.g;.....`..IePK.Q./...|.n.a. m.K.qAC.a......}........K]G...pt....../CZ|.^9.S.......i[..)r,...._.m$k.W%..u.f....J...<S...%....+eG..J:...a..e.......#._....W.G{_/...gu%....(.M.....W..|...t-..D.j`....c...S.p.F#....=.A..........=..K...#C.).>........%..V...._.Q.".b...u..4.....G...+\.Qu...w....]...T....&......-.............'.y.T~bN.v..=....%....|%..6...u..A..i...(%..Q..._...Z.....r...."%..!...<.R.=..B.'.......P...Ux
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37300
                                        Entropy (8bit):7.9951473754892906
                                        Encrypted:true
                                        SSDEEP:768:3qokQTqeihe4535Ag3h8X3Z10PCyRAfnEIstdsZIWSZMQ6F58XkO3g:6hH5JAg3SXry2cIPZFSaQG8X1w
                                        MD5:E62F630A00FCEDA8CC2272182255C256
                                        SHA1:1675BD54A40D8348559585A9E3068A8B7CDAC1A5
                                        SHA-256:C8546E145E2F97DCE881E5C4B0E03B381003C146BE1A6FB7FDFD2F594FB15D56
                                        SHA-512:1D9573332C3919B3D41B776DBD07FFF23C4A6A52A653E1DD463465B90F747186538B86E3CBB84D7E1EE4D49306AAC73A60F2C7F3D32C74290DA8658E6E770A14
                                        Malicious:true
                                        Preview:..1..C.x.).?^.d.0..k......i9}$F.=.I4...m..^....j..`._d..d_.........N.y..Ra.I...t.....Av..H.V.Y...r..{.9Q...../...^.D....r.d.`..Q)eGV..y...l.....@.."C...;kB$.ZZO:..,%....U.......i4..ct...yR\=.K@.V4.C..%.V..u..X.).6va..s>`X.#..vD...[.!..1.,..._.s.K..DQ...x....z..r..2.. .9.Uz+|.9.../......=?..F......^.Js.....E.WLD..P3..&./"..._.5.{.-[2:o....uYFq4.z...$..e...5H...x...3.....x....2....A.h.7..y.".&.g`...5&..z..n.c......J^uw..hPzS...J?>c ...|....pF.b\.H.`!......,.DGzI.D._....Lx........f...Q+..{+XEJ..>..?{J.O..`r...U..Tns..Pi.v.AC...y./M.V...@...vn._..........X.N....O.....l./@.X.%.....X,.$.........l./...s.q.Y.6K..9.'.i..TG.S.c....eJ^..g..}...<..m.N.....<4n.=.Un.K..tO#...7..s..m.u...fL.'...o........@V.Q...i.#SR...,j.E.3.......S..kR..T....H]y.v2X..L.).i._..h[..~..9.>...E.u.Q.?&.%J....J.IrjE.....o.T.w.....Z.......B..N...ay....O.Tn.p..t20...3R.?..zZ...+.o !.!!....7....T.Z.M"^K.{u.....4h+...7..gu...'*8%0pDw.......u.dc.}.i.9....vG;...Wn.j#G...~.....OWe*..q.*...I
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37306
                                        Entropy (8bit):7.99457582811624
                                        Encrypted:true
                                        SSDEEP:768:dj1Ax4BapX60hwjpvl3KUxCw74UE/Ex0hwZ8Om0lepzCrjsoO2vq8zgDdA9:djSm6qlxxQw7bYh0apzCbO6qagDdq
                                        MD5:34BDACA57375B578836A427397943CA9
                                        SHA1:F12402B71BFDAF119B2372C33DCE077EFD53B7A7
                                        SHA-256:6C075B3943009416811FCA2A7658897EC172E00470A72EA1763E0D84DB8D5717
                                        SHA-512:50595C50F001CFCD83568F4FAF5FBE0281C14B8BFFE5DE7461E0A8B8FDE39134D5DB88DEC2B0384D0109F3450626BE3D9BF163E2CC64242BF881D78CB3194D31
                                        Malicious:true
                                        Preview:.....D..."O..f.TkR..r\.SV.$..t......W.=..*3..x.X.S.0.....C..U#Wh(.H4....9..B..h...A.q.s=6$.....'....Y.2..d{u..b..L..w..l....H*0.&...T...]..._P..$....'.<..m..)....N.M.j.........<x.Yo.i}..A.E.%........4.^...C..`.09.O1......N......{..^l...yu.M..%.G.B."[.9.V.4.Ic...:........<u'.F[.n.q...f..)..6.#..k..:../Ptj.+.3.\q......%.7...unSy.~*...;..u...'$..y......y.V.Y....<P.._T....eI........h...|.....?h.g....f.2@-.[.[.....<...5.Y....tj..$.Q..*.bs..7}..T.)cL.U..l_..Z.L...D..."X..J.7..D..}..7P3.k<....q....S..WpnX.|.\.U.*)..9.M}..?...1.Oua5d.R.1.......\..!...Da..v..U..D....9aoybp5.$K.Q....r......8(6.EAf......"@...!..D)..._.:w.>..I..0ekE...5..9a!....TU0...n.Au4..{.`L..W.9@\..!.]..6P....AE.e....A...zQE.H.N]`|(y.5d..0.....Z._dK.......P..N.g.u..N.&v.P Cn.1......6.....H..o}...8....q....}#.|.P.]...q..E...D.>...l....op...=....$......_O..?.\G(.QZ...76..:.I.c...p...~...:...d..b.0.=...3.G.&.....e.Ze...:.y..|{..Z.'.....W..56...R......v..`c..(..N.z.........xY-.Z|.P.$.g..C....0..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37307
                                        Entropy (8bit):7.995091649047496
                                        Encrypted:true
                                        SSDEEP:768:KMWaIyvvDZTfWgIqi0e/Mo/kyo8gCf1zDY1NfO5aFoZhZaC8AvX4aT2UGXHB9Z:pJZighte09V3CfFk3fZoZaxoX2UGx
                                        MD5:BDD4E882B49321AA060FFE489A2DA93A
                                        SHA1:6977C61437BCA5E380DC4A49F62F5A8A64A5C882
                                        SHA-256:CB88A56FA26F4035DF06955DE866935C85A423740F06ED32230EF51F8DB93648
                                        SHA-512:9EC1FE2D715ABF2738D105E94AB0F81E35AB5919664EDFA675A2F87F04DB2B8C2F7C4F8E4D8393C73BD8071000B040289F91C037DBA15069869B0705062B5A3F
                                        Malicious:true
                                        Preview:..........!._..s0.i..+..N2...J7.../..k.D...l".h{.T..Z..7t3-.@.......K.~L .s..^.....ZR.K.\W...F.ki.5./.....Z..]S..........`V...o..V...>...sq._...8...j.!..fX.".....,+.@.XW....{...0.yB.....xB....]..,c..dz'.Fs.1...I2..w.)h...\....F......X..S+.._k...../.jp.]...o....M|<...l....5.{S...-.....c...../.!.%}..!..!.@..#....aS[...6.d...y.........&....u'.<...B......._......../b......|......8M....)<..V...~^..])....X.A..o...d7+.wv..ds.kW0..B...Q.*~b.@z..BSB..>.M h...< .+.@.'zOP....R....o.w..<...a#+..y.(.2......5dp...B.\.6X.*.4vaUQ.....I.#u..'pj=.....U.3..AN.bL7.[.P 6....`..`4V..?..=..5....5m.W.o....e...T...r'..1...3.j..".....{.H 1_.GL....4.4\.\K'P.?.9*5..R~y......7..q..A.$)u...X.a.........+.........)w.....9....0..Fj...J...k5. ....r.......y..........:&.....F.{~I...Q"..5....J....D....G.{.|....xR...&..8...m....F.iU\....W9...U..B.I........]......#...a.\.}..0....G.T....+...K$R..6.".W.n.".]t.X.g/.....<U.&.4d67l......6O....:.p....2.6..>.r..Q............
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37294
                                        Entropy (8bit):7.995540241237072
                                        Encrypted:true
                                        SSDEEP:768:yQbiH+nHRM+54r2GG0oM/wSAKVXUWhfuN23GEpYlRw1azLauJdQl9e/:yQFH35UG09/wSAYLluN23Tpa8MdJdI9w
                                        MD5:9BEC4E14218077AC85EB619F114A0AB5
                                        SHA1:4679D9798ECA9D8027A7851CFFCDE43A15C39FFA
                                        SHA-256:D62C2CA468C1F0B600EFBFEBB2B30510CF9FA80E2D98A2D3B321494EEC66BB72
                                        SHA-512:A74EC657A85806EDFBFD5C322993B8A4F7F094010C108020E603AE6DA1EF32C2D95F2175EBBFA9BC22ED492728684BC955D7AAE5FE2F4E5D37879545A25EDE12
                                        Malicious:true
                                        Preview::08/....6....,*.h..........g}~{S.b.[....^..U....S..0.xA. K..~..9p.......c.}. ..|Rt....=,L.E.(x..9%*....K..,eX.nn....G.>.....?..[*QFw....$..]M L.C..[..L. 3...[.g.......>..~.(o)X+,...?sA.@6....E.?.....u.g)6..k.0...."-..t....s..,.tLM....,7p....Z.....v.....8&.Y..G.DZa..+*.._M...'.[6..6......59...&.....l.CH....FQ....E.O..N...d.;..6....~A.z+.....b.;BC.....lY=..x.g<.k].....`..'h6:...<..^;w..,Bg2D.\..Hx..,N.a.yI..T..O..R.87~.T....8.E.........2Dc..z({S5s $P.if...GB.@.r......{J.../.+Z[...Fm...W..:.4/....f.....w..`ip,&K.;..p=V!.............'$Q...|^..4.zy.C..OY.1.,.<..G....I.U...f... s...8u....{<....!c+r.XYSD.lM2..h.."+..^z...R..11u]....[`D#./H........d..x..v$.**...D.D...k...w.n.NC5..}..o....|..,.-...1.C..0*6......r./.5wnn9..}.6...5...X.|..L.d..K.D..?.....N+T.-T."..c. .{3-....z#........$c....X.....d57...p.@=..m...bHXW...X....d.bE..9.j..KR..Jt..^...........G.....M..3.....Wqj.D.OC.{...W.{.. ..=-&f.&.;.ut.b<.X.]..4..\.An...).P...5.4........t...g1..c..U
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37293
                                        Entropy (8bit):7.994644896495653
                                        Encrypted:true
                                        SSDEEP:768:RETF1PJyIStgj9EjR9dj8aINoJmOMIekTmRkrzRcxmIyZd492:AL1MqYRXuSwIekTzrzMmIwuo
                                        MD5:01BC05A52E9DCACB005AB44D7B0DDB47
                                        SHA1:E04BC67B7BDCAD1ED9956E513C6D640241D3D2F9
                                        SHA-256:14D36ADA2F8590C297A884B929676DC0BA2246673B67C895979D221CCF719EDA
                                        SHA-512:84A69F2575437A402312D39122AEC9DBD241F63737E9D438C3D980723AA0277CA1EFC8940A4D203D2113C6B1108C01EA05632733349035F66CF969638326A9E4
                                        Malicious:true
                                        Preview:_.HW.i._....T.B`.p........Z.a./.)..n..k.t...e..+42.....6.^z...X%)YT[8.Y0..%..v......C...h...........7P3.................."..)..Jy.....=..T..M.0.D....w..OB...."../.Gq`..$[.9....Z..(..?.E{....C..+..}A..h.....Nj.}...w..kV..8..:.I.v..IH...*..........8....aj......P"..M...........G4.../..../.....?].[.[5V.M...(..n.+."Zw.L.m.% .g....(.\...*ht.D?/v..2.....D...F.;.d....I..ke.k....}.:...g*U=a.?..UX.T1......K+N).{.N.c.[.$.J+..B..i..X.SC.]2M...?j.....*..........W..A;.L..(...t}*.,.B...........z...M.K.k..b.~.Nv0..g..............hX.[.UH..;...H.*.....c>.Y,7..R..l1.DIe!....9..+....PN.......=..51...Zr/.F.8`.....?..RY ..~.vP.`..qsf..V1].;~z...68co.]$K...I0....ln|6.sJ7.4 .E...Aoj....K)].}h.FR....n.2.)#`.._..Obe.0..7...t.p...M..~..<k%..\.....X_.[a..0...}n.f..n...e......^........t!s...7.......Y.....4.S.&.Is$.........5.-..M.U\.U....].M.....g.".>.a..^....Ut.&...wW.0.......NWbl...=.ks..5$........)...2..Z...;...l|.Y..C....T..C...{.........h..z.Y.....?&.Q..h..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37328
                                        Entropy (8bit):7.995952529544399
                                        Encrypted:true
                                        SSDEEP:768:GbsBLnitOQMgAMgARejqTp7NokzfHMk1y/LyL4KXLEoMK+aW50e:Mynv3jUp7uwPe/Lykop+0e
                                        MD5:74C917FED47D6C9A6A32A95DDEA37819
                                        SHA1:33300067B3E6B24B4E5FDC5B78FE7B30625D0273
                                        SHA-256:ED56830DD285DA6A7354917D21D5ABFC9F8520ED1DC7A0ECFDC58CB244075CA3
                                        SHA-512:C162B3E21C7DB6C97171D967388ACDC155818EEDDA4C211FE63E51CBE8BD0D2F8FF8E72FD63F9EE796358656916038CDC2B03D436BBB4263586ECC5ADAD1DCB8
                                        Malicious:true
                                        Preview:N.,.}..g.ZPM..I..FO&.(e.&l.f.\...=...%..1.ru.(...xIUS..b~-.n:0E.F....!.O^...J.qd.F.1.f....~...f...P~.t.P.A1E....a..O.....2..s.X..%3..s.rnl..*.@{K.2..y..`...C^{......H...i..B..l..*.t..M.Q^..\....w.I_.).I...).S....8...3....x..k.0.(.y.....@X...6ea@..R6.....`?IK)......%.v......:..q.YOD..;......\...a..d.........'."..p}.1...VZ.`Ub|x......fHwJ#....5.kU....X.3..}[..w.....c..}.....5..~..+e*4Z...p.ee.-.....g7R(..\..<...+.1.#=BI..e.b...M.0.4D..V.....w.....`$^r.6o..#..lr..'.Nb.e.C..V9.l=.....{#.o...<7&....I.g.....Z.z..h............@7....;...(0\j...rT...b...`q.L..mc........G{....u....#...?E....`.....a...29.. ......?W...x~.e..g..]H....B7.....<S.9..Sh..^...K..."YJ.4..r...C..f..YY.6.Q..E./....V..{..........]#k...+X.X....N..]/.G...m<$.. O...K..p.5..j........v.[.SEp.I.+.h...m....8.....u..<.f..'...Wyk.t...k....R.epd'Xo....Mb..MH+..RC9..s..l.....H`.~.9.UY.E....#..I....C.5...DP..=.....y...i.].p..&.......=.;.v.v..h.0..)......nx+.N,..R..0yAa...A..tE...V.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37327
                                        Entropy (8bit):7.994667707478049
                                        Encrypted:true
                                        SSDEEP:768:/TfB6aBzZ70WJloBlGHjUpMSn7Sqy0detxQYtr4pk+5OaVOFUsxY:/LQasWJlagNSnJyac+Ys95OaVOX2
                                        MD5:532A75BFBB9101DD83B94BBA96761B43
                                        SHA1:929F319EB74AE31DCC31808039BB79F045E4DD56
                                        SHA-256:D26A2D1AFEA7EED914A1FE0CB061ED3C9375F61BF43646713817EE6433C0A91A
                                        SHA-512:7BEBD3D4EB42473A6D2854B8D7928E9C244065AFEEAF246F211DE1857A53438D7D37576A493B8B42CE05933C25C47CBCE94CAE338CDB1E1E40E3A6FDCF01AFB1
                                        Malicious:true
                                        Preview:.T....V...m.......:...'.s..V.#..........$:....E...^O..Iu...m....-B....*....g...*I..%.}.U=.E..g+......{.>...=..a.zx.?.\.x._...Kn^..n...O$..D&.I..J..n.b..Z.........:....kMt8!.A.T".....[.."....+.......ej+..7.~)..U....?7..2;.....GX...'./ .....7.6\.6P.U$.o....B.hg.!...S...X.Z..'..B..f...._}..K>hJK.b.M].h...=F.....S@.=.p.....Y/...K..$.s`.4...VQU.q.n<Yr.1.IrOa....../.i.f.(..|..S...\...A.x3.}..~2..Fm.G.w..lA..` .}q..ZT.......m...q.Y..B\.]..8...3.]....x...P8..>..<.!.c.......D.p.o^`...S..N...j...0...O....x.P"...d-Ft.R..<T.Y.\...Z.Z%6)H...*25.J0.. g.Pj`..>.8-.!.._.[....^C...).>...q.)...-...7......;....G...\K....|%.;7..pN....G#$..[.l/J.......`>....?3v..j....C1.-.k.."..j./.0.b.hi1...~.#.......n.....j....D.q.Q..%SS.f.7k-...Dp$..V.M....0?...v.TB..W..C\......9H.W.$......)/.!LVl..j,...8." .,....C.H..g..z.<.1.V..L...%,.U..\..:.b....q....O.~..Cg........sd.L..t|.V........m.~.......G.=.r..........7.s...N.4x6.....16..."..%.....P...i...Dk"..Pz&@wk.../.....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:OpenPGP Public Key
                                        Category:dropped
                                        Size (bytes):37300
                                        Entropy (8bit):7.995786554996983
                                        Encrypted:true
                                        SSDEEP:768:DbWGhwKusk6IZuh48Tq6qFkyXJ0eBqWukg6PYPm09bCjdp/3O1TmyDwNf:fWGhPq6IAu8TYKy3wWur62m0Fymo
                                        MD5:261C222D26E7E81B4499E3B7048FC219
                                        SHA1:D13C9499D633EFC0C85020540ACC809E0F95B564
                                        SHA-256:B4F51E4CB566D9E35658C2E133F677168FCCBE7CE9330D099A440C90C48AA3E5
                                        SHA-512:C64BF45AD70DAAE7693A153FA26AD493DD44AA6CFB6AB60D4CE4024BB7E331E5B7E6756BFD1347A1AD5A89FD14FABBA3F1AE0CD76536209565C0533AF1CD2EB7
                                        Malicious:true
                                        Preview:...}u .(Lm...-....v..N....X(.t...39..07..h.<.T.Vs.6..4...Z.....r.,.Z..-...C-..+..#.#.....a.n....*.r..m.MGk.. .=^.....-.:CBH......5o.....$......0*.C)...g..X!.4.\W.b.%..3.....,8.."..|+.l.........O.vB.D.rg7(GJ.TF...%. .5.,.6x[.5..?...6..%k'.....>?.w..&|mE..sEQ.E....P..+Q.(...I.....V......dj.<.+f.<.....^..Y.0...o.fkR.s.Z1...{...e..9....zec-w..s4mf..,.../7Q.~?..H..7.R.T...lF..T..8..>...}.x:.....W4.Q...v....h.RP..6..pa.+Uz..<8..z^..5...#.58..B.".0.'.?aM....5.tP....L..CVN.;#..gQ..:...J..Qdz...|G...C.}.9....BT..xwU.F!;..#<..y..pG..1..).h"..y+k.n9...c.'>.Rh.;6.[..B%.....>qYda.Z..oQ....%.......o...e...e.=u.&..^._.6....q....o.|vr...}X#!.gk.:....a.....(.....d}.E.k.3...r.X']h:PT......C;D..k$..t...&I...E...G..#.C..17.V.v.J.=$.7..M.K....g.."........-.$.5..(.b.@9.._...s..}.Z.=u.T....UI.[.K4..:......=f~g2..C.i.G.....4...._f./.9Gv;.T..>j..FO..U.I..{q.1v.}n.....jS.....MF.......v.k.../..h.O......Z..v...m..Q.w{.P...($J......'m..d...x....P.o..@.......D..u.eA......'
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37303
                                        Entropy (8bit):7.995273619529528
                                        Encrypted:true
                                        SSDEEP:768:6fcsZyX+G/4EVN0d8+LJU2meLhz74f0D6+D6syyy4wLz2dRuhd25RBQ6kzKThc:6sX+tz3tefo6+Yyy4w67c2a
                                        MD5:CEB02EA428D2A02B5025AA501ED58B97
                                        SHA1:CAF3B4CF4DA56841B62FC4CAA7215AD3D08EBCFA
                                        SHA-256:9BE168F686EFA0AA79ED1B0ED745820733299853075AAE21A091033B14A45667
                                        SHA-512:A2DEFC7E9D16A4A8593F82F2237DC0095121E6615A710BAFE93741544A18B348B77D96C6B3C8F7AB4AF6E0804258649959FC664DE4F0BE17A1C16C143B1608B1
                                        Malicious:true
                                        Preview:.x{.....D..5.$...,...C.Yu.p....3..R......<T[8..Y.qrV`.3...<..n.c.a..XJ..........1.0mp.........^Z_....N..h.5..h.....(...}_...tI%j......VW.._.+.lm.....J.....~....T..{..R..AaTcN...2C.S..KB<.I..dZ...,S.[BH...fY.@.9...I';....,Fd...zF.J.r.b...R....<....o.....u.>X...C!...t..W@.L.6.>..EG.E.p...qO..@&....'..!.u....i.2..\&....sQ."v .B.O[K...5A....~..j.M.%...a.&.2.0(Y.8...J....5@.3LCX~....g...a...D..H..i...)..\dk.*#....2...K.3<..X{Kud..ZyIs.m_....m..7.......@...A.a..'..S. .2P..f..@6....*M....a.:....z..6......km.".$.K......:(....2.l..mQ.h.d}&3.S.}t...K..kk'..[ 9(R..S.v.F....e".p.....n...C5o...lL..7f..3K...~.C.w.`..'..].........-..w.4.g{O!..K.......+:....../d.........|y....~;e...,^.2...?2.......No.I0XH.:.....T..$r$.l..M.Y....q..$Q.g...PHE.r{.DL.)O.ss....{...O...p@.....|Sd..*.l..oz9.U q...`..g.".!..?B.Ro'.R.@..W...s..y.N..\.....*mw..P.:..I.r...1..].....FU.....=}z..7.48....Z..Mcf.~;*Pw...l.K52..2...."~..g~ea.W.4.......%..q...=!A/bji....Z......_lp1i.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37294
                                        Entropy (8bit):7.995282613724345
                                        Encrypted:true
                                        SSDEEP:768:0Tw8u7HzP5TA5LjTRBrq9jHmDgpKyION2I4ermdiTtvl+CPqO3Ycts3TYTsxEd3:0TwfzBToLjTRBrCjHMgpKyIe2I4erGit
                                        MD5:2BD58AE8906446DB788B43E4A3CC1B50
                                        SHA1:371E26FE2B043903C973D8177B9A03E760FBC7EF
                                        SHA-256:09B4DCB041DA58BEDDED95B87E441C46C91EF972F0B49FC256CF8807ADD67284
                                        SHA-512:8F071CBC3E1FE8B3847F381F07BEC6659AFD6A76E82A227045D6B3CC8008A2BE40140C49F1CD3E98D81CD11EF8E0697FFCBEBAF78D0F7EDF5186BDF69B1937D5
                                        Malicious:true
                                        Preview:=Kb.x.O..c.*Z.Y.....W..#$z...?.....2\}g........'.._...Q..V....T.JD.......ixr.K..Wu....% 8..&.....K....E.R..w..d5....F...H.ik(....#..@...m..A2Tk....G.oj4..ETH(.l!./@.]..R.E.$..Z..!."q1.r9.[f.k..$nh.n.=..t..k..@jr'.6....?0...-.R...G`'..Z.qr..b..JwOq...:.....9......z.S.voY..7fa..j....F~fd.8m........_6.[..D..Kn.BD..9.Dg......x..yd.._......k..{..)).P........-....~.S.M.A...So.@.+...........g?..y.E."..[.....S....=...qAt.}.f ...O..v.K..DZ.......r.......j..88._. fWG...!\D`....p.j.,..R.G......?...gxBs..$..SU..}..B@....D3.V1.h....r1k.D....s..5..R.y..E..[.|..,.@"5.\..>.....*.F.....$G.g.Y.a..5j.*.9..l.`0...Ip@..Y.yta.......)..,...,..+m..QS.w...ou.FBP.....}.Y.2..f.....$5;u{.S........ j..F.... ...x|.o.k\..BRl5.F...wK....f..'.....f....kE6h..k7..v,x.p(-. .....'.7(v.e4.h..p.s.#&.I.b....Y.o1.....BD\.....$...M`.4....Hf8.q%.U.!.X...k,.R.*.DV2.X ......d..$.I..X{...:E..........9..kua.......;..gV^N......j....\J.......M.HC|..JJee2...F]....s..U.j>q...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37299
                                        Entropy (8bit):7.994904877250772
                                        Encrypted:true
                                        SSDEEP:768:2qUY4N531usGMH1RGl84K5lH88aUewR289m1O9s1Y3:HP4Nqa1RGl84GaUz289D9aY3
                                        MD5:550DBDC9E8E4D80405EE5798D0DBD887
                                        SHA1:EB90A93D69E41997CD7E80D452A4C437B802F3EF
                                        SHA-256:990C1D098A42BD7672E258132058BCB09BEC06CC2B71029F5437F9BF9D9DA13D
                                        SHA-512:80C4E2A68CBEB10266B41590441DC8116D328480C66D4714A67C09BEBCDA2FD55FE069381B8181352C90CBE879C021B85E25E7D31B18969A8EB638DEFDFA3F5D
                                        Malicious:true
                                        Preview:....2...........f$.XM+...; ...\0..N....9..P&B.......k.I.IY....v.e.0....$.L... ..K{..Zm...Q9M.%<..H.J..U/9./.e...?.k....u-.....9.3k..A.a.0................d........tA.3..*gN.Y.rpw%Q`.........!.....?`..<.......Raj......}..=..e.D.K.Z.H.@...i,...ot@'!4...o.j.....,....D..D....,.Jp..O.2..Y.y.g...P4..A.^...N..j^.....d.VXn.nr...Q.P..fO.4....l.S..I..g..)...U...d..8..=..[p..8..8O.(?...... .:7...3.b....M.ov2A......L....4..[.lm....H.t..].(........r....Q.....D..........W...j.7.......>k..j..].B.C...7.}e.A..F=.e..F....wb..f.g2m..B....1.~..O...3.;K...G5s..z....[2.Qm..GioH..0.......=Z..x4...5.bq.4")4.u.U..Y....4SI...2l5...W..a..#.......2`?;4V......`..W.@.4....u.Z.........C.}...5....=.v.V.?..N.E.....K..D....X.U........^kt..E.5...l.......}E...SFZ..kF.OU.>..=g.....2v.VS^V....kq. .{.?..,]7.......E..T...W...B.z.....L"..+P.....~.Q...B.9!.<.......c.i...V|.b.T.....MX*.2.a.v.41R..t.....z.B;..5..R6.P.._.d9.1.B4...7C=..G.r..H....nc...v.O...a.lo...K-.%.U..O....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37300
                                        Entropy (8bit):7.994767612986387
                                        Encrypted:true
                                        SSDEEP:768:0PgS7PSpdkJ4WgWP/XtcIFk80I8YZN6MPv3YV0vGKq:OgJpo4WgWX7/05268vR+D
                                        MD5:06C811836630C76AD0C3ACDD2CAECA48
                                        SHA1:23D1EDC872AE14D41DAC9ED53C753F43DC4A1DBB
                                        SHA-256:4AE53EB885C01285FD5027D65797AD5BE120E2E0BFF90935BD9653BBE1618716
                                        SHA-512:74816906F90E2B3B8AABE9018B5EA62AC436844493C68D19953FCC702C7A62710D2F9FBF60AC10BF224B10C68D6548F344CBB2E5F09A10A0CB51208D1084EC4A
                                        Malicious:true
                                        Preview:.L.]e.}.i.!.5iX...H. 3o..@M....M.$(.sy.....y.B#{+m..Ea..d.f...m.-.D....RV....m....Abo.#~b.F.)y....yh.~.isO1?.p..X.B6..8y.~.b..F.'.,.....a....$...d.f...m..Ej}..h ....!.N.>..<....P.(:u._..z.B......(.v.#.i....u.H...."E|...I.ZpF...x...B.GH..6.+.9.U:DE...X%...u.9.<...k.._.L...[l.%8,..#...Y.S..K.....a.....Iy.Pz.l...3.KQ.PZ.1......@..j....)6_P()...dx........F|2..`rf7.k...9n.K.e.....:...%....=v~._.g..O%D.Ox..G."...R.....P..Z..7i...4P..M....R.D....8}.*..w.1I........C.........O%..."M....7l^.Z....N .Au.5"..z .t.C..D..G..b.....k......4.m......6..X....c..Z...gC..C..........O.i.....L.8..l....M.0.$..l..k...{.8oz.........].+..?.D..r......&4.......E.(...G...m..E.n.k..o.[0. 7.~....n...S.1..>Q..La..Tun.+'55k.tF.c~....).....2..7..kZET$.'./]j .p....I).OQ.{....-|.#p.....,.~..8...M...D.....psX....{...q.k..cn..w..S...q.8.5#R,Cy.+...C.>"DH...z..j.w...T..Z.HE..-sT,pC...S..:.PTlZ.W..8...y....u }..D.W..+.(.a7.b...;.I..}.\Z.V....J..t3.CZ..XKv.P[....;...S:........o.R..Z.V[
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37301
                                        Entropy (8bit):7.994871516887041
                                        Encrypted:true
                                        SSDEEP:768:t0RgfGJCLvygaLN2ILzAwEvP+FpdDkOJz8NE:qWbSvaGFciD
                                        MD5:5423C56C36522B65BBA47B3BC4EF3AC0
                                        SHA1:2EF6913F4D83C46991058AFEB841FE97C171E7F3
                                        SHA-256:7AEBBBB7432387B0CDF9CBB837816DAF2C6100E3162715943355693F7A5A3096
                                        SHA-512:7ABE93A80F693F1199BDB17B10CA84A7BD4ACB4BEC3335FACA0786F61229193ECC759C6A1E5349976BDE6523F98D6FC53A7AFB4B17C3D50C83EEE881BABD23DA
                                        Malicious:true
                                        Preview:^...]3......@'&.?.tZ6......,]..=........|%[........:O..!.I.K<...#.C....jd)I,.F...l..7..RB.#`..Q...,.6..HG....}..<5...OI.........d.xH...&.t..hu...z......d76|"..g...9..eJ..Z...F.g...9my.Z..}.......3|S....V..0.......e....?.'b..P%.C0gP.X.."D.E....-.tw.F...N.ea......F..U...sN......\.......P!..\..`U....2d..z.d..T....#.t....ZB........{...5..s..(...MUB].5.......jm@8../.....8..>).E.f<.Y...R......|S...5K....q.L7... ...I.n..UD...\.../.I;......tX...}_...h..ugk.e..2..F"..K....-.Io.b......!/nqa.:.k.~.P..Z....o@..5.{..b../.|.A.j#M........97`....b.r.x)T.N2..e[.3..c7.}..G.]..M.Y.[|h.YH....)pn<K6......:F/m....y......K#:/v.s.*.....5gx...p.|.).31<.}.4.....JZJ.[s.zX...r..'..... P3r7u&....?|...!J1,...7a..*q[..m.......FE.f...F.i?.d|Pf8.0.{d...QO4.kG>...*..4.:=.y8..%.O7x......k...X.....Y..........@.\.s...<".6..&...<H.......,|M?......`$T.`..7..t...B.,..}...`v....].......F0,..o...0......s.d.q.........]LnN]a"[1.R.Zl.:\..,.%.,..g..7..z..@S...Q...._._l..`.}.....B
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37302
                                        Entropy (8bit):7.995266876565895
                                        Encrypted:true
                                        SSDEEP:768:rBfLfY/idU8f25VoufHz8V7Ouf0z/CQnlebwaPHiFIz/kTdIz3:rhw4U8fI+uvz4avz/CQlerPHEI+Iz3
                                        MD5:6C9A460C66B3C03541C0B418116A6044
                                        SHA1:194F8EAD31170F7065B7F6A716FED32C99ED6B39
                                        SHA-256:8058FF78DD79BB145E91A43C057014FDC5A01CE45068F78C1CAB3DF3D74DC384
                                        SHA-512:17F6D346A66AC52EF38D1DF6090DFCEBA8768C4B3EE08D123B333FC25B41791BD1F0B85E902EB80FB1794B39872E5609E2A070B698DAEB32B470BF9884BA0C08
                                        Malicious:true
                                        Preview:..1..M3...].p.b1r.....`.n.n&...t.(Iv.X..(.t..-....-.g.&.p.7A...?F........* o..a..o.'......4f.c0.{..F[...).....o)e..f.r8...u}.V.ZV.MH..MJ.E.a#.B....i......./..KSQ.H'.>...3.w.....v_.7.h<.{.c.K.Z~*..hR..Ag..nx....#o_....A......p...P.:.G.o.gmj... ......N..\.......)...C.lI.c.h.|.M.nk.oY.}......y.c...j=......x..r9.......b]=....\.o.....e.;p..z-C3...~.~O.c..'...s#.q.|..OZk....%./.es...K.......zW.p..`..:.....R..%...L..Z.G1.hb..0..y3.h<YZ.-*P3..~.@I......\.fh..ja.%K..5;6.vS.O..04k....>il.t{+Oj"..j...9. .$./...G...]...T7...I..7ChX..).h..4|S:..+..k...dC..p.y..N...&.#.......N...}...,$-v......^.Mt.n,yW..Y...#..>.,\v..k.-.s....../..2gNi.+..m..r.Ri,...`.......M..._...q....3.vt.....0...]S.[-.*w.6.`........6v...P.....+T<.wb.6.*#......,..2".6.Yd.x...uj!rb.H...;....?.. J=.....U......(.xS.7W.......)y.o.,._...D...F.....}f.PM..L]V.......'..........%.g.>.C....g={y.......r..M..$...f...m...dR...N..-..{..$...l$z....?..-.F.Zp.I.~,....}......?e.TeU....R.m
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37304
                                        Entropy (8bit):7.99483136802808
                                        Encrypted:true
                                        SSDEEP:768:ETt/KahURBW8pE5AUp5/mBw/gGef9U2cB0x3MUfnxF3+ado0+1FXm1rnd:ETt/bhURBPpE5r/Czf9cWx3ZfxVvdT+o
                                        MD5:77F470838316B37DEF1AEF7A8D79961E
                                        SHA1:64F6BB0D2BEF1C3F62230DB52B5B98E26757572B
                                        SHA-256:D8BC7690512ABEF33F09BA81EE5DCB4742A7DCA7AE527D7B684AB614E0F76D7C
                                        SHA-512:16FBF20E35EB08E9050B4A507880B368E667C4CBC8D70C5ED3AC8410B795AEEABFE349A203049F54B511B7C7B859813F83FE19719EFF61CE428775E5B51BAE5A
                                        Malicious:true
                                        Preview:..`....|N.3K.=.sg.3...R...X...j...v.P.[?..F,...A.j>4E....K..'..c.x.01.....q......v.z.j....w1[m.%...^z@.d.. |...N.:(.(p....Q .m.1.g.p.kwp.4.0.x.....ff,.3...y.......w..........A..3.J|...#Ln......#.$..&..t.4.0._\..]'.S;.U..Tu.#......2).....2<.....d...J.".:E...s....j.....2....U|p..!..a$....5u].`D.....$jy.}(.q....L"w.-.A..i..w.. .v?Ws.MMQ2.4.L.......2O...7...~5.x;F../...J9..oH.kx...I.a.e...`..9.:0...Q..#.9.8..........1IE ..k?.......`...YUs..xM.z....1k7@....he.M(..P..q.w..x.....=.n....Q>s.6=.o...&.....$e..tF.*.j....^...g.+.t@..t......)fk...O[+.. .......zn/.......5d.rOj......h..A..^......@..Zy..h..j.?....O.}.@~.x..I..%...@....%...../.s...u.e.1i['.....g.1..c...Q.!;"5f.. .p.`!-U...o.5:b....^#4..d[........>pD.......L.m.c..-...x......0!Qt..8.I.|/.{..%.....:.SM.|..k.......2%=q....d.,.WiKH...*7../6:.....x.0V.l.c...a.......a.b*G.\9.....>!:T'.....5.h...QAi..#B...H...K..p..m...6=.eN...2.:R\a....F...Z..I...G.V...m.G...!..S...`....0.\.C.Y@r.;...T%......L{
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37303
                                        Entropy (8bit):7.995012779945125
                                        Encrypted:true
                                        SSDEEP:768:/jz90u19JFvHL6L0RkDKPt7IzxgPcVFFhu0umSaDukJjUkw:750Y9bHLKyixg0xAqNJjUkw
                                        MD5:8485E861D4073A26E47D0063FF718ED6
                                        SHA1:CE5D1DEAF483CFAE72E0D79531B1DC69FD2EADB6
                                        SHA-256:378DED42B3D7EEE0DF5CB30E755ADA4FA1C0A87C530BB6309A781B238E1C5ED8
                                        SHA-512:5A824D872E7F876778B3E8453DF68F8CD5F60F3C75FB34C1ECD849D5B8AFC3135BCA3988E00AE04B39422E37808F78491F0E83527D6A4A9FFEB15E5C778EF9B7
                                        Malicious:true
                                        Preview:..!)'Z.t-_.L.....k....0C....u.....Yuf.].O.......Jba.Z[..h...54l.g..7..6{..~..KP.1lM.Fj._tTo...u..c.>_$^..D`.l_.S.u.~.....0...{#.......mt..^.....O...=O~c.Ws."...>.^...Bt1.............e...A.......x.l.j2.y...,.L'...m.V....Q..B..81.qu\...|y.D..L....D..k...T:k........^-..Y...d.Z.&q.qv[.....Z..~.~t.....wo.*b.>.........;.7S{..&...Je...5.,G.E.........(.==sH.A.....b.D<...<.K.........I.h..*3..-............F..}v..XU ..W.{.u05.....Y...s.;.2..W.....%k..._j...3..i7fu.M5...........h..[.Q_.../;Il.."9w...TsW.!.....]..B.&.g.9Yx>....[ ..bH..:.+w.*.`x..A..-J.EK...7...|.....Y..n.......~......2.w...]B.VK.;#...v....%......F..|.N..N...{3....uN...2t.n[2....}"bl.QuUd.z?..~.`..RE}H....f...dH.1E.b.]..].b/e.4..R..I.|.M.....k.*.u....d.......:Q=}xH.4L.y..'.3!..p.h.G...............mi.....wu].%%....B.ao..*.T..dA.56...Q.T........J.)-..5.H..^7P...Z..i..P...1..s48.......{DT.u..w".B%.?.....Y...x7.....H..<;....ir.ni..e...T....L....JKt......DW.3..h|....e.Q.7.2...o...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37302
                                        Entropy (8bit):7.995470119890469
                                        Encrypted:true
                                        SSDEEP:768:StkHr92otZA6nW55JACCz3wgEaOsIukCYlnJaPO3pch8ytoSl9:S4Z2otZA6nkWCCzFE7sIukCOiOSqooST
                                        MD5:8383AE1B0757A160059861F1BEB8ADD0
                                        SHA1:B5E7BB770B5A105B0E1BCFC6104208C59FCD0C22
                                        SHA-256:3C61F7E6830EB414098D9E9B83F3278B2FC1D39015B6BC7AEC9814CE99687CE7
                                        SHA-512:4E1A9E95EBA904B4D0BC04AD113887ACAE1DED7B7240BF1E219D8C5BAEAE6495EBC5273BBECE47937DE86D8CD8C2C9D5B3CD8CFC0CE38A35C707DAF0EA764F11
                                        Malicious:true
                                        Preview:N.~..r.|.....3.H.....w.V.7%c7..2...y....+A.)..Sk.?..#.71..}2...E\....Q........w.feqB..>5.[.(..........:......u.I....|...j..|...Y...x5P...%.O.,.:.P...c..V.(.7.w.s6...Z.U.N...:*.y)X...=.a.&..jz...ix........Q...L..,m.Jf.a....6.4.=..eF.d....f..1a.H.....P.]...I....I....)...m..V.n....=.F.nlJ....<...O.U.....c...I..r.#..^.L..@..lYS.....4...!F..)#W...W`0Q.X.1...~........Z...v.!.eR+`.cb......L.....E....!..>..\....R....r..Evi.....z$...fR=.u[>\..1..|.tI...j..&c.....k....!l....x.....0a...Mi)...L(#X....r...l...<..F.....PR...l./..n.S..p..R....~>.L.-.<.!...[ ..#..".Vt.J.......ZA.....s....%.`/...N..I..z......B..Cm.E.......M_....!.........a.6 .}!.X.:..!..........&..0.Ih^..g\.....j..9...`g...vZ.V...CD ...-M.t.Up...zX.$4......Rq......x...).a......z..........#.z....(Ur..i.0.|y7.L.%...d..lTU.......8M.....LcU.>.5mr`b7...>.0..".....3..n..?.M..FY..yD.2A/63...0..K.y.f..l...(....1.Y.6...f].F..0'..~...Y.b.<.......y.NI>..KV.....Y.v^...:nZ.....;.sur@...U@...*3....+...n.D.D.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37301
                                        Entropy (8bit):7.995124014408809
                                        Encrypted:true
                                        SSDEEP:768:7ekEimcUzOpwiWP6jQd7bZRDj5KRDLyueEH1xMhT/olBeV13vMGBUkbJaCd3:yplcVpwmKfZJj5OyueEHKT/ofUvMGBv1
                                        MD5:C6E4A615B90F193FE751D32CAE915738
                                        SHA1:EF7AEBFBB9D7F96D1BA06E73987A8FA23EFC1866
                                        SHA-256:A4CC3BBA91BCA7BFE0114DB4B544C9562CB24F15B62891F9288C444E12266021
                                        SHA-512:4D5789C60CE4CB511ABFA51074F59BA4E96BCDC8F5E3B88C99ED05C0B5BD92D244C16BCCB995DB0869B3883E60C0D9E0C3629D399DBD1EAE99574A18B2DA667F
                                        Malicious:true
                                        Preview:.eO..*;P..tA.5)..~S*.=0wY...W....Lf$|G.%....^.h.I..w%...EX.k....(.. ..$.)Ry.o.>M.x:oF.>....;...P[h....]..>...M...l..a.=e|....)n0..v.@3.9p0HD..w..+...6...D..I....>.)...>...i..a..B....*f.D.Y_.g........9R..Eg....L>....W..H..D.>.{a..)......_C...qr..n...Z../..N/Ee7N.`....C..8.R`.g...O......L".....P".......?. 7...f.*m....'..&UZ._.....Z'.....iV9...-S|.Y.g.P...G}=._U&.A.xM.~..........k..8."......X.V.^....2.~/z...8~W............g.PE...x....}........2.%.M.ZhUA...Z..,..........+..KI.f.:==...3.X..hhT.j.@m.80+....z..c...S...*Y" .,+..;Jh..Yg...Y.....j.....Xj+|.&;f....*.......H7 ..Fb..{S....%%...,X.;u.Y.-kf..A...l..!....x.....w...q.m.Z..l..........<V^._NPH...(....8U`....6.]Z..a1.6....{..r....C.#..%..\.^ .`...(..~....Wr......}....Q.]...o..~<.g...|.E.Q.4.M.%.mM...gE...Bg..Y...c :.1..Q}......SiN..`..;B.Z..6.$-..6^../O.]..e..qA...9..(...*..4.@..8.n.....#v...J...V.{..m'f{.m."..b`.aB...}V......\j:.....].R1.._.......!.d{`.?w..vy....!..Q...V.b..ge..glx..3]...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37301
                                        Entropy (8bit):7.995402185281166
                                        Encrypted:true
                                        SSDEEP:768:wZO1f7OfL8yXV8zL+fFfv7MicMElAGUvOtPEF+5fONbNbMbzftk7xkYo:wZOVOD8yl8k7M1GKP++1ONp4bzf6yYo
                                        MD5:697B0B11CAADABFBBAF2F4D3237F4721
                                        SHA1:2F4C825377F097D1C800ECF181E04C0598BAB793
                                        SHA-256:9FCCE2707106ACFA92FF84D54EFB2F1423F235B1A8C39ACB3D0F6868425B2D1B
                                        SHA-512:42B5BE8C0BBEFD8270025377D39277E68B766AFF9B64050DBCD89EBC0A6B76F35E27772E432ADD12DE6B9A411C8A9A452DD59245B07082C1EE6D4E501435B2A2
                                        Malicious:true
                                        Preview:.....nZ.....$I..z.R*...P.....$P....D...q.W.....f..*.Z......w............Q...1..^.C....B...+C..!.G;..`k. ......1/..t..5..4.$...@.".3../..Pt....=X..`..@O`...U..3.0.H.... .U..c.*7.:..._.=..f......h....0>.E.7.].2m...{;.......u....C.Lm.X^.=.\...<.D..^fX._.4E..M.....1...:d(.'....}....hMz..q...Z..L...:s......wE..@*B.H.[....D.l.|uh...4g~...u.."..*V..{O3f...........4.GX..b..-......s..%p.....3..B..(..o.}4..v..Y...A...}...F....6.....9..6.....y........!..Ov+FBa...z.0.L.?.u.^-+/........F..N.(..{....}~.s-.s.x.r.3..9...K......e.8.7@g...G..z6......x..K=9h!|....<..}"...e.Ob..8.Q...5..=K.o.........$...z.!.........%....Mr..-6<4..19.L2...[(...J9)ZfW&u..f..$..l..T.6.......p...J..g.w..*.........<....9.......1..rAz.. ...[/2..`..#L..h.......H^|....N_(..:......S.^R.......0...8.....i.L..._......^...p..[..B68.p.......:.FN./.zNY.0........v...<.....:'st....Fb...iQ.....<.V.j...Q....).M&......1xJ.0...B...[..z..!.1.Jo.J.;Xs.BG....pcHVJ.M%;.j..o.....j.$lm1... '......Y....z.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37302
                                        Entropy (8bit):7.995231393621219
                                        Encrypted:true
                                        SSDEEP:768:9hia4RDU5IxKtBr4OAeZ3iTIW6Ws+2bSlMZjcz/X4QgjLsn2AX6yaRsW5I:98a4RDvZTZs+vlNz/oQgjLsnldW5I
                                        MD5:71A0D880211B2ABA7B7DD21B0D4FBC4E
                                        SHA1:61FD95EBC008E8F37DA8037EFB555F149C626E35
                                        SHA-256:E5B33323A0ECAD0C4C98317818E4FE7F77A8D7741BFCC211341CCF00423D3CE5
                                        SHA-512:98BECD3EC91297A5EEEF5C248377CB366EC624BF1E079496BF2524578147AB2BB7C93CE750B43B979F253A1F77FE5A565E672BC9D5FB82F735CD02E27E419676
                                        Malicious:true
                                        Preview:Q.V...as..6p{..ook.$..A*.=.2..LH......!.-or....ha....`-.........ii.5..7[?.......].T.....]....0.Y...X]W9S73M...j}.:-:Yi...cIO.'.x.S....[S..u.+H...@..D..]. B@.}P&^~.$.....77.T@~3Ld.p..... ..pL.Y...J.}m....jbM..r...}).}..4....2.p....4;%.PX...y.{...bi..~..zc8.CM.......dy<q>.7>.5.|...B`ua.....I...H...0.E...'C|W..fC.....G.O.g..r?.0...R& ....9X...`..s..!;..U.4..........fQDd.hy.......=...B.'.G..7.T...=.G.......].,..2ACX..w...UR. .#..<.9.h.......T..4.~h.P...(.@jBT.Q.....E..s......~.B..._.....T0.T.S....[}.I.)2{........c/~.......h$.?..)....=E=.\kMo*||....w.R\%pS........y.KDd"....0L}T..0..o^..m.mL.....9..\vU.C5.o$.....h..+`..>0.siB..K4.'.bn.....wj..U)...+;.y..@..w2? ...z..."..1..B.m.J*...\=...r......s@..@)..e.;.-7.ZE."B.!.8.c..(.t..e..\.!......;.Psv._..?.._.S...<.I..x3....X,.6..w .P9G%p....}.IF2......&.l..$2.q\A.....Q.f.GG...t@........G.E.4.{?0)6.+n..`..0b._rm.#.......N..C&.DU...'. ...P.......8./....7e.. .G..;.k=.c.HO.Iv.J@.._..Z.....H........G$.4.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37294
                                        Entropy (8bit):7.995137504277237
                                        Encrypted:true
                                        SSDEEP:768:p13+y6BWqX6bPGWan7y3file4bp3LqB6e1Du7sgOyHKszmEz3zHK:ft6tS62v2F+B62DwOQmEzjq
                                        MD5:FBA104C9FFCCD6299BE45FD1038DC297
                                        SHA1:4977E7424DEF9BF8935991DABBCE98ABC5B0C233
                                        SHA-256:D409C9D3CC5C70A9F4B305BCFE292DE0B4097C5AACE59AB343B54639DA839134
                                        SHA-512:05CCBAFB8FF5838A649CC516B76EC1EA5FED89C4456950607359A8E9AE8B63225FEF98ADE864D067D0356E2CD448266719E63F3F4D1734644D262817001E862E
                                        Malicious:true
                                        Preview:3..8*o.......=tx.~..........C..^uB.7.g0.....%.q.....z.0....-MB.....eg.........m.....D..T..L<.$..%......a.Q...B.-...X.l.......jXJ.K.H....6M.]..$...W....BcG1}.<..X.v*P.M.5w....6....=..j.L]f.w^....I...Y.R..4..c.M,B]... )T.By..Xf..dK.CW..-'..)>y...u7.$...+..+."4.....i.$.cG.....C....F....`.E...oc.&:0~..t9..{.)5c.7..<.....pt.@.m...on......hq.....R.UM.....g)....U.U,..'.a.A2;.n. ,|.0X...c.J...U..8..n...*.>#.f...qM..lq....Da..-........` ?...s..O$.9..=A...!.&7.&\.d:.Q...+.o.t..SI...V...D./3R.F...}.).....e.....;s...i.Y......+.....E..:x.........0...q.(.7.?.W..t53w..^..t..G.>d.E..A.(`]..vC.+...@.;..9xX...m..L.)..>.rW.....\W.....D....'.....R.'.........B<..}..X.!7.- fN..Ir...#!W.2.&Fx.v........z.#/.4..Y,.6sf..v..O0u.Q......"f.....<O.a....(.>;.WE.@......(.t.zC........G).gU......{.L..\.Vs..K.......6.......X....,..:..,..rT.EC.e.y.._.T.XI..'|...:..^.8........A.:..)..Cp.b7.^.... ..[....v...?[X..7.......7.....C3.G..u.Nv.r.w.k.Gq6\..==..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37312
                                        Entropy (8bit):7.994956730088804
                                        Encrypted:true
                                        SSDEEP:768:uF2AR2L/RmaEWyPWggESJx3VLBdczX1y+qeTBbP6I8w30mgoVRcSwl:a2bEaxyPWggEcFLBazlXhiI8waoW
                                        MD5:8DA12B0F59C8C2BF9ED09B640A900E32
                                        SHA1:128247A0B9268574E960FFA19E65EEEB4C36914D
                                        SHA-256:BB16197C2CC135A35D88B16D3EBEFB0F8D7C752C6E07AB7E2D149E6343350491
                                        SHA-512:68743B01E6647D0DD6F785C08CA477F1F95CDC68F2E63D7C01473E920040D4FCAB1909E2E026935081CD076E0402056E30E73030A8C887143954DBCA0555C194
                                        Malicious:true
                                        Preview:.....34..M.~...../2.m.^.O.#...0.\...;......HN]....Wq.a......P..W[.{].;c.......^.[...X...DW..g.;.52.2;.:.5.G...q.&.....OJ....L.C..M.5..N>..42..".(?..n.W......Qs.l.e.0!yT47o.6T..?...d.#..8.Y.W..,.B...G..>.u5..B]9....~.Gw~x}>..oN....9q.1m.Fw...Bh....(`#..M.zp(bf...`dvJy.....FJ....H..]l.@F.y.f'/..pb..... ...-f...!...Q...*.;...B.........3=.6."3.o...*0`..Re.(.0[.b.4.B.........u...B..6....|.]:....Y..E.(..$m.3~K|....#..+xu....~...!2OwT.}/.4.q`.!..!...h%u...U..V.>..M!.UoD..\..8x. ......i.).5WK......(....O..>.N. ..x...`.4.N'...[..2.X.l!\&.....+....NG.5.)E.A.(......a.(..v.Ooi0..r.d....g.u.".n.. ...O@.hE1./..o..*..Y.k."...b..a..B..I...Z?.Y.....D.....Gm}..l.e.......uGt.pD.....[....X.#...4.d...d.\...5.....A[...../..0.*j.e....t....f.....L".A*.4r(....1..l....8.Lh.Da...&E...+g...S..I%..#T....r.....U..e.h...UK..{..9*..r.6..]..K.8...f.4.B.US("m.e...O.3H.....1Fnk...9Y%A..QW7.(W|.....j.p..........?.....5.iO*...2(......J..|.B.V.E.(H...M.....|...2x'.!b.r.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37294
                                        Entropy (8bit):7.9958750594145105
                                        Encrypted:true
                                        SSDEEP:768:uMwq3gbOOecWj8qUxhCytlrDZTCGbjObMmamIu5ae7EtT33u57:vwq3gbOVj8qwhrlYGbjIl5p7Ed3K7
                                        MD5:C05E9497062291625319449AE45F1347
                                        SHA1:362A69D8DB81F259DA67B168B9789055B6E76BA3
                                        SHA-256:F18955698C6ACC52480CC4C3F4CD1D87E86EFE95E630E1EE69D9590677C00847
                                        SHA-512:C6337F0A0DEF10CE5E48A5A6DF9FDAE7610CEA4447B64B14CE77453F27C4D3C76CC2272A9F24027B39030731773E22AC22238A9BD0680D6FEF43FAEBA9E72D10
                                        Malicious:true
                                        Preview:..i...|..Y..w..J}s..p.x-.....$9...4. .P..>2$~.....DS:..h9...J..y.........Z.....j.~_...'K6aq.i..~.e.+.......,4].....c*..PO}(.|q.W...R.i.0...{.*..2.u.x...eO.!.U.....F..?^..O ...[.^...le.k$.Nr.~..lP..i.<....d0..pO!Q..e~1.a........7.O}..Ch..5..@ ...0..-...C......R.c...)[1..g.....o......!`.V7.....7.TE.;.......5E..............=.n0@#...}OAd........:*.z.(g.......<....`.^.m.....c(*...g. ....0....8i.ACGv.N..rl.8.....l.o@....^...9g~..x.>%.?.+.."........b....$..-e+..p...YH.-...8.d.4c......cQ!......N..f..J-.....NRzV.../f.Zl#P.F.M.U[>.h.G.mk....d~...5.kU72............,^qE,.P.w.y.....R.....9..!...N.RjT1..i..jv.dk....Cd....y..n ..{.C.....U.....Wh......as.P....~.XE....V..sQ.C.+"J.b...F.}~..S-..*e.!..-.p.E.Z...)..}...)....!P..ua..[..V@..-u>.)...../p.....b.4.@z..T...X...li.l"(./.`..D.U..H..?FW.O..y....T.@.f...v-(..S..._.G....R5..\..j....\.M.....\...}...e..Q.A.......S.T....eK.'..q...P.<.....7.....W./K.....2......y.R..4.VE..fr..CGI..m...!..+.Y..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37307
                                        Entropy (8bit):7.995196332662406
                                        Encrypted:true
                                        SSDEEP:768:0V3O6Pmuk4SqYnxt3v2oHCtzfzHhsIoJkJ4hy6IKB/Ql/PAne35KF8E7W:eR3/dYnxt3VCNfzefKJnKBYl/K2KFfW
                                        MD5:09F0403396527FE49E10567CC039F132
                                        SHA1:F8F36E76FAFF483C6CA5A4D6A75D74C875FB78AE
                                        SHA-256:5F42A2D1A1E641DDE735AAF36BBE9795E0E9FA30F35DE14388BBAC66EF220BC2
                                        SHA-512:A54E85B3F0F71BC8B7FB1132051C662B819640483546462B2D9EECA71C8B9B895D7ACD9F0FB76E698767191E6C7059283F0EAA691138A20BB514403EF3E43B13
                                        Malicious:true
                                        Preview:..%.......^J[Y..I.I:...._....n@.......XkZ&.:K.....3..09.....x@..a0..*.....#.+...X....f.9w{..)..TR..@....%..E.V...^i..:a..O.......d&!.2.8.Qn...<..I.9..6......[..S._x...%...{..jLK.%.....C......J1.<..S..e%.c.5.._Ipq........2\.F..9...=...,..U............n..].@W-w..-A8...e......a/.[#B$.|..A.....x.7.......(... y..'....H....%...o1'.....e..1..k..Fd..+..E.........x.\|.S.B.M.0....b.;..#..T;....g|...g.F......1K.Y...B.q..t..|Q.....o......\B...p...~...........tr.../....{..B....5V#.D..z....<..^.2?...-.c....*...%..U!4..J...3..lT......8n...c.*rT...D..C<......X...-...R..>.....Vc&A..X.....%.C....&.. x.,......ZT=P...S%./...V...h.*.......!....3"..I..i...B8'"l..B....?GO.>1k..C.y....k..%.h..d..R...h`..e..%..~...'..t...Q~2.A.&= >..i...at...qf9e..<.X........PV{.......r.>p.gvojlg......u4R.1.q.../-.L.Z0.n.0....w.,.Z.T..I...'...._...j....e2<....z@..I....U...L'.];..h......B.N...}...\...F..+..d..@v......o%KbE...d..,..pO..m....~hJ..=.*.n..r..pf.1a.....\...]..wM.Q.al(.l.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37301
                                        Entropy (8bit):7.994305927212963
                                        Encrypted:true
                                        SSDEEP:768:GVh5tNN3Oc8OHL3zXAkwO/aocn3vmP9H80/:GV1FHDrXwnoc6tz/
                                        MD5:03AF762F00719EAE3DD50E2D7518FDC4
                                        SHA1:0F6F314FBDD9FA12ED3269F54BF520E0DD41F7E9
                                        SHA-256:3EA5381C1FD09AA2A4185720D5E26BCD7BD9BFDD4E7239BC444828CFFFAC395D
                                        SHA-512:DCD63EC7FC2C86E193969B88FCC8CA3CAF8586569ADCF8D379BA1A66BC9624D0127EA1A6B75C171F07DF11E023C07B343D234A26E561030B87DD00CA36F3EE15
                                        Malicious:true
                                        Preview:/....F........^.Bh.L..&*....&.........6.l....a.d...{NPr.L.;9.?....~|$..O..x".0?..>...T.......#.<Y..Eb.,.9kQ.o.[5...<4.6...8.%O.J..p-..B.t.x.)w....z..Mtq..7.p......{..5.....g.bja....!...{..an'W....`.....v~....T.).....@.`5Y.^.P.<$.. ...i......a:.VY0........2.....1.w5..x#=....O.....sry..-.U.%/~..a..fy[0.a..VV.V..T.&.t....7......L..d.e.....Y.Z..4..9.S...m.Y..p....W..58.z.qP....E_R.K..y..K.h..X.....0.........P.M1`.W....g..0).l.nR..;....i.6.....Q.........O..AN.,..}...-.:...=...%.f.(......IZz2k.O.....yc.%....n...}......u...sN...: 'F).NVr...k]..J...]b.]._...<p.......F......FL..$...;...}...SB.H.s..b8P21.k.......$.~.e...-...{.q..i..O..?$p..!:........./.....#jP!....H..lb..U%.H+..U.1;.6.w.N%....O....w...*.Jp}-.U...<66.r... .u&6..c:=tM.x ..0..s......F~....GT...>.k..|t..lD...a=.b.RD....%./.d...e...y<.4....t^.i..h......-:.......G..`@sA.CD.S..{E. p..t....| .h..a....U...{l...,..`...0..).....`4.!.<.+..3o...?/:;sY.`g*..d\hd..H)....D..A..*...4j.sN......
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37300
                                        Entropy (8bit):7.99533878562845
                                        Encrypted:true
                                        SSDEEP:768:uKfmeFfvTXO/LVsp0fmWxOLBiy+VyjXR1Z0W20EDzHdw:B3HToOEOLBinyN0vDK
                                        MD5:E0D06C7F6D576A26A6F5FCB10238A2B4
                                        SHA1:3CD75837E1906D615EB94F49320B21DB215D3F6F
                                        SHA-256:AB9F7C7E2440376BB31446095EFCFACC886E77362461A491E05FF06A9F873AB7
                                        SHA-512:01690810005E1C0E222DB23E04DF19C0BBE878F7AC7E750657A6B0D5E0F226859E0DBE1E6C154D9179C705C74292940573A76BF77EE61D94681B98DA4DF0869D
                                        Malicious:true
                                        Preview:..V..C.~..=..\..(m4..l.^..5&.uZ;..Zc..3b.-.>._..^.....>.#..tR.)\....^..)..+.W...E\o&.7w>.;K......FX."x..~f..m...R.ZG.S.%.......P...6..O/..-.T }..d.....4M*.:........HJA..3a.E.a..Lw7.I....3c..Q.d..nBb.F.]M.eL...k..k.H..v.N..D....q..6V..x.....i^.....y.9|....g.f}.N.B..q.Cs.....N.f.){.$.....#...I.4X....~..9..f..o9...ayIi.......L..,..h..Pq.V.Y8....X...{.UI..(.n...DR..5....W.od..A.PM....x.._h.X.....M.O..'.....Wb.I..i...........E.v3.<.4....\$..mi....OeT..:J...h.K.-.......)....P.~i,.......t...........0.|m0..Ho**.t..i...Ae.l.....\.Wk.K..>.Q..<.../..N.....cq..{X...yI-.S.2..K.._@.3........._....c.....l.?5....#}7.W....a..3....:D..e........9.\....U.s.=..J.....QE.0Kk.0L.D..I......($D..1....\.:.R3m.....>..{f.....5l.6.G8v..^==....i.t..V.Q&D.#..\.A..K#:.WW~...."2.:L....7...2d..5.@2e.7R...........k......E...Z.5........R.Y.t.q.k..]gp$..:..IK.'.4..xj.....|.v.J..\)..m..Q.......EZ......i,a..9mU\....~.3.........}...:.;.FT-.<[..:._..(a.a?q."f.......D..w.E..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37301
                                        Entropy (8bit):7.994665691204709
                                        Encrypted:true
                                        SSDEEP:768:1CZQcn9DmLi4sC1s+YrlkP1CSWQah307xVUbKQCIgZ:qQcnALKis+YUCJQah07xVU+QR2
                                        MD5:AA77129F0A9CE89D2E9D392D6DD6F5AD
                                        SHA1:E0C3414F6C0FC13BEB4CC17703CBE229CA8E35F4
                                        SHA-256:E874222C18D23CD368DFF3A417B3991F9112D39B41532F9B002EA8B5A9EE711A
                                        SHA-512:5E1E95BEE67BB1FEA0471FED33E254EB3911F58410E2ADCB3AF48E45220D7D614ECDEDE5E10336E4A1D827688255A32E7E9714DFFE042C4B06109F24AAFD650D
                                        Malicious:true
                                        Preview:Ze..e*l..~7....*.ncs....>...YvV."sz.$D=_.{b."..I..Z..'.(......-j.[*.8.M+..l..+4`..h..:.|..x....eJ..^.!.\..4FYP.T7...i..-/....).u".......,z..3.....d).P...l.H.B.y...C...It?n,3...M.!>....Vl....\{.$.P-5..3...{.2..jT.].PW...Tn..U...2+.Qv.......6O.X0<.3...~I[;...^G.{./a{.$...d....$r..].v.,......9...J..H..#f'.)V`X....D...!.o._l.z.5XM@..Y...&..~6..q.%m.........n...2.g..h-"...Q.......0V....8.Z9..il.QLRi..(....`O`j...^.......#...>..'.a...z[7.._..Wb..K..3>..p@.Es.w.D+.9ho..^f..T..*....a.C6..^.6.J9.`I....X.E..d..d*._.....n...N.m..Z....F.u......[..^.G.u..bzgm15..-....l.X#"5i..).e.H^.<...</..q.m.&..o.._.......&`.c..c..mP.4,.-....W.y..$.8P...N.<'.8............8g.z..K.Q.Ap.0...s.....B:P.......w..%.7..?.E..BQ...;...%..62..x.E.u.}7C......%...X-.G..{..~..E..u......F.NE..>.H|.2nj.q.A>.N.....I....5.B~.....J.......sT(..L..`C....b.Me,|#..x.3...fT....f....zi......U.c....R..,'.fT..~......o .Qq1...z#.-Q.AQ...j{y.....%~..G..7..?Q2..%..9Q._.)....].Z..Z.W..:ys.o.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37314
                                        Entropy (8bit):7.995379829609669
                                        Encrypted:true
                                        SSDEEP:768:4wu68dCEY0gM7VYUfAFvTBwH5DHWr4X+Wi/:4wpMCn6Wdm5Wr4X+z
                                        MD5:0EA252C622F1B3D6DD2BDC14D5C6CE68
                                        SHA1:E459549C687CF830F11356903AA3D56D47A56B52
                                        SHA-256:B594540A5E3564083AA1B1CD7C49588D47AEC09D92AC4FAE09C94049201F2743
                                        SHA-512:0E3B83DCB02680B84F10CE0659565E7C2A39E0E00345ECBEA4E9428D0FA64C01ECB81E2674713C9A1785BCFB0DAB71A76778DA5A8A988BA94E443446F66AFA54
                                        Malicious:true
                                        Preview:..Ub..c.....i8u...X.,.z..H..g............U!;3.......[...5....~k.......A.w...;8.T....-d_.>......$.........`w+..{l[~{.>......#.....8.h..E.v`......_..)..f.VA.~...:....2..\...N.uY.J...(.i...CX:.7.;...#m2`F..;=..`..L......T..[.+.I../...;3m..=..3....UR-A.z.......T..bD...B.K..q@..&..9...q....W...f.......s9..<...K...M.7$R.N5.F....R....Ws.Z.cLX;w...}....N..i.f.R....F..x.cv..;.%.9....$...3.P..Re.q....H_ *..1....)!.^c......j.T...r.g...==^kv..D.eKBmF.+..Pw..H.`...a.v..T.@~..Im..mB..9}......$.....%6,!{.:.L,....p.".v".}\.;...[v.q......<..+.I..j..0...0.84..Nk...M..h|.nW..~}j./.wM......~.u..4....5.....o.j.$.s.......;.;0.^.....9.~..H..bG..V.1.-t...............................&.Q_*dO..).. v....._...Z.."%..}.#\b....L.w/..z.LR9...Z...w...J@*.k..E.....Ut.x.{....s..4R/...2..5\...6&.....O.w.......>j...aK.u...>4R`X...f..a..aO..^.h....e..&.....@m......t......g.H..N..u...T...k.Z..).[ij_.Sd,.i..Xmv..n.G.-.....(hZ..i.|W.........M...A&k.....2!5P..`.w.0......D.jgEtY[
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37342
                                        Entropy (8bit):7.996083701966245
                                        Encrypted:true
                                        SSDEEP:768:6vfDiY077bt8H4PU5LTVraCdOYe6huCetT1tRWIbwQ0+NxNj4l:6vfDiY0PbtU5XBDdOr6hu7tHMIb10CN+
                                        MD5:07A11DFC1A8730D51FD4150C73BE7FCD
                                        SHA1:000152E0833268CD6DC7EFD995442BADB2700D42
                                        SHA-256:E3A95B080115BDCFD7DDC457201641186D9C095121D3BDEC7C824270C16008B8
                                        SHA-512:63A8E8AFE1E62FB33DE506A294C5D822CDD543773B6D624C11010B8DD301C91AF984D205D7F96F7EE8CEECC612FADEECC3394D951B7469AB2CE996F992F3F2C6
                                        Malicious:true
                                        Preview:...S^>..)A...f.....&}...^. .b]e..........<.c..s.r.....6..q..qN.....W,.2.!...C..<L..<>.~..c.:}..cK......7:.t....,..~.3..*hE...j.<Lb.s.$..IC..9.Mf7_.L..S.L.1.L.f..p.....Pu!.)>..!....F.X*..%)..x..[;...Kp.==...;....Q.c.3.Wu.oj.."D.l.7.$.......MG...G..z......R..-...~.....`..-1...(..U.....C.G.T..6.r....4..L.b....*...\cD3J........o.k..~kL...sH.....?H.5.....o@<..m..T-...Q8.nr......C".../..V:...Y.d:.PzK.........*sQ.[......D7LAI.V].... ..T.k.u..*3.!6;.I.......+.0....5h.;....n^.......r..b).....o..M)<........$.&6z|..$.<.^..B.....^.'l.v.pp. .[@.E'...)=...sq..YK.D..%........0W..........~....@6.B...,.R......5z....;)|...[....:.....~G.....).....O^q.7U.:r......0i..&.*..&;.7.@b.<.i..\..g.G...C.......S@.s. #.D..+..QM...M ...=H}..z.!h(OH..5..Bo~+PC8..(a=S.8.W....X./>..........9....O.D4x.m9..z=O"4@.a..."......7@.+....v....C~..DX.`f.n.k<;|..ws..>]....2".!.2.....4O......6..g.U<.K....48P.My.....F.<@.w....-@.K....z.....zi.<.}s..........<.9...S....Z...8..s.y,..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37332
                                        Entropy (8bit):7.995067976390015
                                        Encrypted:true
                                        SSDEEP:768:mtktZ2nrW/0r6g1Nn6FDagEs/RYTuf4MgPNahoKmLBwiUY4NORKjMiA:WkenNF1h6FDagE7WeIohuYuORKzA
                                        MD5:AE1E6146691CEEC2296E51C0A0BA4AC9
                                        SHA1:1BBDC9562B0576CD519655465CCFEC032711EDAA
                                        SHA-256:F0639B2BDAEAF5C437357A25DC4883E3CF0735D7B36A57E71C80744C1FBDA701
                                        SHA-512:5A24D88EA6BB625BF55EC3AE82FA1D5D2861459DB8E3BF4F767B890191BE58038DDFF6C5FEF783BC1734A0A54495FCA2B2B38B39415D986D86052CAE19A9E1F1
                                        Malicious:true
                                        Preview:h9.F........B..0.<tY..3O...:O..+%`.g..p.....F.N..?.~~d}...9O3! J.7:PZ-};0.e.Lx.......^.....:2.L.*..)d....)...af.`..l..4...Y&.8.dh.O#...+.jB...`y...'..6..o.w..Y...7.. .{+>{&P.t..A...k..B..G'v..........c...V.c/..jf.q^>.E..o..>P.U."8..q..:...8....@..fh{.. .b.........{(.@./..r.~.s...M..x......f..M/.....,(.l...St.{....D....nj....A..E@..w..;la#.j.>A....Z&.o(.~.m..~..zM..._z....A...M..Y...6.x...a..s....a.Y...E...KM.a...3......+&.Qv....>..;..Q....*9..w......dB...]9.....>...E...@%..V..q.11r^..V.......C+..m.l..NPV.r...P.A.,..l....n.*....c........k$...P.2..r....R...K.<.\...X. ..}iq.:.C#.....m.+...fn./.A..?.{%O....J.V..H.<...u...........W..~}..a...n}MtT...a....H.#[..E*K..%...|k=......~.R......!f.|........OKew(...MgjV.f.M.v.ad.V..c.5A.4..#5.J.[...q .DN4.P..m3.B...{....7-.6...<{....~P.9H..M..F......Z.?nF.Eh.,.n0L".4...~C.N.....t...bE.9...l.B...r......;...j..q...S.cH.B4HB(.....i........ZX. jh?.us....2.0....T..ji~.rK8j...P.....s.h.J9.=.h...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37312
                                        Entropy (8bit):7.995181182882937
                                        Encrypted:true
                                        SSDEEP:768:p9BkzXOqVoUW3EaqDbxTN3uuMtq2EEBTKHcBK9TeLd3m:p9mTLx0uM+EzFpm
                                        MD5:AEFD866479F022F1824AC803DE83063B
                                        SHA1:C01EED2FF928DF13395B5F5C31D28A5742B1F2C3
                                        SHA-256:A0B77F8254CEBCBED53B26E0ECB11E6738E4F87C7DE746FD35D0236B0A903736
                                        SHA-512:E193B38E4D8D09F17AF0241B4FBA174BD6B46A69480916C1DC531F208C721D27A86CCB3F140A5CEB02A9E8ED709627E0CE46207CC9AB69616AF3ED00E8EA6AC3
                                        Malicious:true
                                        Preview:@...j*..c&.b...}..CV....J.4!....yh..O%....b.O....w..D....fv...#..J.P..&.J.).j......R]......x4......t.....M.B.&R._......... %P....N.g...:j..a.L>.(..L.16..Z$...#r..j.q6.....}h.f.5..X.......I..\...U..`.......kY.7x......Z........,+}.]..@..T....5q.......[V;.......]O...e.,$.[.~.....L..c.*D...f|M..*..m^X.H..~.._.".f..bf?_D.O.......l.....6.c.....y...N..$.z.l.....!....*....Z.^@..j/.3.b../.......qJ..i.w.k.$.....I.....R.......j.8#..6...o.b..*.C...j.6i.&L....e...r...1.~W.....I.......Z){X"....kK.../.^..m...w.....e......".o.B.y..+r0g.z9y....@;.2....g.e.>.#l.L..0....V.W.(../..=Z.....E.....}l...VG{..`l;.\.H.T....Q..jn.J..../..s.f.[.I.2..eP.6>..<....1E...(..N0...H".<d...w.r...g...u..g..s....O_-............h.|.y|.z....h....~e.....Eb..UNzm.9.L*V.......''. 3S..?..d....E(.K.'..ww:......#{!>.w?DF.z....K.Ca..%..rz.p.*.....>.....~.. S.>-..-........WS...%...N(_n.)...-.8.....^....h....>...a.\.7M.)...yx.d..xk....pi...(...{<c.u.E|....VH.E.`.....x.U"..VC......L. ...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37318
                                        Entropy (8bit):7.994362365350443
                                        Encrypted:true
                                        SSDEEP:768:h8roEgSDcNzhsblA2Fj99ZSRa3Qb+l0lh1v6bcWYKGiL9:aro7qcNzhsblAUPZSEAv5v6bcIGS9
                                        MD5:A8D0320FF64A43938BD00A8D94F23BF5
                                        SHA1:64954267E7E29F10EF6DB0A6F61CB272EA66AB0F
                                        SHA-256:65D20437ED7B545A56CB0B194A5F0C6A894B79BA5291630EDFC4748061832A10
                                        SHA-512:8396D1991B6BF493C0DADE7DB04BA77D0C1475A98C62367A2D770482A25BF0981A3E76EF4B0EA480679DC305E2DA53A37BA201F95325346152847CF0DA0B8D55
                                        Malicious:true
                                        Preview:..Gw5&...~T.-....i...E..%.....t-.;D..|.$..O.y..M.....Bj..G..7.Jp$..3E..:.4.....2....S.+L.L.dS../.....[..6.E.o.M.`hc......b..4l......T...D.........k..=C...6.c.=...$..).de.....K.....zG(Hh._.7!.]R.....v...B...G........1.7..L.+...=..5..o.Mj.$...Ms.......V.T..p.....z`..]P...8.~........KC..P.u.A;.[.~gl........O..~.G\.gi.Cn.|p.6.....".mq...\l./...u4K.-F...!......1o..,...J.r %.!.N86.u....G(..(..w.;.....d..9.Xa.7{(.C.....8..Bd....q/.B.p....=.R.|..%.j.Bp$.'.)....<P..X!...B....n3....m..1....V......g:h9.0|.Ar.........A..;r).t...,#.......:.O....v....[..C...y.)5g)v....$....X|....*......)6!..].-......(.....G.....*..M3...Q#.IdV;N...y.../F...@..q=...Q...1~.+Y..@...S4.uI..?&.I.....x=.e.jII..../:.<QsZ.d]I.W)P.It..UK....%....|t...N...^^..%P"...O..........mE.pG....4.mP8........u.^p.M.o..mmS.vB{.,.M.9..;9F.o..g^.1R..0Q.....by....9.'."...=6ZIp...oD:@..q/.....)....w.....A..J..zP.>Y[ .Se......]...5M.. .....'EY...<y..i..1i%Z3...bK.y.q...ibc...}....`H..De
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37311
                                        Entropy (8bit):7.995425166595228
                                        Encrypted:true
                                        SSDEEP:768:7vJ77oi5ZuPH/89iA4mscAN0mwbP9klGPDVATR+cW9hJaemU/w7J5:7vR7F5QPVXqP9klID2TE7/XIl5
                                        MD5:30CE32CAC1A0AC3AC6C362D8B256F8C1
                                        SHA1:F63E33E2A117D2D611FEA3199A0745EA2B07A4FD
                                        SHA-256:7D815ABD88F8C4DDAC1822F720F7253E2AF4F88812690638A177B8DDD7AA285D
                                        SHA-512:AB567D4F0A1C3E48783FF4556BBAFF1FA50D334B8A4C31C9FA80355F0D3FC63195C0DDEB0A902602FC610709FE7B71D01DBD711C39F498D66007281E1DE2FCDA
                                        Malicious:true
                                        Preview:..3.K...~.N{}!....|.E....s:.;...*..O..M.2.(.(!x..H.1.7...4.vki.vJ...j|....v`.@{...:.hT.NF..zi..#K.9.%<...b.._...Ia.....(.F.fk.........F%.(-.)..e.WV....%.'..V.f.:.Y.@^...Lq....K.M..Do...v...O..R...i..../.j.....$..=.....l..L`k..|..q*.!.126..b..........,..P.D.1=.}d...8.0.0....D0.9....[..@zZ.*..]...?...'.c..C .(c......z+....lwH....'.h..5. ...O..%>.|5.(....{.[%...jF..H2z....})hq.\.n.9..\N.9.S....^..ZBL.._...v...^P.*...\.=..(..`.V#.Aq....yGr.]...E.;..:z.&....].i).X.Q.t..#....{U..<..h..f?..J.U.a_..g.'D.Ue..R.....{.V.[.BL3u.kcn.c*.mL.!..].$......q..1.oa.....gN.k..^&9..p......<.g.$...:.%E...Fv.....6........`u.......].A#..}b.tZ$.^".,."....#..g...D......[zG?.9..[.5B%..;_.4....l..Q..../.0.....9.._Y'-.....D..N..+.\.w.S/#...q...'.?...Y..=-..B*...>....`.2F..6.;.[...oG.P_....I......gR....m[.7.C...DD.q%.A......*~.W=L.'...)E...D.?I..|c0..Lo..}..!.W.X..e.V....~..E..e-k.*..P>.....0R..@.bE.....7?b^R......s..0fDQ...;...A....)#..s.+:.....y8.J...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37316
                                        Entropy (8bit):7.995450791385972
                                        Encrypted:true
                                        SSDEEP:768:zXLp024b/s1YgebU5k0kQadtaIGpWMQwi5sJm1TriLGhr2c/:0bo5oQar2ri5xTriad2c/
                                        MD5:F08191BAD3B5CB34A312C91F8C7FE729
                                        SHA1:3280661C96F1CBA90E45195CF3433873B8E7A5C4
                                        SHA-256:E1F0C6823750BA2132664F05E3A0BC7E62869721FC6698B80B014D86DD23D961
                                        SHA-512:8C7073DFF96F54E96C8F0AD35580BB27FC15DCF03E9C8BA48FB268579B7799B1A8FCF7E80ABE9BE0482D070CA64F7B818B43ADA6400FDB69C123B01B768AEC93
                                        Malicious:true
                                        Preview:..\l*.a^.1.W.YAO. ....Y..H....../.....+...gB.v...'.R.5.g.<...X.....e..$>..K.y.W:.......q...J..W..j=a.0.U..SMZ.&.rC.n...../..1..Z...9.....{.(C..bt.s:.<n.;]..W.6.a.f...m.1T']{....T....2pso.UD..!..bDr...=Q8.sG..W..a.. .|5..."...o..7*k.o.L......f..T...g..mK.j{f-...#."....@.y`U..?..#.;t..g.....+|.pK...n.U.C:..K.....#...}}...un..5..!..!)...,_..}.Rr.&.....6...........{@M:.]h@...M....b......_.}.I]......q.'1..j.y.Z|@m.GT[.vp...Liv69.D,..J'mE....BR.(M.\.s..#F..7G.`?.I..0. x.....1~...1~.f]<.......S..&.qMh...#c!...h*.P...I....~cn..!5..c......R./...4/^..~."P.....O;1....!;y.=[x..........oUr...l.E.&....o......."_-5h......LXD4.{%].>.6..k3....)...!i......}.........0%..0.........}U.v.F.......^.A...p..Yj.....Si.$.Z_..Xx.b1..?...e.;....r.V...P..C.o....Y...jUX..(.^Z.......y....F.,H'S(XD.}I$C...,Q..W.7W.G.h.V7 ....A2!Q.....R.\.<...."A.-!.(.;...Z&..e..c.....{.a..y.:.....G...&e...a(.."B...F..E.....i.j.t0..I...,ME.8..d..E:.L.$..>os`S....l..U..p7C...n7X...f....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37324
                                        Entropy (8bit):7.9951936022550605
                                        Encrypted:true
                                        SSDEEP:768:AIxyeO+CoH1qerRv2/KE8YU46BxBxyyJvjsGiEtkadaLl6+:7xtOAVfpEvqJpJrsG1jdkl6+
                                        MD5:2693F32C1AB66F8C6B1D847FB8C3F377
                                        SHA1:9EFB3530D390EF780F26BB0BBAE118C973EF5CE4
                                        SHA-256:847C0366198C1F9DF4A1FB5D1E5C7F374E4BAD6D53C7E57D8AD46DA4C91AFBDA
                                        SHA-512:E08BDD5AD7DF123029EDCDC31C96D979DD3FE3E5A864A594A14BA04E66072E7152AC54D47012CC8D8E53939A0DD9F05713B57AA5BCDCBDBE80DC52CE9BD999F6
                                        Malicious:true
                                        Preview:.....y....2NM.F_..8Kw.?.Q.&..2c.V.>.m#..8M.&.....Y.........h=XK.P...AaQ.... [q...nRH...3U......;........0..w.cr...e..H.8B....o.W.-)..P...Q.....(.yJ3..=..oN.........o....T.Z.0..>...0(.C.)h+.@t..p.=..r<R.kC`H..'v.j..).G.\.a.c..M..^..g..o...t.5.....;...Oe.]Y.|A.....].PZ..Q#~".Y$P.1...?wN....C....}.k[....|...&.!+@.Xc.$.!..g..g...'.u.x..=R`._...d.W..J..aiw1.a.vpb.....R0!....$.5..=...m{.. ..../..J..)Q(L&1..b...R~%.L.G............v.W:OKb.wS,......:...Q....@..m.-^y[....h.d......8...t.3...KS.v.&4.....k..t..;.......#.....[.Gyo.....r.;*.Oa..oo.:...y[X;..-Np.U...0..............I...%.PN.s..5x..F.S...>.m..J......4....k........,w...."0..^. ..o...[^s{.g......!N.n.z.q....R..$.E.).U5..t..-.L./Te.r9......7+H.H.L..*.4..".."l.....0;R..#..s....N..c_'z./...c..LK......(............ .D.d5......0...O...3.T..?...d:.G.m.......6.iZ..Y.#.2T.....e..3_....'..].Z.....p$c......a....8.d.[.T.x........7....W...q`X....S.....<..h..oT".q..u...PUzq...wDQ....<u.....:........l.p
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37305
                                        Entropy (8bit):7.995416029868566
                                        Encrypted:true
                                        SSDEEP:768:WG8Wh3M9M5W8z/jt/QB33WMnV+idFSj5TkF2lzDur:R8WVcAh1mDpw5wF2lDur
                                        MD5:94FB54913F8FC885D2F31DD759E52724
                                        SHA1:78DEF5580EC2DEB81E06A826DD97CDCCAE867FD4
                                        SHA-256:4FE67E36AD42B60EECEC5AB29B2FD7147B4ECAC6E95253B437B58FE2162DDFED
                                        SHA-512:F346FA3F3D4AE1435BF4305C547CC46398F0B544218488515278DABD0136D2B526CA79732949203FF4F9F5A018F963970D13F0384ADB56A5F62C4297E45F9369
                                        Malicious:true
                                        Preview:6..,.T...aUcW....I.[....*..O....G.:A....c2V.j.......tf....9..(....6..T.Cq....|...4/.....;B.y.U`...YaL...pq.4..;j+a....o':H.p^.'..g.[.....A....].8..=k....T{.0l....W..........t7c.....%.t.....C....Tn......$.`.a.5..O.d............D......./).O.O.I..j.q..?...Wv.k..y.>.t....R8b...hc.._z.W..{_S..nP...>...d.).]M......^9x.b.rq....!.?..n..8j..G...j......8.Ag8.......2U....M..w..8u.R.~...]...8<X^..k...7.0.."U].j..._.!.9.aQ,.....9.......7H?Rn.HY|..S.H.x.....a...0....~.......a...'...F.wp...Y..Db...r....Fd.(.......4..2..[..X.[.K.........?...w....Q.].J...H\.E...\.>.71.A...Mf.JA...-...]... .=5.TO..Q/f..B&,d.vJ.I0..PH3.%.~kp..\..G... .C....8.KX.#...Z..wI..vQ...]|....2_h ..x.>.x0....l.B..'.................4.....FT'...jQ."."....=b~{.%T...4..+8....Q....]c,.....e._..$..Lo.j....w^j.,...2....3..|.56...M..B..5d.....l.B._j~.)6.Po..Wj|..{...[..#.Jql..|..jRZ(.. S>$..x.. >...J&.........B.@Xr.z.......hw..E..b....g...8r\...86a.U+......I5.Gt..k..(.T....C4......D....Yc.._+..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37310
                                        Entropy (8bit):7.994910209128803
                                        Encrypted:true
                                        SSDEEP:768:GYPZij4jNTc4g4htAMlEUcFhdgyO50aWMljp5dCaDm1zLcF8Vvji:TR2uNTcxMGvHdgyO/fr5rAvji
                                        MD5:D5F39EB9DF785FB2A9BC6579B745F7A3
                                        SHA1:EB17D3FDD038A28A7061FCF482E2D2389B00D9AF
                                        SHA-256:30902723E3FAE080B567F5BEA6C0B1C08FF43FF2AB2F7B351130E1E02CB7C746
                                        SHA-512:6E0BF6A9439B7CE045CD36995611C3CAB2D7DFFD30883B9614D6AA7EB57F3F601A2D20FA9459B5211D9DD3E9930BE7AF1CBDF7EDFD6590E37DD13D5051FEF03D
                                        Malicious:true
                                        Preview:_J/......q.r.xF...2..E...2....r.!wW.)Fi.?v...c...g.e.0.l...~..G..,gK.z+..........E?....}r.. |...NM.Y+^M.?Q&.H..0{.........<...NY.....S..m..|..n.P}.....k.>.../..>c.....]p.................0..,...a....U....Z._.P..T..(........_...T..:..f..._..).B._.....K.F.....N....#.A..x..#.lKW.,;.;...c@.........v.....D..TfR:..\..t.2.1O.a5.V/Y...t..\..?.{U5'...Qa..I.....L.IcAF...T\U..UEJP..@.!.$.{\..KhYS %s.?$D...&x..ma....-...-.8@..{.)C=.....X{..P..d...5.y...m39..\Q@..,EUf.N..}.f..L.gZ./.$7.E]G....3g..........M.7.p..e/.r?{/4.:..JT4~...i.a.y_..&.MU. X...i/...>%$..>..dK........[&w.._f..]0j.J..5.)<5.....O........\.. ..Z....;....xz&.=I-..5c.....L....].....q0..F...6T...{...'.V.`.vCP.L...uP....._.=..po.d}#.Zt..n.w.L%...(..s..*..mC.....l..%...Z..|..$e..k.\.Y."OL.V...k.(h.(pm.......hK.P.m1.z..P3....W....\:L?..E(%........HAZ4.YN.Dy..0y.....*.Q..z.Ex..N....0..@..Y5~[B...xw.`Zm..P).T.....,4.p..C_......)..`.H`....q.fb.D.>.......'....f.....W'....gv."6......(4..d...Y.N
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37309
                                        Entropy (8bit):7.995222706524047
                                        Encrypted:true
                                        SSDEEP:768:yiRSFe6qD9g3iynjea2SMeXAqQqbnDogqRxnQIkPdkkDroGgvet:yiRSFez4iynjeeP3Qg8xQIkPhDM3Gt
                                        MD5:F516D751637513F5597934EDFFFD41AE
                                        SHA1:738D8431D83865CB1F780D04D22A99EA0302CADE
                                        SHA-256:8AEA71D1F6C0EB1F948074AF750BD0A020E12139371CED9FDA6A247C52252E38
                                        SHA-512:CC70A3116798916DCECDCE8F63B44842E7A8CA6CD53A32C345DEEB70742CE56FB47EEF7C3BFAEAA7A0C86BCC7CC35CA91B71395302883F935C2F4B4D4AE85779
                                        Malicious:true
                                        Preview:.q:..4.n....Cu|..K.i....&..~..[.H...2.d=..T..<..T..j......s.KL....l.4;..V.....2..%.*.....T%......-.m.../$e+.4...v..[..'...%...|......./K..n.........^...XY[..s.,U@x.....MRV..M..8.5E .<n.k...f...,@...S!...$p4/.~./.K9t..L....4....=s<.G..H.D..f[S....5T8...K...T..w...i.X....R.\...@._f....K/a..Y.oi....6h.{.'...s...(......H.(S7.bRIF../.....B+LH......cg.ZF6,{...i8.C.C.`.".LJ.Kb'....0.>Y....c.....V.o..u..6:....b.e<5).3...*`%6..r.\J.b.9.oD..].....^..........)...e.Vbm...AEX...GOG...?z..c.L0.....K.zD.H.7.:F|hh...:..........[.P+.HVR.../.I$w.%.r...zJt.E.#...6.m..]..T.X.Uym...A.Y5.]...U;<...-..:.'.$.D..I..Q..-.3..."...W.t..w%9.JJ....1.^.D>.Itl........J...k..J...V..K>YN..o........1.'W..$.D........$R...r.A(.,Vv._M.K.l..h.Z....EO.. ...B.....*......qU.>d.z \.... M9.V1./..F......O....=^....y..Q.lS.7.x..)R.f#'|.|.2.._...2c...V..N.b....|X.YD..v.|Z..-.........%..c7...zL........-.t.|.3k........./.0d.k.z."yj.....+.y. )Z.......m..._....$C.vl.....^.E
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37307
                                        Entropy (8bit):7.9956194141287815
                                        Encrypted:true
                                        SSDEEP:768:qxEGO4BGH/Wy/eipUkV8VLWgzyJtob3recVVzlSOv2pJQpP:qxTOzMi+xhpWJtcrHVTv2fQpP
                                        MD5:FD275185E2EEEFA4C1353741F02AF314
                                        SHA1:F1D7C30FCE02960C24B2433875648961F7DE7EC7
                                        SHA-256:F4CAB3747B324D6E926154E74E56665B0B896C1C316DA4EFE9CA55A9D1C6CE7F
                                        SHA-512:6CA2D50F255C8A3C26A7142E4CFB36FC9281FC239A47A35D8B25F5DDA783E31C0E6560362AD2B1B59F40B524756AF1A6281420433B2CA743C78383F451A2C82B
                                        Malicious:true
                                        Preview:8?[r..]..&U%3..+i.M....D..t.....*.T......_)......n.?p.B.u.~.....'.....s...>........np.(.....S...0....[\.e9A_.o....|o..@ 3M3)D7.<..a....J>(...mN.LI3...~.......'...PX..&b@D.....`..>....\...(.......HH.!F6JX30.@L./.$....7....o./.j. ..g.J..._..D.....m.R.&......Z.D......r4.U.....MQ.@]n.~7K....3.$....q..g..O.'.S..^..(H9=......7@.Q&.......D`.5.0....4..<...P...+.@+U..).....'.P...2.S.[..X."...fP}....wu..o.B.dR...w.D...{.w.....%.fn..M..5.3.*O\+K..'#.T.g.px....>.1..>,.l.....|4.>-.&=..PR..>.6..I..Mp..U.8..I\Yj].!?.N....f..\.a.?...7.~.7.....w.,..8q~...d..B...K(.rgn.\.r...w6....*-.X...........?....:W...c....5.Js26.>..B2.7Zg...wYL.;Oz.*..T..p........[H ..t.P..F)z.j.."..R..!...wL.nx!.I......v....5'\....3v].]..Si)...[...d....U.r...b.I.L.I.iG....#..'{l[..L..p.j....9.....OGb.PYU$,CNq{..i!@.......#j..L.y.X.v.R...oG.4...._...+.L..s.....n.2sb.:o).,......zI..AO..n.ExA....?....D.QI..`E.....8...)..H\!.#@..|.....f...r.Z..D...........fwV.......Y..9.l....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37315
                                        Entropy (8bit):7.99496982449358
                                        Encrypted:true
                                        SSDEEP:768:O1ZlvbA//2bLJHLxFoEUvPB5nqc/suQdFGu4G0Y9NCJ033NjwqVE:OFM/ubRcdfnV0uQdT4uP6e3NjwiE
                                        MD5:E89A62CF261303D0CB56CE96C2A58D42
                                        SHA1:A4E7C32B42E51310B8B9FFCB78CF882F332BDBC6
                                        SHA-256:6EA034B64FF49F93FAB843A29284DE51E6BF6DCEA5ADF430085AB029C0187E10
                                        SHA-512:CA0108D7E14CEBFD243109F31BE40696E01DAA084FCEFE653FE596207DE7AB7F55C267DD41EA8CCA1D63DDD71151D81BA08DE432F1E739B3775F22372215C358
                                        Malicious:true
                                        Preview:D.|@....v6.+T..=.....`KL...x..Y...........#..G7Dp*...,M.OI..UES...GF..AJ...0.K..m{.Up..K.`.E..jC9F.iP.P/.....:cW...-._....A.P/.!....o...U.R.V.z.%.....N..,...L...pZ....+.R..NK.2@.I...skE,..}>zv......=.........$.lh.aXjj...)3..j.V../U.A..t...).7K......A.0.fk[.t.1X.mn$.u.)...........F..m.i|...8.?..*...IRpF. }...se4t...`.P.,.........9.d...G....t......c..pS...C..#A.k_...=.n.>.....{#!.-m.z.....Yp..w{..=0....}H=>1`.P.\(.....M.B...^)L.#...v=J.....T."..b..b.......HD.........R...H@.U..}.:....4.GZ+rp.@.W<........R.e..Y.ke....v..d.....S.g..J....d0...g..x....N..DPz.2.e.i6...._5|)...e.Q...f.....5....,...''.n+.D..^5...?...A...'.-...^......Z.....s.\.l.....Dm.2..3.....4n\......~.....kKC.l.w.Y."....6.@.e.a.^. ......n....\.%.&.kjt7...`.0._...X.I..AM=.~6.{..o?._/B.8..a.t...5.....y..L..h.....%.u.f...A.O.o....3.k...BD-_.....\.{.<.._.o..Vj+..v..~..{dDhX....\..lz..Cq.[Q2.ir...&t.s./zn.M%....1..)l.L/(3h...Q.O%....TX[.#=Z.U..l..DT....</.<.A..i.....~I..|. !*!
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37309
                                        Entropy (8bit):7.995362242324382
                                        Encrypted:true
                                        SSDEEP:768:H2KH+hDzaFb6UAGYkCxyxGhl00CykbYnUK9vdByEyyrCI8e91SBhWjr0Le:5gzaFLA7k6i8EvK91Qyj9G2Ae
                                        MD5:0E42D18067C1420169874CB2A451007E
                                        SHA1:77A88A6C2FD8A6C54BE1854B6676003C18DF2079
                                        SHA-256:B309C1B3FB59AAA8DB3137755C0DD74E1881F64FBDFAC3D47361605C7047021A
                                        SHA-512:2B0AF0539EE49EA5D23FAB43E3330C2DF263D6E2298A8F655E51B3D45DC75FC8DF8DCC90E65B3AA4AB1BD5D13BA3853D30C5E52A2E40AB35E6C77044B0EE8F7C
                                        Malicious:true
                                        Preview:j..9<h.[..-.o......n.5...N8c.oA+U+..n..c.. .N0;%......:.u.|.k%j...L...1m%...1....P8Ex|.F2.2..(.)....y...t-........ .....D.9k.@.>._....."....*Q:.. ..b...f-$;........\...D.(Y!e..].dE..._.....cb>D...m...g.K".3u}..M.ro....".A...iv.;I+.....f]..A8......[.>*.z..D...y.)..;.......4c$e}..)..y.g..N..|t.?ju.q..Km.i.4..K'...W...+..8\}.e=....n....Fc1@.1...a.]F.._.u..x.....x.]..]p.n7...zp..u@cZ.i.......NA.w..pZ5...8..\....m..`... ...E.jL.&.F.}.......RLV..U.......<.Z*...1....f...k2...#..q$..BTP..OF#.O.%+0YQ..4.FL.... ....TR...u..n.s..........O:.Z.1...,...7.Y.sIo..'!n...d..V..C.....{..X.s4dh.;..b..<..K`B...&.,"..Z...t....Ws0^.zK.l.b...4=...^ .l...-...)@......Cn..hZ...3..W...u.U...B...g.S.2|'1.kU8..........cy.{......Q%.....@..7F.,8..w....F..L=.Y.4n..C..7.+%$.p.......M.D...Zq.tH....su.g...p.......;..<d^...5...?\ft..(..6.0...'..R}..h..L&i....-....j`Q6|..D}Ok....o..U=....A..V.Yu>...@..f...n....<P.:'.lF.4Q..[.....2.c.J..W@..O...gqm.{ip..#.&.w..A.T...8.k{m...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37314
                                        Entropy (8bit):7.994543455870677
                                        Encrypted:true
                                        SSDEEP:768:Rr4oeTAyeDGrQr+E0lbwOFotVHSik7XrxHT44G166p1WDy6:Rr7CAP+9BwOOVHyX1Fwcy6
                                        MD5:DDAE05B28D8CCB675517D3754431D10E
                                        SHA1:8ACC6CCAB491812648F833E83F6807E650A65FBC
                                        SHA-256:A796C5D4180A047E47989084AFF1610BD9C863B076CE9E73CADB45CF51AD1371
                                        SHA-512:0E329953B5F00E9FD9D2CE681662892D887F6D2032E83DDE91B7908EE448D5C5ADBF9E49EEE932FAAF3637EA2A43493B2A95900964145D61345844A1D29DF014
                                        Malicious:true
                                        Preview:.... ../.&.5N?.OP..).. ].<v].......\....>......LD..`86.|t...C=.....Q...'...%.rJ.. .u.....-d4..E.&+......(....I6=..E..vjX.9.......;......pjMc...J..&.%"P....]i..`.`]..9...R..}..x....)...._.....Dd.Q. IZm.p..Fn....Z.w.,..PuE;N.6[b.P.... .8W../?^..\..8...D.~...;....^.1G/c....YZ.`O.EP.K3=..G.....&..@.P.r3.d....,..9...^.Ko......ZM.R...-90.?4..C.Z...s'./z...kv...8...5.li........e...*.n.....z...QT..w.._.&......).../...x.0.R......n.a..x.HP.\..D../8.". ........p.-..|..'.ZKM.j.'..."..u...O.M.....9.....j;.PK....}`+B.0;O&C....L4.q"....dZ..|_.8..U..^hT0|.B.........z..........~wb@..W...3.p.u..t.X....).Q.X.s...Sb.}.....K..&..So.uay............w....$.o4....q:......DU...9._.\X..hp....C......&L@.=9...u?2.1~B.>d8.C.?(....|I......_f.....{z....}8....3*T......#.2..........N.^bA.f{3.F....3...`x.T.*_F;._..rz .0..S.=|{T.>.G...&...x.^.nC.9H.o`...PU,.}.H2.6..p.".....F..HG.<_d!.^[|=:.DgQ..M.2u..C..q.eN....a.[.t.y..O0.J....J}-..s.B'..x...Y..n........7.z..o.`%.aY.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37326
                                        Entropy (8bit):7.994198714706511
                                        Encrypted:true
                                        SSDEEP:768:xjyCr6AU4DGGTDv0lsvQ1SkiSnbVkF98wtDWDbzZfKAcV8tpfrf:N5PLTIyvQgki8bV49R0bzsobTf
                                        MD5:B4D3401F4FEC2AFA200F1D6CBBB9989C
                                        SHA1:E40A454B7932818E1B44F20CBDFB271B26273866
                                        SHA-256:5C36BA2FD49224FF3AC6F6E4A78966293145F4E624932736292CFB0D4F98E3EF
                                        SHA-512:114E477ABDA917BD9B6A89B7C313B45F919FC6B047EB859583C871C0C4271781C43DE6DB458EF206C798846569895948DA00B27C86A534101E857ACAEA50B47E
                                        Malicious:true
                                        Preview:..r..`!=....MO.>I......n.|.gx,../.m=|.X.X_.0.f.}.?SK[."X.V{...<...a.K..1.).W...$F...`......[5.du4.{.G.yqyR.[Hs}....E.A?.UO.7...;.=...w........E.ZD.}..k.$X....R_.K9.y...1a.t....Oj..........468;.{...\.|.......3S/..3.p....4.I....D<.=g.c5w..c..b*F.d.j.x.e0..]..QhG.>...@\W,....3k.3.Cm...T.wZ.;.&Sf.`...V..o.Q..g.....k.A6|J...+st9.xs......K4...V../.U^.."..3....S.}vu...Q...[i..n3......=.V...pg.L5...}.....2.`H..(s.,..@@..q.....K....u!?.F..O.*o$o..J.&.M>O#....h..Z.`=....%N....c...d..hj...U...o.g.!.k.>...+S..{@.r...%#(.^.......;..L...#p.|.....jG..;...D...!e.....Q)..(,..<N.w.>i..).&V,1.....q...e.s.`..D.-..q......R....8]....a|.y....O..........>.......6*........<]...Z........M2vDi.j....d}.#<......k..[O.?..%*..I1..D.).....[DK+.....w.....$G...o.....=..Zoa/_fX.*.,.+.....9...!nC........u.&5..r..v.[<...l.{a..2...S|......:O...!.q:=.}bj}....F..O.......F+.......w_l....p....'.?........1t=[.Fl..(k`.....a.".h..>.=.....*s.Y.n......i...Qw....1.!..H.]...ogp...T1.`
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37336
                                        Entropy (8bit):7.995052148882304
                                        Encrypted:true
                                        SSDEEP:768:hE7/ItMHDlvw1zS7INVIAAMm+5A4suT/GvXvPMByIWtI5gw2FaVzw:iaM5vKmUjIN+5A/yGXkBi6nU
                                        MD5:B0551F7593E2F43EA6C6E6AE6F72D6BA
                                        SHA1:7848D7A5BF30E419E1EE7C1DFF3EBC281ADE747C
                                        SHA-256:F7C761CA0876A0A881763C750BC97815DED766F38FC08AA18B86845C8AB46A6A
                                        SHA-512:A1E0D5D09C7286B75C7AE7213DADDE09AC47D5B704887E4FE687CC62E7546DA82606EAAB5F824253A9A8E39E70554107D3BD19E324BE6AE90A74DB726E705BF8
                                        Malicious:true
                                        Preview:&...K..c..(..M.i...<.(.7.#......{.$.?.I../H.qy.u..d.z.........6.WrI)..1.lqF.;.,Z8..k.s....6.m.IX.b\..;k..h......Am..."s.z 7.._...!...y..-.F#.$..A./.a..y....i..L.E..uI..9.k...%|*......6.L.k...y+..Q l.x.m.8.H.M....I&2=......cZ.2'i..!..#m.y.fE......0.a.. ..|7.?.%.!../~C6..Ks.CC..2.)..m> .....[.@..;,n...g-..Q..F.3......K.c.7...3s/.|.....(..}+.0....l..Z...'.a.8.)...G~...fN..xB......@....{.C....W%...G.x.?m..N...v.m...$...}_#I..>+......iP..e.jG.......;.P.|3.{*.....hx....7#..Fn..k......F.......4..bt$...z...}....J1a......&X+..v.B[ |.S.....F.Gv..~0...^...{.OKcG.8.8e.....m..n&...%.`u.P.l67p.\.Y...{..b.".0.jc.....%.d.)}s.e..W.(.\.*/wF....`.@K.....!ez.5.6.2.j*.....P../.p-...k..ZYif.A:..n.......PF.5..(.u;........8...T...1....Pm4.....j!,g3.....[.d.L.................N.:...~.O...,}m.E.C=$....0;..En......O|n 2.W.|~.A..J.6l..q_.;/.v.rv..]@.608.oZ. ..|:.G...#..i.A.\.....b{`....kC.;....LX&?.j...47...s.uI..lkC;0.VAR.J.s....\J.p.".M.-AA.A*.....!.cQ@...x.1V
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37334
                                        Entropy (8bit):7.994310017881952
                                        Encrypted:true
                                        SSDEEP:768:9Mu8SafefOdysNcFHYiiajxD6qf72B70Cr3XaogS/tvy6F:9MuOfefANCHjx68iBfqohA6F
                                        MD5:ABC045E756AA01D47F5F588165A3A701
                                        SHA1:418CED072E47C11E7C58E8A144225BC6066D6A15
                                        SHA-256:D64316D235D44A70038F199F07945915E37E6B37B9CA1BE8A4BD9B0545B0453B
                                        SHA-512:86CE2F1F12687232A367190383408F1EC8A554968E5DB28719B6BD8212EC4F65070E5CA0FC8CA3FAA6C1D91EF493F9496287232C147DDF27FCF3EEF3F165180E
                                        Malicious:true
                                        Preview:ZN....S..i..o.....w.!8n....@.<...xzGF"^.......5N,$H"i.F...S.6.!.`...9.6.#_&.uQ#..k.R..1J....-.%..f._E:..(.....n...J...|..{.K.w.N.. .][FW...;.-..GSb.....66S.A.....X..v.c0V.....M.u7 ..Nj.L.L....E.,....3sf3..I._v.OO.s[.....g.x.W7....Na...|..3..z$.._b.b.d.....:".J7..N,...9].c.?......Xf".uig..1M....c.......00_I.:...Y.f...a.M.{..A...{......."..@..18.x............3.".Me;..A.[.{....7...[...n..OP_=..&......o._.2h7....l....w..9x.......D..;P..eqV..hF...{.r.4.H.0...L..m.......*>e....:.Q...DK6...Q.B).......Z)A.+..S...%.....E..$S...r..0.p.K .....I-..Tm.-*...0.jf5.....s..d.-.+(...>..^Q....-......JZ..8B`........u...k...}%A....:..O........e...._v.)/..I.k8=$.F..'..0.v.~-e.3Q.FFw.zp..vW......p...d...a.=f=9=ew....c..mFu..0.=......S..4....R%."..w...#q...U..)..S..b-/..q]....[.i..X..,.34...#~....ca...H....w.O3..r....,.../.x..$.a.4..eS0.v.wf.0.;......$x.X.]..d..$y..&..t..w.*)..oW.s...c....l8S.....ZR.D8.^..M..@V.[......Ks...q.).k.y.K.......S.+M.F#......k.....C.H.a(/.c.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37309
                                        Entropy (8bit):7.995204078432762
                                        Encrypted:true
                                        SSDEEP:768:l5lgNOWcHpRYtTP1LsPOZOhALkaj8isQnnoao9jEQP8BfqFbCsl6ab:jUgpyTPu2ZLkaIHeZQ0BSsslf
                                        MD5:305FA0F44D45AE920C26489D11594249
                                        SHA1:82DC9381CBF1E094807F616FE955A24F0065EE36
                                        SHA-256:9C66DB914A4A25D2E6CC0062AA954BED6AA692ED0012253181E7E643B207AEF8
                                        SHA-512:0B65DA899248E6E8EFC73E9E8C31FC4C91D3782301D418DF2BC97B435846B4E95C9653EBC0514A94E369062E4CBB8901C1D0DE78FA306064A97C55B56808D36C
                                        Malicious:true
                                        Preview:.(qr..Cb.S.e..j.c..V...}.E..)|G5p.x4.....X.oc..+........I..y|.3.....T.....<.ZIOtH.;&5t....j.A....*x..*.$9o<...h.n...w.....`...W..`.h..-1.....wo....G*.WQ9..z...K+...X*.|C......G..........8.<....U....n...%.6...r...sf9`....u. ..[..x......a.....A..1&.W......e.br.b).W..f........j..I...q|e.....SE....$..06p..$VA.m..`vU@....Q.I.U..%..c....[%.!.....J...=&...k...I...|..7....T3.>e.O......@h. .G...X.>....&7T.`1q...W.%.#.h(.L..c.}.Q.<.G..>.X...: i.W.=.@.@...(..M.+....o.%.$.'.......p.......t.(.).!.K.U.....!.E..AMl.....%].7:%st}....]...sO....j4Q.I.l..A<.^..g.W_|=...).w.P..[.....>`...o.O[DN.~...Z.p.?..c.....:.....$.h..........<.A6.*...\qr...@.!.d$VH.<#2.g..........2L........]g....[.{.....Y........,%^...a..-.QV.?Jn.a\ub...3p..p.y..b?.|s(........7uO..u..+...!\{...Uh.7....@x.`.....m[...8..@Bn...J_Dr.......E....]...$.ME/.._...*.....C.C...o......6u...A.A...u.~...XB. ...r......?G.?..Hn.B.|...xh.-.w.SD.{..5M....5~w.*t."I..[D...zHgGy.Y.2.."=........W+,.B.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):37306
                                        Entropy (8bit):7.995034284134744
                                        Encrypted:true
                                        SSDEEP:768:4EgEsyTyY01L4qAhxbW8jIcyIHXfDeIs2F58StOT0dmeP:uhyTd01t4Z/Ca5/cTqn
                                        MD5:7738045C81458994A16B206F0BF58B7B
                                        SHA1:CF51F8618A70101D9DE051ADD49E59310A181E27
                                        SHA-256:158DD7EF8BB34715C6605E3B0D197FF0AA278228320A577F11FC6A42B8740A55
                                        SHA-512:34857A729CF1C9A1C0A96EF706BEE8B354ACCE1204A1D6E125FBA50EBAE34423280D7D5AAE07E15F9E9B3A4DD404BF4BEE83D4124C352AA8C92F977869447F53
                                        Malicious:true
                                        Preview:..U...%.U....G3=AD..5.......&.3X....X.D'".R?......V...i.....x.^s...........iyA..}......ZxD...8&..CtF".95...e.....L.:.....v.D.%...$.C..E.dY.U....b.....C;.....^.\.....+.....o...K. ..wo.v./.t...Bh.i..q.@R....V..}$. [......\..K.E.&...iD.s.r...Ak...........|..G:_...~AN.....?.e.....%.-.s.:....x.;I...f..JJ....a*.....i......IY.e..P#G].D#..6O....X.......[...j.9....'1.*.B4.%..{..8....v.su.)..5..-.YII]].G..j......p.SLJ..k..S..+j:.....V..N0...E.PGF._.f...i.....:.&.*...L,%j..........~...qd_6..I..B....=._.W@...$C2.;......T...Y....R...=j4.C&;..4<...r..1.2...Z.d....9IX..rZ?.....R...W....@...#...k...e...m(...p;..l..-.kz.r. mH......../eI.~.>.M.~W3...g.;..9...Qp..,m.q..)......|G.`<Q.......V.kTb.p..y...#`1.I..s..@i.L7P3b[@6.k. J.....p<.V..A.....yA.*.!.[.C...v..P..[.Q...c=......(.8.:....j..\...g...r.a<.E{..b.VW...0.Q...d.....2..H2@.2.t[...........S.Z...*:..r^.&/|.c2u...>Ov..1.x.v..c:.=.N:&.+[.8..'.%.f.U...l.A..3.n.u.V.R........:...`..#w.r....b.._.(.K..0
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.977080512327198
                                        Encrypted:false
                                        SSDEEP:192:gPlPJIZC6/Z0d+HMiF2Lh4ajJOCxr3zHFXjiZfcLmaeI90MkHanSZ3:gPlPJgqd+HzF4rJOCxr3DhiZs7eSbXnm
                                        MD5:0722D2D9202F742C6F03DA0DE92B2C51
                                        SHA1:514A4050AEA1123EB5F0B2C69B2520711A77D114
                                        SHA-256:A7D9FAC7E4CCBA63FAFA7D9F0197351265B252674D828C57E337F951CBD94CD0
                                        SHA-512:ACECF443837E0AA57B81D2E8CD33C9524F8ED186BE6FB15D9D563746BEB8B36B5E7D0D5BA06BD40AC9D87F738BB3392C6B699CF279936B9FD9D6D9FAE008D86D
                                        Malicious:false
                                        Preview:O...g`[.k..P.:M.l..(...>~.:...YK...R.[.[....0.v.5.gRv.J>.a+..Q".......2p....CI|..fC.......].FFp.[....ChnkX.q..R.b...)..Gu..E.'O.!A|-%....v.. /K@.9..}M.{.....R*..........)=..au.... ...m..O.z...B.A.t..C...|.<...X<."..D.J..X....sUP..E.......l..~........,.x.r..5v..r...U.N..^...jMh.bE^..Y..k#...4_.....M'^!.Mj.R..&;........I.._..1I..XK.w....k9wQ.U...r_..9...=.'<aF%......:i....U....].).$.6).."....m.Y..3...N.(3..."x.EN.x.{fp...X!.......x2nb@m..+.e.r...j7.%FW.....F....2..g...'....2.K.+i\..]...l_.#....T.p.~+D..-K<.........\.G..Q.`..R..........h...f..?.4+.i..$..s.!.=.D....36..7{C.F]iJ..X.E..=t...5 .. ...q.q3.e...&/.w`...p.....J..r.bx.../......P........C..id7H...4A9M4.>_.e.....hpx...1K........&=f..A.D..6p.sN..{.].......-....\.@:.V[.F.TC........Y.aO}i..nr.3../aD..`...)...D......n..L.....x9....2..U.....J.:#..).....'.. ....7.D..S)H...f5.K.0yuB..5^......?.S.....1.....<...|..W.).p..}.UT....p.....x.l.U..{Z.p,f..r.R6-WI.F..!".8./K.du]c_..Z.q.8.l...:...&..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.980051265163785
                                        Encrypted:false
                                        SSDEEP:192:VBnDBnBvZBx4gJy+CB/IJcJFWRqqLTULagXM4MIzfHBijjOlW08tJ:VtDBBvHx9JCBamZ85g84MIDsPOlWftJ
                                        MD5:3E29C3EEA86EC87F29924E79F1670944
                                        SHA1:B0EFE6243EC8C61909980C6635E8D15F02B57899
                                        SHA-256:108E15F2DF11B3A2414093818616A0DA5EE4E4478C2CA40C063DF8D249E06900
                                        SHA-512:CD6EFEBC2E1C55A059C915C44FA827A4A86C6CE69FF3351EE31271FD33F6EB4D87CCB94F3C324D4BADE8090FA7670AD487C051F3A6CA9A27C7934BA401C4DB6D
                                        Malicious:false
                                        Preview:.%.P.$.+H.....5.O.9t.^XM;/...x.....].>..F..T{.tv..0.G.<.>...P.kg.....~..hI....)..75.I...E.[..kL....."4..nJ..[..E...h.9.x...*..}q..~...H.....,......D..4l:mme..F=..^........L.y......o...|:.,:.^.>....V.....J=H..uG..H.cF...@.....Rxz...Z"..W8..R....Y..c.....\..`.&....B.;....&....#x.@.4.~#l[Fw+#.....@.l!..W.....k..........Y.%..5..C.!:0.R.|_.J.m*.D<..9;.ZNdI.............PSC}0..4..J3...-....t4.&.......wm..qD.3.....G..O......#D.S..g.......M....06.x.otHi,D..Q.&VH.....im.y......a0B...gu.s!...%.....{?n.....V.]...=.~.<2..udSvF.....]..u.JQ.....M*Y.......P..v7B....!....T.UnN.........C..t...<"}.11y.....Xb.D....X...Y.].[/.....@BeJ.(t..z...U.Qx....0..qGxh..AO...g...Ma.%$.+P1.A....*L9...P.Z...c....s..[O"K$.B..{..'..Fg.....ch.....5qV...6%4..T.@.{`...KTx....i7...h....!.......i....A.i..Y..GUd7......E .v...p<.$....3..S..@.c ..........v...u.}TP...#...f.....!H..^.....R[.{.....J.3.".p..y....B[.?/...J.8.$V...vh} P..~Q.N]Z3..-_.f.y.k..$a..h".:...K.......@...S0..)...}.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.977448381277302
                                        Encrypted:false
                                        SSDEEP:192:fqJ3KlorFENQqaSSpZU0jPlohfymaw0Yf48KJzQyRaRwjdLYZol:y9wo5EETlohfyzTRbGc
                                        MD5:2E870C3DF28A8D3700F20358BD16EEE6
                                        SHA1:6368AE577D80F9C16C807A10C6231F289B242AEB
                                        SHA-256:FF6ABF3DA6916FEF3BE401250576044168F44FCF59FF3873984AAA56D646C4E2
                                        SHA-512:D7C9DD953DFDC03AE8CB7C54220D252ABD343D23A3E8D5C3B3AFFFCB478CE748E7024B94377514AF56E8DF73BC1F1D5C77E03041BEADB4CF72B8BCF0614A9151
                                        Malicious:false
                                        Preview:..j0.>OW.....]r>a.......^%G..E...cCT..s...q....+.R...-.W...%e.v.]@{ .^.......72.....m}....|.....d...s..A.K.j..{..{........G.4.....U..-..(..Pk\..0d.K.8~....W$*K......+...7.D5.~..$^i.>....:...f.......SpI4g.y(....[....3...e....y.dA..s../...._..Pzh.4....i.;......~^h98.4....hXK.+._.....'A...n.AK..N.9.c..3d.G|."2T.7..f. V......A.|....X.....&e.|.>. ....,Y2..wu..u.e.WN.L?Uz......H.....G.f'...7)|}.o....Ox..-..Y..@.;!........g..E........@..=/J:.f.....1R...n..Z;4^B..~...?..fQ...\U.D.(_.P..s.)..6....}.ng....&..TI.......n..?.F...b2..Q...&...K.e.&...G.N.W../..i.q9..z.&..S.Q.6..k.A.R..~...............7:.e_MA..l..Os.8.mUUi'9....D..p.P.?z:M....C.*..os.A}R.`)%n.......>..:%q....g)eH..VV.'......a.Bk.s..#..C..`e9.<dJ3}......-K..B.......dx.yT..j.......1...V>#i.w).@h.&.|.\7....s........N........D.N)..RIa...U"E.=E'.y!q.Z...gZ.W7..3fw......uY.$.[.KX4....Y.."*e.#X-E.+".W.....%...Qff."..#.}s6.2.....R...o>.X..X..P....%(.Wa.J.P..@...u.F..6O..c~..S.z..h..;..Z
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.97910738768158
                                        Encrypted:false
                                        SSDEEP:192:j9p5eq9uwB3J5Lh82PlMf9WdTvwJ6IKPA1hwqrjml:j/QRwNJLrN1C0IuI5yl
                                        MD5:1E5FFBE3381478278CE555F5A9FB7D2B
                                        SHA1:8B54EFECDEDE4FE28A880BFFB63B44E8C8D05382
                                        SHA-256:1EC41567F85C712AC287DB12EFA791D8A076DE055C3D57AF69A3FFCC123B2F9E
                                        SHA-512:FDB41551F098B3650AF5779591EE7E65E0118A8C214E283C0441F96C5A97208B9684E359D022328AFC54C8865A468F114D242C42A9FB15E090E4C9EDE4C783B3
                                        Malicious:false
                                        Preview:R........'..e.../lX..S......).2.Fs...76...1......Q...F$7.V...4."...{.|Xo.p.....O.>..Nee..r*..N...Z.....5.,k.....D...aP.|...:..k....(.....l.c3.!_.45&d.b.w......g...B.v..]..}..S.!._....J.V...6..4Y.S.].H...S.C.?;..HdK~....K..H...+z.9.......+'d\.......'J...+.I...Rg[.W..6g$.M.q.5{.F.y.-....%2.."F.X.VG.i..!Q8.d..R.....M..}.Q.....E=@..\{].._.I.....K..]...m.JY.o..N..9wW..;C.eH...1.Dd.N1.O.B-.0(U.).R`Q>x'@..L..d6....i..u....%L;.......R.....K.-P._...x...........>..+.r.......ta.h..P}1D+.2p0.f. ...oB.1.3....\...OB.4../Q_..UD..J.g.....z...\G.^D.hqn.$.>m.C.#r.tK..E*.{.;..e....8.....b..'..0q.Q..}T..i..4.r.....R. .Cp'..G.".>ORf.k..rx...u..2...x./|..7D...b..Y..JW..i.t...ow+..).....Z.-14......7+.Kj.....a.gQ2T...&....e....}||....u..{.5u.p#31....b9.@6<.4_....;.&\....C.9.;.170......m......-?...aK....<n.B.......,xi.N<...",K\|..L...J.....eT%.z7.7E:...1P..1D.W...q/>HV....E.x.#...tD|.d.....X=....?..*@0.M...$nk..T.)..".P8c.........?....4..'...ix{...7.UaMi....Wwx.?...x8{........
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.977877994890191
                                        Encrypted:false
                                        SSDEEP:192:/mGaao6MmqeQ7GaQS67//pS5shB6aOOndqXwfz6u:/pa9QqeQ7+//pBv/OOMXwfz/
                                        MD5:C1398CA6B73D07077239F4CB6F9611D3
                                        SHA1:DD2354CEBB938D71440D1EF66E5699C643FC0787
                                        SHA-256:33AF3BEB974B4F3B1476F11B10C131104F3187AA7BB542976AD4C37D0C67190B
                                        SHA-512:65FB9F1A37630BF4585ED5BE5BB7C6B1827EEEF4EB0F55109A4E036E875D1A14ADED5D4FB2524041330A9F13DAEE9785AE7D53CAB893DBE03A11D28E0377D448
                                        Malicious:false
                                        Preview:O.9...Y....#c.\]..>.......3e....Gy....X|G-..!. .nw4~g.Q.O.'.V9,.!+.@......Tb....gIO.l..<V.F.U.....{.0..@W......A.....Wo@G..N...Iyk_s....*..W..m..dY....lP\7....{...S.m.g..A...Z..|. ..:..2..Q.).....U.Gw.:.P....W...l.8.j.6K.9.........O;..4..).O3.WD.J..{g.Ay........e..iMm....D..m.ad....h(/....}......~..W......4...0.5..1.ZB.$....\..vN.~!.T.....j.X.7.E..)..0.L...V....>G....<.3....F...".31:Q7......<...:.T.S...l.....JmP\....L...\....../.d.n.m=...!.j.@{....Z/.V..}....{..I...+....-...).w.6..A>4.6I....}.....@..l..|Geg..h....s....(.....F@...ZzA..;}.]q...2P.t..@D2.E.......m..t.\BT..&'..*,..r.B:....i......x...*.8..........D8.....W..|Y.i...;.3.r\pS.)Ci.hXj..V....JU.=.W}....2....}!%T.[e.{zi..C.r..G..?:....}.'Y0\i....t.".#.2.M+l.;.....QE.Y...8WQ."...>$.Q...MT]...gA.z.......(~..Z..aQ>.J+.6qA.c.~@.3..g..1C`.w.3A..{^C...;/.i.!k.T.....eC".....K1c.l...."../..53,l.5..BX.....zi..b...>...;.m.....k.2."..AB^.IY.l*........).f..... .=H..(.....P.^w.....x..hx.0..+pZ..(. .X.5..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.977341931409699
                                        Encrypted:false
                                        SSDEEP:192:boVu3VwcF3FD1YdlHP00YQy9S1ZC5YODmLHu:bLPdyjMa3aDmLHu
                                        MD5:B81342786EE1B1D2CFC1A5D8E3B5B986
                                        SHA1:48C27DCF715F254BDE62CFA68059367EB584DD07
                                        SHA-256:B4026F4782D8901F53C9932EB4A121EBB9CA559C9B7927570A85D7927FD86E19
                                        SHA-512:4236EC4B2D1D0BECA15156AA8DE7E8A019AB9718D2A91524C20F2B5D16631A9B09AFB6E07EDB763CF071BAC7896D0EF74AE0A793FD859F4017C8C7B250048B6B
                                        Malicious:false
                                        Preview:......q$..a.C. .d...JZhEm..I.cQ-'..... i.t..5..b;.......uF...1......].J.`.0...........}73.b.u.u.......-.V...:.{.......m.._..=,;...O3.n.....=......f...:.O.J...V;.P.Y...+*..-..y.....l.~..uge./,%......C/.?n.....^..: ...m...O.q+."hL..L...g..pa..l.v........Qr.fK...[//.A.aK7.....*..A..+..i.5...L.}we?4..4mHN..M(}..D.*..V..0....B.I...M].vh`).(s.6.-..7.a.....mp..[^...GcHC92.0].p..&x.....[$..5X..........W'.m.h.......L......!....|...`...I'..wb#..8p..P..........o_.~...3....Q.q5Z...j..d0,;#.F.....'.g.3j. ...|r....,..}.1C.`....b`..U..=...j.D.{.E..z....p$:9h}..fL.c>..*5.o,L.....A.L.......mAz....s....J)d.[..O.....M8[]..K.*...d.d..o.........Y.l....Y|..+...A..`K..{|.PVJ.*..=.l.,:..dL..:Te..$..n.....-.o...WG].f.;.....,.SGI.......3...@...6.l....2....*)|:...C...>.(.?...v.q{Z....MC(2...J......hIC.Q..-...&.b....n.............lp.....C/'...N....2e.../.$....,.....n..QZfH...z.1...R%..w.......R.....y....S.a9..L..S..y..#t}..Q.McGP..r$...\..aC5...e..M.c.UF...V
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.976684431299556
                                        Encrypted:false
                                        SSDEEP:192:I8xslaFZoXUBHsDLPcPnxOFh41SEWLvQwsCiDR8VROJ:IvaFZoXUBM/0kC1M0wsF0ROJ
                                        MD5:12960A5D695A16C68764C64837B7D8E6
                                        SHA1:A09E91FBF874EB4673BC5D0745BC35D74DD61971
                                        SHA-256:CEBB391AA7CFA466352B0ADC9DC806D52B0AEE999DAEA33645C0928CBA44B13D
                                        SHA-512:5B079AEC324488F17BCE10AD19892921917E20D3A4BAE0D5FAEEB26F7AD0AFDD028D7122663C44359993185BBC3CF098C840CEAFD0B8777FD6013FC84E1A9CF2
                                        Malicious:false
                                        Preview:...[T..%:Uv.cS.....Q]..........;....!h.l...o.k..,..'..5...}..8...U.-.w<.B.......v.B..p,%~..V....oq..:._|..(....ZQm.m.!.ga.....Q.|..+.B..-.......-.Es..C....hE)N. .;/j.....W...K.+..'tm.8Do...bI..{.P0....Q.q./.g..?.Y...+..M....A....a/.koWX..#=.N0.5f.Q.......g.p:?.P.....{.J.l..=..f........sr.J........4..h..M...G...wm'.?... 3nl.3.'.j..b#.C...y.5..%...y...V!..H......x....v.X.......f.9.4...~/XC{.d.:"`..>...A....a..!..Kp.#<n....q.".Io.(.W.7OP..I.3=...%..@....0.z.o_....]L....eED..n....+..ymB..e.~...<..Q....N.M.=..4%m.8I7..1..Q.I......b%.T.t.hEv.s...9O&.0....ldi@.....=..X.Q...s...R....o@....a|.C.). .......C.tU.+.N."S. pO.w ...y24.t.......7.>..x.y~ouA....7.%*.."[.I.L.R.#8..........K..Nc..p^.s....2}....k^.huk\q..KAL..0. ..aU.?.....,U.Z..=.....=..bb.es.b.q....^.m....o............W!.=T.......e...........8.O..=C,..R..S...T......^fTM`.s....A.>?.P..l.)|.V...{..Z...3....|.x..O....".V(..5..T..z..X.<c.....lql5.[Q...j..cS.H..Z.8..=.+...... .q.LU.C.....5..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.97800060860406
                                        Encrypted:false
                                        SSDEEP:192:W9eWoRVGd/EbtDzjYXCZcvlC4f9S8BQbllB0aYg8g:W9ZIGOBDYXplDobllBtvn
                                        MD5:634EE18E8A7721C87FF2F44C82E59529
                                        SHA1:92D48FA4BF817EEC7D43720A1B35F308445F4AC7
                                        SHA-256:DEF4F4CFEE3B299BCD05C6DE75FAE2E6D051C6CFF37E84854D7CF4D8211C7F25
                                        SHA-512:BE308A5F4968418899B40CBC47EDF3C4441B3279766C96469528CAD707A1FF681BC64D081897479065178D482050A9B14C0B178112A8A3EB80EA726A11E8EE1A
                                        Malicious:false
                                        Preview:.........w.]P..t.0vY..H.R.%..2~P.@.fc.....-.....t..,.(;K..{..........=....!..u.8..o..~E..B...Y...nm....7*S....q..B.;..R......m.c..>.@..h./.g.9.Gu...c"w..P`.}9.....I,.Y...h..|..WS.q%F...J.dC<..G.cd..U.M.P..@..........tz*l.cb.<i..<2...T...u.U....[....z..q#<[..5.r.....r....$.....;.|..3.!..m\..*...J.i.@!...J.a..hN.....7W.GW.....KT.&..On.u.2...g..lA8z..$...w...%OA.jSf.q.`.i.....&H........(........ul.`$...s.P.JI...1.=SF....l..}H....1...6d....=HWW.4..p..Y.Xb....!.P^.VQ'.|..gf.....,..#...'...m...7gB}..'...._.?.hw-[j...jv. @[.......bk/... .(6j.D...3 .*..Vz.(0.w.F.r..7n..Y..O...r..$.E.v.&,.J....&...G>A..x.Y.*E....[@..y.<....7........4e..y..M5g...o..St.>.}J.....:.^..f.$..z'.T...85g.&&.X........a.............V.8M..r2....z.gL..SNM._.M..."C.F...}..t......O42.......~]..../KEVL..D.....^q@.R6.......=]~.Ih.5..kEc....4.X.......v.......)..O..G.j.F.m.x..Z...9....O.x...j..dH.N^*...'...e..n&EA{I....:..?$!d..(.2....?. ..IT.b.pi..E..0A.....k.{.S:x'....yl.P..!
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):551
                                        Entropy (8bit):7.585517834564016
                                        Encrypted:false
                                        SSDEEP:12:mjCR8bUv+4XUolRMNJse+A8MO8k2IXApV8TI1vDgX220IAuTsM:bR8X4Eorssemk/IXaV8E6X2oT7
                                        MD5:BA4C47E78EDEC80F9AA028C42DAD9862
                                        SHA1:23CFBCCA486B428AFF932C148C56C44FFC25E31A
                                        SHA-256:0545A725AF276E5369765F4FAB4D4CD621B92A4039E4DF6EC2663327BEC60F56
                                        SHA-512:0F365D803BDB58D716660155FBA57645E5E60A3A69700C6B1D1AF1D8A55AE8327453B132C38BD549ED6EC78BAC58B6E065897B62B7C2D5F06EE2350EDB520064
                                        Malicious:false
                                        Preview:.Z..^.:...N......C..ofs.X.UN&.R.?.7$.*Q[..W.W.8..3....w{u...2.<......Y.*.W..1.....=..m...J..[........!....k...W.\.r.4S.*....m...5...G.JG...Q.....j./;...l..C.0./O.9C.....UKt....!d&..n....[.Y.....=.].,*...U4.:....@..g...:..d.>...J2.(..uF8....."..k`|.....e?3k|)U.]V......u.G.v..+.v{0....E.....\.B.. ...N..Y....{g.^-q.ru*#.U<.T0.<.X<s{...f..D.\O.h\.....Z.../..b.0....P.u...S.....f[g..s.<w(.y>..>.+...@........^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.980468472394913
                                        Encrypted:false
                                        SSDEEP:192:chfyceAN7kpU5I0OxWlDJuaCIFX+GEqhpVwxh7p27NscM:csUkwg6gHIPEqGxb27Ns5
                                        MD5:A091582CB42A98EDC3F59368062B4513
                                        SHA1:BF4BA317BC5C624A3B78FBAFFC0BB35C9AD7E71E
                                        SHA-256:ADF460C6CF24367922F3AF700BBCA1C7A00CB4050EBB2ABAC41D2A8D44D1F105
                                        SHA-512:67E5189BD86B43C8D85684E42D4C19962084438F9F9B809700CF94B3E8AE31FB6418177BA8743E782D25961A34F16048FC13ECEFDFC9B366CF6E34DACF557FB5
                                        Malicious:false
                                        Preview:yd...X.....ja......k...<...$...o..2v...Zi8N..5@.T....J|....5d..E7..=.W3,.\.1.......t.D.j........>...p....z.e...S\..QLZ.2..a.........D&.H.5...T..a}\..V..G=mD.H.>...:Si..e..I.M.T...~.N.j...N..VJ..4..4MZ.(._...' .}.2........m.N...77t,.eI...............P..s.p...T1N..O..b..F.....}d....j.K....nbCz....#......"Lx....L..X_.9....w..].-[..`.....N...#.='...<..{.Wf.8....j..Z-.....DC.2....|.3.b.ux....p..P,.=D.fN.G...Cf.s...`Z.%j...x.v.#.c8V..o.....W#......n'.c^g..J;..%...g/vyg.M^q;k...VeoI.C........k|.|s.....3....a.....././qze..Z..;..-5...`..Vs...+.k\.`.m....6gP9.....R...q%.H!a.2.`j..fP..."..G....}e.qS......P^....;.[92C....fz.>q....*...'..).._...*....(j..%Lf......y.....#.....9tj...e.y.D.F.t....d.:...!R_.Au.....B.....;G.f.....r.l.3_..P..l..hY.vU.....#e-...A.N.<@..b.u..J....m.3.K........#.C.{..0"S...0......&.o.D......+......w....w...8.E....$..D.b.-....;.r..N...R...gQ..8.GK...M.UsGG..7P..<x.py...2...V.j.....vd^.&..[k\.....6f....m.....31C..s..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.979478802362421
                                        Encrypted:false
                                        SSDEEP:192:QBtWxfcBXYcYzmpmr1GW1/8aSnbyrBo9wzuONmwbT3ROats6:QB0ZcBIBzmpmcoSnbiq9wzuONmwbThzD
                                        MD5:A7DAAE1BB9655578A9AD3B6B8A8E9932
                                        SHA1:29177EC5D194919109ADA598A4E69BDB8345E2BE
                                        SHA-256:84D7C23296ABF14E695B1221EA0CF88C21145CF7DA5FFEA9A84CC7B4A7ED2371
                                        SHA-512:F6400BF695A04D3B85D0D397B852B16318111D363C0A4E498CF9C803A3F354BB1FA64BB69AFADB5E6F359F39B66B7E5FF324D29387E0C7179CA4EAE96D5CA486
                                        Malicious:false
                                        Preview:.-...AV ....p....o}....[0.\.R.a.K.5..f3..wd/&F.6.\.pSp.J.{....gB.h.].J._...vM...O..$..|@......../i]\.....K..-&\V......R.J...&>c.H~N...."..h..{...H...a...ZC.....X....... p..*&.&..^.....G.}.\d..w...>U.;>F.^.pK.BX.........$'......'.n.n/D.d..2.S....#Hs+....0.zay...W2.r..q&...T.z......2.*...lI.x.....rw%....h..).....).'/.'....;.O.In.5KJ...%..!.b......{..s...>...T\.+_$lw.fH..Ej..D{..$......T..%.g.Xp...f...?].jT.{.}C...zP....|.......0k......+k... -...ukfY.+-.|.......~.....(Q}....&9.X.Dz...A.Uq..e.......oJ......*Z7c.t...!|3.r......|=]\..j.Pw._G.C.xJ.A..9.%.l..9....D.].5..Z...'$L......1.iA.pz.W..?L.....n.\.6..+\..w......0.g..`}.|..Ea..}.3...(.:.F.!.....b....,....d.v.W....4...).7........}WV$...>.^.M#h_..N%ln...N.-L0......v..a.P..T.q.FS.....3Z..o.$.(../..y.M.~.=P.,..T../|Jm........nt.QB.K....W,.W...>A.[./I-...B..Y._<.(u..N..._.m.yx....H..nl....t..B.&..-......._..6..4....v+.........<....rZ.NVM[.....%.....}%.../..bJ...C...}.[.r.([Y.R....j.^..(...`....}...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.981775224249101
                                        Encrypted:false
                                        SSDEEP:192:TP95EzXvXsq7kzvuR0GVYZCBG/bBi6DeusXuww2XB6:DTEzUaRCzbBi6DejXZp6
                                        MD5:2FA91D3A931CB956244DEB6EEA2EBA60
                                        SHA1:3486E23B698AAAFE4E3EA563246D5A5AE1A35D44
                                        SHA-256:26B3A50EFC4783F64655E560E0ACB87DA2E1029A4DF9B0829F1E7D5AD820C107
                                        SHA-512:CBE693BD2D56A4BAD4A4A520BD3901744641F07D2445D5205FE4209914F61B801395A0075CFA85373D891FEDEDB10F080863FD4506B063722E82B18D848640C2
                                        Malicious:false
                                        Preview:YV..._..x.b.JO..0v%.Q.+V+Ff......D....k.}...n....'.e7....J.....f.|j...W`...g96.C..e,.../..M`$.Y..fjC:...D...d...n.....9...MZX......m.KY.G.....L.'Ne...gW@..`.G...Uu.....u..t....:..y..!............wG#r.E-M..]^..${........m/..W..!..u.v&}....b.i.;G.>.W.0..y...GP.C..V\\..yR...E..D.<.K......L6V.(.(E&[.K.;..~.....:2?..~;=5..m..j..c..gC.....,....iP-..R...?..CA\.....<.':y`..&.AZ.u..b..yz\.`b..."C2c<.v..w..L..F.Z...TY..k..y.mk6;..u...,.^5..O...4..n.c.$.m,r.W......y.z..Qy]...f.\]8!8j...0.ht..qW.B2..JCX.U.z..I}.2..5..<.......).Pj......bXe+V..a..._...1..K).#.!.:l.s8..i.3.....i.h...,.>.Yc...57..-.5.[!f.,..k//y?..K).|3t).e.G.j.......:..%}\*g..@T.c.....GN+F..fRa.6.`...j./........c.'.T..].7r.Z^.S.'.Z...........gr...e.~..HZ....D.s..)|.k.....h.T..B.n.K...)...B.s..TIKC.@.y.K...ZJ..YL.j.!j.\....;I.....Dit.aa.....&Q....q.Ok..h.-Q...\.2.8-..(...}y..c...o.....E....i.UD...z........}/.@.8...BR..;.)t...F......,t...8..H...[.S@O.Sf.Q...uN..1.o.\#w.$d*2......>.L..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.980169535133892
                                        Encrypted:false
                                        SSDEEP:192:fZ0I2Dfma/BaKUuR+mLJ4t4NbADhvM7emx:fj2mhK17UUADWyW
                                        MD5:F0A9D723058218AA6BF5D182A530AB9D
                                        SHA1:28EC9E8E494A23AC8776DFBE532DEF2367439481
                                        SHA-256:6D2B0F8FD2B6327019F9E4F55C28843F461718F333F0683C1F3A5602D541CCED
                                        SHA-512:BD8132774086BE82A839CA24DF92A69D5B489077E0637EE07F7793E2634923741FD4CA6060D134C916ABBB2BE8A2183E1B4C558CFA5F6271FF85324AB18B474E
                                        Malicious:false
                                        Preview:^z...z..O!<-h..Ud.kc.)...P:.Y...;..p.&{.R....^l..eT.8V?..n.jea...D.}.e.a..,.#.......uf..s...l..*..].V.B...#.O..0. .V.,......Wq~........u..V.!.4'...........L.....c.....!.A...EohR..!....a....4..D...Q."8..[...Mu..P...))E. ..,[...X..9.L...>..]G..f.}[=.|..Dm..'N..7.+I.9.)..K\\../"y9....S..U.~.2T..$......@........%s.$D.]O...6r{.....G...D.y...S....4.*...bc....QN.5H...\....bh. ...n...I....4..O...";Y!..A.mZ.F.......%....m1.Y=0..Q., @}.y......#...X....(....:.K%....8...;`..l.c....D(..:M4.H..>A/...6.|...R..).:......^YKc....RL.A..Jf.X.!.O.G.g.!.]}d.j(.)..x.%.P...H>&v..p..j...u.W46j.>....1....:..7.....X`....z..g.-...$.UG....}..Z........(.........y.7./......p.F...].9NM^.....t...L).(]#.H....Y.b.9Y\.7.$..^'.u..@.N........"0..a.z....)& QI0..#.+*........z.....x..#.V&.$..8a;$k...r......w<..6...M\.4a..r.r....v..x..k....V.........`.n...$..?.w...Ocsy...-....#..2......[..MC.#.M.x]....N..&...{..........&..-H..<.......:f...l=.S.B%_f....r|.........s-.E...y$.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.975320081378526
                                        Encrypted:false
                                        SSDEEP:192:PVYtQlQCDflmwj/F3VUyTnq0mqlA4xq7nIWlVG8ED3QK+YbPP:kKQCIKd3iEnHlA4xfWa3Q+L
                                        MD5:14E9DF875595B914931A60F763B0AECB
                                        SHA1:06584506001667FC28D2CA0E1300890926B38F93
                                        SHA-256:9FFEB76C903B4AD4428062DE50687D0DD81C650E9560EC2C26A6766CD360EE75
                                        SHA-512:B4A3C248F954A41740DCD8C96740A4ED8FB6F85B5420682727D48831843BBAD4B018922929A7B364C13574DA2E75392CFBB183CCA2C5981A662DAE32E7DBA43C
                                        Malicious:false
                                        Preview:K...B...F..y.......>..........s.O....8fQ..3N.{-......3..zI..>....b.)...L?.b.^.a..-...1.w....5....<[...><.[...........7.{C...u.>..Z.H.......f?7......*..6..U..:.n....M......j..Is.....w..X...O6E.@Y?FO....>.Bm..M...0.....^...99...x.b..o...a2..S.$....2<..www%.'.{......W. W........K.%.s*.%..r.=..=..X.."....3.*.u.4.[.....w..{F..vV0.2WH....r..Cd.{..p.a.h9....].@.5.M.|..=.;......U.....O...y...3.O~.I'&.^.j..l.8.X..wf4..Z.#..V.8.9..t.......y.<.S....*v..a...._...#PCv....J?.i.G.Un!O.H....y@.....K....p.9.C.q!.O."......@9k.N|....'.o...16....8...Bn(.............R....&f.m..........=..ZW........U@....@.\...V.....7"......#...r4.J....&...p.s.g..h*..ga.<.....oS.J..Y.. .,.X.....M!5&l.....#[%....fh+..H...2!..$.......*......+\...l;..g.;HAcm.J....@.............1.O..x&Q...-.T.U.d..{..P.f>.qpi.'.....:..c...vM."_.z&.....q.h.{.._|}E..t...Kl........I...*.Q..i.#..w:p"k6&z.p.....k...}......f.....$h....N.&.'..<...'..msC.^..#4p....0w[jD.p.[.I~.....O.a..8.,.^O..@..{.Z..f.6.,...K
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.980649728987797
                                        Encrypted:false
                                        SSDEEP:192:PNyS1xrXgsrtKEv/ZchL01rDGg0EgPImM5C9rpbCrBJeK8W:lHPrgcb/60J6glgP1j1pbC9Jeu
                                        MD5:9111FAE03A13D677B4C53947AB3F4F33
                                        SHA1:8FEFD7E8AC73B03966A2A02513BE51225C30F857
                                        SHA-256:37C5E24483059E58EC0F0CD3FC39034F7DD03CE50992DDE8759FD7EF0685102B
                                        SHA-512:AFE3BAD216196E80C0CD2E970138563CD83967CC73F277E3AA81E77A58EB7A06847F0241572ACB9BF1D665A235E6E87769246DCC10D933E563237E9B05483481
                                        Malicious:false
                                        Preview:.Wl...:..0..o...,.U...Q..4Q.g.M.LR..8X...q7/....^.+i>..............?/..k........l......O.'.jV.>_.c..e.]..qE...7UX..j:.N..0.[A.s....K(z.9.G....L.bD.}.xH..^..".....X.N.*...c$..@.>X....)P.E. .]w.uOu.w...pBd....g.C..).(.XY....yDY...0..e.!.3..S....ZS.L..C.'...QM..9.6..eS.Z....T.d.......?..[.7.T!.....'..*...._.'...*..kN.O......Ek...>....TKr4{H.<...gB`.....HI..M.BMmT..J....PA~...:C....\..C....%..@X.jq...G.......^..O*._7Z1;3Iq.E.~..oDD..k....>..gH..Ug.......2B.TnZ..HW.L.z........f....'..M..>....pN.^D'}y.=.^....l3.3...%..q4....?.#!.h......m......V..1...d:4.[..2t7...S#.X.j..q....J5.+...Q........^.7%]V..A.V.#...S...:7.>...yrX...w..^."&/>....8I...f.y....u.Y.N........8..@..}f....j...N.<..I.........._Cr......=..........55.Ok7..i.......*e..r...r....'.W..n.0....Gw...M(N.\....bp._...k#R...$[......5N,'..>..E}...,c..iv..qC)...}).g..M.BS.....J.Y_.#..s.?A.Y...DK.....ic.R.......X......M/..(....Yc.f..f.."....n.1..<......^.'=...#0.._.....x0F........M..W
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):8431
                                        Entropy (8bit):7.9763155506181835
                                        Encrypted:false
                                        SSDEEP:192:qPXgnW0Aw7d0mEOChVT7V9OyRunobBLFGNcPAOynsS:q/Ti7ms8Bx9OC/bGNZOynsS
                                        MD5:0E80EE510BEDC97C9E9441D6C478E08B
                                        SHA1:C359ABA08BF9ED51870934E52CF34A025C875725
                                        SHA-256:0F4917222A66B04031DE9BDF7332C87D1037E404EF6C614E7BA7C039909B3504
                                        SHA-512:0F4B709B588C86FA0A8A1A658DD9795234A56E6A90FB4B145DB321753F95C856AB960C4BCA792FBF7A31E9AE0B144FADE72CEEE07780384E9C9D070A72EF3267
                                        Malicious:false
                                        Preview:v.1....\...3..X@.>i.;-..q.h.dc..nE..#...&......x.Q..1...6kc..R.4.].1.?..*.{....k..N......@...*.=..E.v.......@.j+.m..M..T.....}.=.=1..qd.......z..y..,....Z(..J.(>..K.oJ....L.,F&W..B.[...,].W....Ix...h.@-.Ir..1)..QH.m.^.3.$....w.N...iw...Y.E.^...;....n??.....f.X..._..1.Z.I..,$5.q...l. .s...9."...9N|.......oy.V.......B....4>.~....J.L...#....p..Bh.7...f.._...-.%..,b).Fk.=.._....rN.0.R.C.......+m{tmL4.....;5Xw).V....^c.F........Z7H....&.=3i.i.1.5..}.......\....+X^h...&.|.....R.3._.Z.. y.E.W...(1...e....F.O.',./`.....Y.....E.....hQO.~r.8..h.........Y.B.Um.....W....f..:....|..$w......@..i..3..........w....#9.#N.#.uo.".vvm~w.D..e.@.z.{R..O.9...0.Z[..9n..].;...~'.......GTe..r.......IhY(..H....e..6..._...^....*!..5........]....W.Q.=..-.7,.@U"x....g.3-....Aw/sE..8....k..#..IF.J....v.........*.......=.).$1.~L}...z.Y...a....U,R.sei..;I..<...{6....,.`.eBr...V.`....].\..Ae...fC$.+....wB.*4......-.!..R.o..P.j.H.B...........!'..W^.b.1kx#A}..koW&,.H...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):65793
                                        Entropy (8bit):7.997431048410088
                                        Encrypted:true
                                        SSDEEP:1536:19qbqL17NLDNwndugHHdQlCz7ENYIt8cClWo/jH:11L1pUd9QIErWcCIobH
                                        MD5:C59EDE435122C1BCB80710995667F1EE
                                        SHA1:72046AE2E4CBD61C8A9A906AA13AE4FEBD9183E9
                                        SHA-256:4F5CABD111C03C83DF43BD78C91F421276525B0A3C9018BB717B51C78A36588C
                                        SHA-512:BC8993AB3DBE77F1C604E3D4BCBE3220CDCC0E0DA54B2A759879A53D399F852AE237FFF6969682DFC2B09B712833B0B59DA450C77C48FE734D956D0831F06F1B
                                        Malicious:true
                                        Preview:6.$...`......I..r.2t`...m.i.5.8x.:.....87L..Xa?[...`..g?.p?.$i.j.g.#).I.j..Z.w..&$...{eTu..xe.j......u........dJ...R}^W.....yy.2..BT..^.z...Q.EF......?..rW'D..$."{.".A{.7...@.U.&.:&...`.GI].\..>vl..d'.io.s.f.b.C.....{.....3...O.......8+.\.z.;...;.<..~..!.aM....[[....S..HX.{......a......j&<%6.P.......(P...pA.v.<.A.*l...b.)q...7.4..Q..L.|o..jP..w.e..Q...cg..R..Rj...{..`..g.Q...I.x...blnW...qhP..0....L+...a..9.*t.V.%tz.S.... .F>n.....c]....*.$*.c..........bG{.T^...W~..An._.}.mS.v.&.QU..m.o...)W...C.A.&...X7.sE..+..k.9.iqGy.f.I..N...9*vJ.-.$.....|.^y.L?[u8...N.JU...f v....r.M.Uj..L.8.3.s...E!.J......4O..IG .b.kMX.~...,...#46..,.(...o'i.....~Y.....B..2..)..m.........&.@B-S...B.{.3..d.>t6.~.?z.V..K.JJ....b.:r..p./E'..%.... ._jm.m|l..x.....b..$..+.1...<OC.k....I~X..>.Y....h.L.do..... ..n..3.F.:`I......+...n.8;..I.$.Ev..p.....06{.x.....o.N..IT...Ybdj....:...K..@...D..q....y8...pj.....b.".Mk3.....`..v([...4<...|T....,{t.!.s.i.$....C...Be#.,..~
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):65798
                                        Entropy (8bit):7.997573471420175
                                        Encrypted:true
                                        SSDEEP:1536:IvCVDu3WCaormiccEPZ7WWhOu6XA89g+6oJ009CAuaVsyiZqXg:nVDaHmimWWou6XA8T6oPs4VsbZh
                                        MD5:58F73FB1BB30CDDB4062DB5573BEB93F
                                        SHA1:2AFBEE838298EAAFC837585DE1D2BD62A654A1D8
                                        SHA-256:6CF297CD2450DFD7B087CEA2CED173B9E2AD1204A678E1791EE275E5B19F76E0
                                        SHA-512:ABD4483CF2A7530D521890EB2DD724A9942DFEBA164A27BA06577A00F13923684C9D6C3803ABED2897049B26C6295CA305187D22280BF55C109C1434711AC18D
                                        Malicious:true
                                        Preview:u....Yf..6H.C...4.'ur....g.Hp.....E..."]L..r.7~..S..N'&r .<..Z.,0.xU....e..v......Q...p.Q.=....=2MF..m.r.9F.eIhx.3..........?B.\Y..=k.......Ph-1.LO...+k.}.g....S=#>v!.....u.U%1rIu<..y...]s..$1...&?...dz..VI...D..o.W..~....k...5".....h6c....?..U.].. ."._...3\K4..vH..L.0.Rm....'.....B.fzF.H.4..0XK.....5.8..+.C..L.p.......I.lk..%&..........@....4.^..km..P.(S..k.*...Q.+...n..Q|mA.......>....#.P..8...-m"..R.. ]C8.i'*..E.h.2.@.0.4b;...qhY.uTW.e9F...........j....r.<s..G.h.F.<..<..1..$<w....|...Jg..I...U.W...?........Z..I.ye..a.i@..7O..\v.-X...0..F....~.YB.A....7;dC.r.2e..8...k`!..&=p..=.......!.E..0$...Z[`....]..J..^...sq..._,K.%.p..4J............)........Z....,C.}..&w..A.....h...Gl...\....J.)........H.9..%.......r...*...'....x.yW...i.8.A..)..s.oP......~.......hd.)..d.V].e..%.2ZU@..6".4Y...b.pw.\..;$.b;.ML3._#..`BP..............!%6..p.r..m.f....}....pL..;..d(|. ;,b.*...,L....!......b..B....\s......jP...6..2.tD..."..V.{.H,.h.)M..Lz........-.......Hc+{
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4194544
                                        Entropy (8bit):2.045642940349602
                                        Encrypted:false
                                        SSDEEP:12288:RTeSl4+ERHPuf1/Rdl8qRPnI8o5CmJmoYV3gMfX6RkmRE:Ve+EtPuf1/RPDw8o5Cm051gM/8/RE
                                        MD5:7CBE10D06EA546A4D1587C7D2F06B8C2
                                        SHA1:8E64C241AA4E116A57FEA81EDF3FB724223BBBF8
                                        SHA-256:3C6E11BF38E12E5A5B28C9CC612038F394425608F066616FF14958A8A0F74866
                                        SHA-512:62B338575C762A8BA621E1D7CAA808AE974F587CDF89974F58D52113BDB08E4CB23523BC69AFA646A5947112B806EC83539872F281FEF4EDC8252DB0C2DEEF14
                                        Malicious:false
                                        Preview:.BbB.W.....v<>.....4..6.+....'..s.'..\.V.AH.....s......uJ...<..n1...QCR...`n.@.>4h.!~..P.w...M8.X.=.).-xO\..M.+;:.^.X..b]M6..(h.1.K.M..P.....<..............>.J..._?..jY:.]F.W.E.1.(p.p.fm.n...|..O.......Ye.w9U...gz.?ut*..C.^.yB.Q gX....'...x..hC{.]s..frw..2I.o.H..GT....*..!u..:..Um.IZ+O1.#..h,&[.|.J.rV.L.y...J....)|...m.._........0.9.MF...$..t.+{...7...........&.#!..R...5}#r<{o..2+...J......k".e.}.H..F)._.....<...X.}M.a.Z.H..&...'.a..0...{>..|O.w.P.).'.K"..K1.u....`.....H.%(...b.....FD.!w6>..@#.;..]1."[.....62D.T..BxD...9...:.w....<_[.....A.GU.=.q....S.w......7...3.)(!.?..f..O..V....{Hb.i....6.e4..d.Vd.w...1...Mj...M7j.....uq...7.. ..!/`.I...+.u.P.=/AZ..............b..h...j.......f.f....u...le.J..~.....pq...D)....$zY....SXw.>.|S.....pd7)U.-.....9V.z.-Z'eS..1.N..S ...:..Y&.......M(...?-.#.....Q.B....g@ .;u.|"..9...~`v....2HuF..z ....q...ce...2P.E...&0>...r[R]lr.I..!* .."..dw..,..F.R...,....Ui.u......7%X.......[.|..4....K.=..};.."U/.1.K
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):16623
                                        Entropy (8bit):7.989187867532354
                                        Encrypted:false
                                        SSDEEP:384:R1CTEGEHFLQZXh9UyH4FOvMx2Bbk8cD/6diTEu8EXt0roDU:eTnEHFL6XAyHYOEx2mNi4nt0rh
                                        MD5:C6CEA30F0A432FF3BC93F7192E473A56
                                        SHA1:85BE7FA98DBAD8F620AB32200C9E3F4203272970
                                        SHA-256:B3D49AC690F47876649B87B5F6C250B56E31C273C00164774844BE824AB1C346
                                        SHA-512:061B3D624D32FFBD09406890993D267F51DBF223D3BF7F0EF2B78662F73FABCA35C48235A07471F8673094F9268CDA14CCDD6165982547EED01CC87428165F5F
                                        Malicious:false
                                        Preview:.y2...<.z$....|....F-P..?.........s...dm..=v......j.`8Xt.y+......A=....>....'..d.v.K...a.l&.Gc....iPh..6..;...A..`.....ztG....--..`.).l.h..Hbk..'....[.jn,....r|...1.S.u.c..f.h...X.*RU...=.....R@.ah.w......M..T..t..P7..&....m[>........B.c..c......i.......E...M.Gp..>...F../..m=g.V..1G.,..g..xT@.M.T...a...y..k.<...5,n.Y.W6...'n...y...C.z.....k6......|.".=Bh-....5..;*.kb>i.n.].2.;N.<J.,t...w.ZL.....#.....HZ.O. .*(..].\r..G.e.S........sg..1Wp_.0..z0:2..6...(.`tt@.h..On....e/..1f...*O$.3..b.EwJ...<.....7......f;(...T.z.T.....J...>..G3TY{bN..2Z.,gtKt...$.y/.4.L......g.P..k._.\[..I...KV-..H.+....O.%...j./.....H....8...Ki.10..:..<dY.I....$.....=..1......b.........v.7F.8....*-...*L..D..`....r...I.J..G.d.l...U=G_.w..pV.......).=....0*.'-...}.......P.b.S..'.8...]..F:.....4n.....8..,..d...p..S.$.....*..{..#..s:Q...w.UPZ#..,-.wj.q...?......;...h..=.I.......T.x..".,v..o.v..%$Q...Y)..@..u..8...i]...2.8.....l.BY.^.jk.....J.....@q.K.......w.82J.NE..Y.'
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):279
                                        Entropy (8bit):7.239958018034405
                                        Encrypted:false
                                        SSDEEP:6:HMUuUTluEPoLLbkt8TpAz2l9LrD7hje952lItGIUCKcpqKsM:HnZl1PMAtbX220IAuTsM
                                        MD5:D8DE2F2212ACC964E063961D5345AE5C
                                        SHA1:3FF578E29065A711BAFB29BDD5EDC7164115826E
                                        SHA-256:89EC858D9A73A6FE6356B122242998A35CED404801C1F8CBDFCECAF8B0F95AAE
                                        SHA-512:104843B32097404307063D730A82E74382BDE82F27C3138FF37C75F10A55CEC4432EF0DC4CB347DA28FA2DC13F2B4BD1E8C792AD897EC8F1006F057650FC8703
                                        Malicious:false
                                        Preview:su..j.-.X...K..V.j>..l.K.~....QWEs.....%j2....%.9G.1.u.G.MCPBG..Uq.JH...~,.>.0x.F*...-..(..wD.J-...jw@.>....M+r..k{.....Wi.m@.0....d.p./.@.n.YW\.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):735
                                        Entropy (8bit):7.721475393181041
                                        Encrypted:false
                                        SSDEEP:12:dVWM1g3AI0f3Unlp3S+mZE0f5ZSEOu2iyy7cikiXGXQ2uh2QVX220IAuTsM:d0Mu3J0MnPUZ/f5ZNwi37cesMX2oT7
                                        MD5:CE422705A0C0311C1FA5D37A7DDC3AEC
                                        SHA1:7BF507351E5A22BC091CBA27EF40B16FD8815DFE
                                        SHA-256:2F64FA8551C48558BF40F114CF881FD0A6AA42075D3822734C0B0E06676E9E0A
                                        SHA-512:E6AB57EE0109EC1D3B40640ADEF7BEC878009A9F3429BD01CAC33A8ABF7BAB4FD730EBAA89352E166D836EDD0F8E6C83010B6043B454C3A95EB2A4006983E211
                                        Malicious:false
                                        Preview:...u&....2T.%.:.&......T.z.....b.....&..m...[.85.s....kZ_.W..ld.)...YW..J..<.....6.Q.N...7!.A...V.IY\.2D"bT......{..i9.g).*....S..|P..C..+'..%.=}..jh.j..agW|.[B`1...+..\....S.j......=.........;.."..7.%..J.l.~6.2W....'P1..~b...R:....1.AnO..K~x.g.^*|..he.......^m.HC....T.....vs....~jq.=..+..oiM.sf..y...zX.....7.)..@+...6;....&.7EH..w.....m6..1w.c.X\..a<..Flb.*v...Jc..,.xX.`....]SI..G....A..T..\...L...._V....d*p'.F@........s@..Y.J..p..~.Q.%.4kL..............;..bp.:.pif.s.NL.u.G.v~.u..9%H.nJ...},.l.0x...>.~....b..........X..H..A...........L;9..P......K...q.c,...>?.[S?'e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):736
                                        Entropy (8bit):7.724710795595683
                                        Encrypted:false
                                        SSDEEP:12:4kTVXX5LV1w3LyrcTNrhNX5SJAzE0F5eRy9L+Dacug6Jf29Q4l7MiDdgX220IAu/:dX5LV1w3LyrGNF12AfTeRy9L+9u9Jf2I
                                        MD5:02F0D40CEDB981D48ED7E8773E753F62
                                        SHA1:679BE6D6213D6D34B595E99D0291A8E663588408
                                        SHA-256:A670046FCB94170F0D60788EDE7B87B2A5CBC0DC6B6EE1C3AAE4BD70C618581C
                                        SHA-512:93A2FE84A4EC44FE1CABE969B3B3F77CA164A796FC03099D5F8268B2715574426700535E6A6C2D6BDCCF1DD20CE2E80CA3E0719124372909894B788A9235BECB
                                        Malicious:false
                                        Preview:(...tDM.4.....3;e<.K.O/R.!...I3ny~..$..P..5;.7MZ.$.OR..w.....A..........(.DZ1..&.22..#.:...@.e..y..<.I.<.6..Q.....H./-..K...;.O.!....8`. ..m...\......^iq......O....{G...'._ZBA.O.....W*Pu.....*lG`| .O.:.x."...*.....{..@$..).$..{,.j.k]'....V.u.H0*..-.c..y........up.#yB..?..T$....V...i4.8Q.....yF..F9...t..*B.].)..K....|.....Y=.N.;.r>z<.K@W')...iS"F]..p...!x.4...BsI.."@.h.@....K...Dw.|.WH......6....v..\Hm.ym".c..}.Z.0c:..}Ab7..........'.N.y.-.R..@......z...wI,p...o.....#P.?;Sk.}..X..u.G.v|.q./{a.A.].E.i,.>J0x...=.~....|.5.L..!.....1.....K...h1&y....../.0.^.:.&^?.2.t..FJ.c..r..5.wJf.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):735
                                        Entropy (8bit):7.75044373010626
                                        Encrypted:false
                                        SSDEEP:12:6MuWnu1mcTm1edxTGLDzZxYRERc5OdCSXWxsRVb8LmiB2EVX220IAuTsM:DuDm1ZLDzZxYRl55tx/LGEVX2oT7
                                        MD5:47E86415F76C90F5650ACF9DFE05066C
                                        SHA1:2C5F1D153735E957035761A3AE3A3737F4E0D418
                                        SHA-256:80AE73E455A47724ADE92DF75698BD24CD1C0E9CFDCF4D00DF42CB963F985EAF
                                        SHA-512:439ADEBD2D4E08DE70B1045F961B96790664ADF94B7754D0D3B128E6DE6497F3E3AC3CBD788E29DBF3B70347D8F5D779A9C414A28238DD045C8A55BBD93AD2CF
                                        Malicious:false
                                        Preview:..X..uv5s.00...)k..*..N.z.e.....WO..}.`..E;B3..3...~.+..1..c..hH*..f3?..o..o... \f.yr..8.H..I...........K..j...lz.Y..b..(....3.........yN.1...8Y.#.. ......H/..`...r..h6....4e.;.nf.....)q.0Y..{.I.'........%N.2..O:....A.P?+I.e..C(%.V....}...L....J..O....-..|.2...I.8.r6d...5....o=.Z..kM~|...Ir?...+/....=.Fj8.a.@.m...E#.......|g+...+..l.I..C.R.[P|m..V.1k...g6......5.[m...g...|.......W...p.'t....=...(fH...1.f.=..-'6.PS{s,.jW.Wp*.......@........b..PO...T.......{...`.r.Q..s.u.FW.sNt\/..t.FJ...},.l.0x...>.~........H.1e.....A.}s..........].N.S..."....:{W@.KT...-y..x.aY.e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):735
                                        Entropy (8bit):7.724542247603903
                                        Encrypted:false
                                        SSDEEP:12:PP8xi43UoPCeBqdg7Vh2BeDNbpOZ+Zuk8c9jRH8OGYaKus+lX220IAuTsM:ss43UoAi7CBeRsZAmc9jRH8O6P9X2oT7
                                        MD5:0A48AAD88F877EF70766739F226A24E9
                                        SHA1:82D7BD84917B6F26373549F10906B9B95892FC6A
                                        SHA-256:017801A091DB2EC32A1CE7B987846E77F85C1A59AEC28F28AD9ABF7FB55D099C
                                        SHA-512:448177698A8D924F1329CC430F0D84A399F2E3ACD56C73F20445746D48EABA69587F64433F5954DAAFD85C2E9FF4A278E300AE1C39C1483AE278D2AEF11C65F9
                                        Malicious:false
                                        Preview:.Z..."..Y.r...0w..2..z.).Y,w..C,...8.t+P.n.....wl..0......0....}..b.............&V.U.q..>.S....."$..U|.3....W...h..+..p...mR..f...^..R...h.....v....KO"...fHLS~]...t...#...l..%0...Sn.Ti...F@.7...|9.U(.4....C>..2.h...~...qC.iN....kS....8..)..+|..v>.....R......-83s..))%>J.k.........[......y...u1i..^5.+..0VF.v..p.t&QT..:.Z...mf.n}j..`.TaY....b\.e.?Z.........I....|.&7&............k%.p.fp.O..{r.7.\.T+.a.Z..V.......#....^..U..Q.F..|../...Z.\.lV.......2.....Q...D......}f.s..u.G.w.^s^(.f.EZJe..},.l.0x...>.~....qqMf.t..fy>>.8I.{.3.r.J|X...xV.v{...?...g.$.q......[.B]...\e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):736
                                        Entropy (8bit):7.7096298008080915
                                        Encrypted:false
                                        SSDEEP:12:ATv3aDnn4b+QGrku0w3ZTJY9oSRKJfUI82q0rUTtscX6yhARniRXON8ySPDgX22j:A74n4bsrgwJJUvYRUI82fSN6yOSXONSu
                                        MD5:844469DF40E7FA22991F2795860BFA41
                                        SHA1:D4DDCCFE8E4A9DAB2EC95F9823891D039FC9BC63
                                        SHA-256:DE5FC9E990E7275ED6C241E2BB7FD3255C77E088131CB3BAE8070189EA7B5A16
                                        SHA-512:8457782C739589A0E1D5F16D6243E0A2396BE17E418CCCE1BA0F781BD1E7DAE74A306F31EB9AC73AF47E8F2AAEDC966095509CD213B99CB0E5D38B707B878523
                                        Malicious:false
                                        Preview:.w.p....S.,......^D...k...`...].W"y......1[;..........-.,.q....$,..!{...w....A\,....#.0-B.....PQ.je......:..f..>=(.f.p...1`.....f..G.b.#....;....J...|>..'.*.VUi.d.......r.3...J....w...O...1..X..[.........XiD.P.i.s.Q.....8o=..=.....u%=-...i.N.....<./.5..........w.~.].ZBE ...B.=...d.<.%.rs.=$..Y.#.].1|.3.. {...LV.9.|p....eA..lVf.MV.....u....=;....i.<,.(.<.[...N.....W.Mi.w.<.. [..4.:.(-gi ..J......[.W._Q...-..7..-B.C....6.=...$..y.......D.9...N.X..E1..m.A.....KV.6..X.h.c {...4:...u.G.vr.p.#WDFM|....i,.>J0x...=.~....)#...y.....y.......1Pp.\..E...Z.........K.c.`|.*m<..+.G.....8(..f.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):735
                                        Entropy (8bit):7.755579019236623
                                        Encrypted:false
                                        SSDEEP:12:00CJgU2NZgG58N7IIN09GHr0/jMh+K5ac4msq+ROphelABYy1y0AwCg7jD4RRX2y:00CT2/gGGN7IG09GHrEa1m70yfnQkRR/
                                        MD5:3E68B385CCF455C5903EAF7ACF347650
                                        SHA1:E470A19A38F188CA6E7CB250AFB77F0A7BFA9326
                                        SHA-256:206ED49A2E33063FE8AD3D93EE74512DCA724E583943CF3BA6C2D98B84187A5E
                                        SHA-512:0D0F1B94E3FC464B4ACCC0C6CEA3B964F1F3151B955E8A244B1C5E29F09F7A3810E72182E4CE4EFE46DD2C7A3C037023DED088133B7C40BA7971A6697CEECB46
                                        Malicious:false
                                        Preview:..fz......Vl%.......0......az"...(.~....|..m.'.....j.,M.\.....b}g+{.?..=..._E....&.r.K.0...F.."..q.#......F"..o.N..... p.=d.AcwP.f^... ,PR..2.c..P..9g.&Fwm.....n.......f.,..$7?6n@.z...S).h.i....Wi..M...t...&......(Z.D...].dvI7zp%.$p..........>ED....^.J.}..<Jr..).....Ir...0...$;. a..O...0..M....<.I....#....zt..j.....(h.U.M..D...Z.'.ej.3^5Q...Ws.....y...N.98.V4.{..'..S.K...|92i...8....,Ul..a.4W..Z.j.7+O.B.n.hnz.T..o?..Kl.z.B..Q1.k[@.!...:|..PQ0...b._...k.....iH|.@.C..6.Qx%..nQ...u.G.vy.Op..[HX~....},.l.0x...>.~.......)...G..E...u.~.E..F..257t.!..r.y0....X?..+...]....Nw..@3.e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):735
                                        Entropy (8bit):7.749138662724701
                                        Encrypted:false
                                        SSDEEP:12:Y+GJleE/ql359ljgW0emjmN7TFbGaWgVZTO+vFTjoVbWVdlnLPOKQBRX220IAuT7:Yn4eovlgW0emjoFGaWYZTOewVbWL1QBp
                                        MD5:3D22C87EE12F54784B28AE6BDDA66F75
                                        SHA1:C3C8A534B5C86693F165D74FA6D0140C8969F45A
                                        SHA-256:FD46DFDB5724F0FF86BEC6FCD02C951AD9EB1B345BB71178476813B62805EF7F
                                        SHA-512:B840735B5D793F43C4E5E7D08347EADDCB94616AD0122C4213CAF05401D7193C4811F1BE73274BC66C8B32388B7186BC08AFC6CF616CAF6AA5F0C990750F889F
                                        Malicious:false
                                        Preview:d..k...K.`ug....L......B../...h.....P.#..T8....U..Ek...=-...0V.vA.........Xs]...G.B.T>..;...Cs..@.7....&:...p.`....Nh.H.`.L$f./..V..I.V#.......r*...n.....e....h.{.b..P(..raw....b.d.. .....p .zN........ppj.s}.....hZ....@=a&..j..-Qn.r......f.......4.0...'v...........W..t..K..w...1l..#A...x..A.U......B[5...i....b....4....b..........T.....<...B.....l./.."..7..w.....3.n9.....Y~x...{4..W.g..1h.s8.Qh.y.=.....J.A...`...#..>>Fv..l.?X.Q...K..........^F.Ia.R5.^)....1|Og...u.G.vx.q...b.e.U...},.l.0x...>.~...a.=....YF.L.........>/2.@.&...q._.(..%.P...F....c..^!........e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):735
                                        Entropy (8bit):7.7388450990581825
                                        Encrypted:false
                                        SSDEEP:12:/ITRvoTKfnGoeZUZoGKn6hm5zyFOVavbzuftOaeznkjm9zEnIX220IAuTsM:QNv9fnNevGK54zutncCnIX2oT7
                                        MD5:EF3066392FA6D8AFDE5D88A663D0CF84
                                        SHA1:CD0EABC4F5BC476F7625FC075F2B0E36AFA77C25
                                        SHA-256:36FDF033531E84766370F1508B109E9EB9F280F4969FFA54BF958113FD2F6413
                                        SHA-512:AE1BA18F9837E4024E0E02AD31C609885D21B1D6AF0374D5CDB93AD147A9DCEAF645DA8D0AF2BA59118A19F6B884FCFF1C7712A3B51F9D15ABDE19F29800DC0A
                                        Malicious:false
                                        Preview:.9..........Cl.q.8.?..Y.5.U.2.]..X.)...T......e...0.....u.}..T...VSf'.>{2..Eprw...z.,.I.a.'.....p...R..2.E....I.I,T:.Y...]...l.....xv]3.}..83TM.`....o..0E.A.F...^.x.\B...z..|.I.>i..D.?..C.mb.Z.5....$/.....D..T.Dg~{.>T.......`S.....J..;R.o.O..U..C...G...#.....J8.'^.2..A..."V......BB..O./b..e.|Zm........I.?#d..rc.r.l.... .p. y.+.(..s..Q..iW`..S.e...kL.Y.3\.?..H...'a."...y=.t....yb...3.....8.k|-.3.Wa........P~...Q.l..?r.-....:.nBW...a.....-./V&.E..1..........V.......uNw.ja..u.G.XOjNq...D.[J...},.l.0x...>.~....."k..6Lk.dL....X.d..F@.'.....p H.........Cr...~,......=O|L5.e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):733
                                        Entropy (8bit):7.775245571550501
                                        Encrypted:false
                                        SSDEEP:12:gznEEwqZwI0hgxXY8lnW5pKTtoxww3TKb2WUHlYmEkYSfLDOyepFVX220IAuTsM:aEzB+Y8lW+TtujHWgyk//eDVX2oT7
                                        MD5:1F2BBE040B50C76BD9526D6FB9D29FF7
                                        SHA1:262A13A19657572FA80E2059CBEA05D5CE5740F1
                                        SHA-256:DF333F843E869F5025D00B1C54B48F0D24D8D5D24D86D75C0F1BB9B7C81563A8
                                        SHA-512:7D7DA0CC689978C91D73B560F7B72D3DB5CE85CA14E39B5EE16C2DF19E1A51C86B40AC0525C0731C4ECFADA16F26EABF3DDD37AF3E35D592D463271222CAA97E
                                        Malicious:false
                                        Preview:.,_v..e.......tU...F>.P.~.....2... .w.s..L.m.t9cJ9.I..94/...^.#...S4RV..D.q?!U.8u....F.zI..Q..G.....j.?.\......?;B..4......O6.....Z....n.Mm...#-:1..:..<.I.=.cI.A...:..2.^8f..ZE.U3i].r..........)..*..K..~'.~.(;J.......b..oC.|....u...w...Oyq......:[.,5.c......!.9. ...Iq..F..6y._)!lM.ol..C.G..%.Zh9n?..(.....o.5.+.K;..o.......h..#ZX..5.......<....e..0e..F.F...X......,.............4 ..pT..Kr.LE.:.....p.........A.F.......t..H.._...+..D@.....7.z.>V.{.V.d..]...P.1.HQ..;OL.lcO.t....x.u...8yR.H...}~.>.0x...>.~..}.W......N.9...0. .ea_+.p.O!R.+....._..v...p.e...?S^...&L..q.1.c.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):738
                                        Entropy (8bit):7.688178114720525
                                        Encrypted:false
                                        SSDEEP:12:UvWMJHU1IEvIaBWjOgWHSIfLmJV8rz54ZPEsLFZyBukUf37H9Kx5yX220IAuTsM:UvXU1ZvIKg5/Jq5AEseB67H9KxkX2oT7
                                        MD5:2BD7BC701EF4AEA466295CB7B4F79163
                                        SHA1:67FF2FA3DAB8A416603E70148A60DB049AC4468B
                                        SHA-256:AD3B4E20ABBC97D497CFFC5FAF88648D9D43FE1058711E4A7A6C83883662DBBD
                                        SHA-512:BE72241920A9AFF10F8E291069A90AAF72BC0A27608C9D90684ACD492EF84DC599293C21290423BAEE0C61D9AF389B792AD21B46C109C2A66976EFEA96B03AE5
                                        Malicious:false
                                        Preview:.V.oTU.T1....*Bz.... ..@.....f.}..X.KiY...%z./.6.J......y(....K....$....1.P.#.J...K.ofg4....".9g..p.c.;...{.5c.].....4..[.0......5<.&Nh..H.........Y...V.,k.Ga.....H..m+....a....(...`.W...../..3.....}w.....!..i..(.GL@..U.K.....3{...f.X2...Y....N.zE9x)..8~.....(.....j...T........m.(K.%.......~(........b._%...a........C.....KT.@...vT@]..[."..["....E..~/....7..M.Nz.TOS.F y...c........<..x5....-.R..a.....<.....n...=9.lK.j}..`xi4.L..:...Ln]../z....I*.t[..e.l.h.a.1..?9.6....u.G.v|.q...[E^.F...},.>.0*...>.}.......].{+.....6..Q..3........eO.w..'..rq...29S.j........A_...3..Ch.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):737
                                        Entropy (8bit):7.777983745508037
                                        Encrypted:false
                                        SSDEEP:12:oEqf6774sspyfv/TCPLZXZ9aTStg/c5kkAM+sHdZFyKSgLy779LFZlNf6J8X220y:lNXTCFp9a6gU5kTs9XPS1lLPSJ8X2oT7
                                        MD5:593A06906F34E2AC142DAB05C7DDDF1C
                                        SHA1:8C0B5E2FB5ADA8BC80D4EE15CC2C44AC25190466
                                        SHA-256:253F44CD59DFD5188766B066674E1C2FA66CCC23D80D4CAB0167EBD225C36DD6
                                        SHA-512:90773C08971F81053C784AFE0CB9DC3CCAFC26D1409CC480A1D9CCA36849972B37BF877BDC7749A9D90353AB8D02B47AB27FF8FFF2C94D73759F0621B420BF6A
                                        Malicious:false
                                        Preview:.0..|.8..-.?.* ..Z..'..\O...>v...R..Q)..\F....5..x.7,=.\,.......".....o.v..z.Iu.72......^.Z....B.;...d...n.f....>.a...D.*.L-.(.(...r.kP.o.z!..R...=9..+.D5...zS.1.`...0.|o.M#....R.7..q...bP.]>J...G......"..9.Q73q.I..o.4(....^.qQd.w.....G...T"..K...{..%Tw....~Dj..F...<i..0...O.....CKV.L.....O7..a.O[5.XoF8......L...cWwv.J......oZ.."..M....?5....+...C.&pB.!Zu...Z..".Au}..S...............8.....(.M..I....S.N..._.f..%;F*...d........F...p...V...{.].y.q.x.W....4...u..uJ.D......u.G.v}..W,.emiQ|...}9.>.bx...>.~.....,.y#NOC.*.o.a.~4.7=< .L..Q.B.x....:....>.]...8.)..w....G..|.g.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):734
                                        Entropy (8bit):7.72110000008007
                                        Encrypted:false
                                        SSDEEP:12:/F91AWWLozTEXHAJ4YoQcWsn+eN7X+UQARZnw5Tq1WkFB7Vlpo35gX220IAuTsM:/F9SDXHAJlC7+eAUfRZnw5Tq1xB7muXv
                                        MD5:68EDE90FF71777CA27C0399803A1EE13
                                        SHA1:137B724C5F216C513B927D9BB5C7CD5540530CC9
                                        SHA-256:6BD425183329BD70774452EAF77E442F651B71DFC482A39F64066806477CEB0E
                                        SHA-512:473371321EEDF6E0DC7DED546CD7F57C7BF90CBB3F1AC4A488924CEFFC42543331C99C536B2FF6930844206D46747BEDD332AE26FAA7AE1EEE1BCDD6FCB86AA8
                                        Malicious:false
                                        Preview:.l3....5...}..v.;:he...j..?.."....&.e...s.c..pJ......lU.q....m.........V.....,ast;T.i#.E[....p........$.d.z..=!j;*..$]e>`.]E1....T..4-.'au..7./.\..~..du..-..+Jp...R.....O.......IN....>....eH..C.0|..P.s;.u.K.Ag.M...EP.;2.M0e...4[./...M.....K.H....Q.Aq].#.wZq..KU).7.v...Z.V.............#.)....j.t...o5>....Zw.%.R.[I...o......@3......$yL..\Y.pf...,....F*...^'.4....Wd1K..p*....f.....1q..S...n.-......}w.KA....T{."...../.Kz.<u.yn$S3.o{I..&Y...Iaq.!...l.Y]_....J.......G...i..0...%.u.G.vs.G...b.e.J...},.>.0x...>.}....+.).........B....i........>..s..{..{>.M...8..u..N.....d.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):735
                                        Entropy (8bit):7.740143899660062
                                        Encrypted:false
                                        SSDEEP:12:U4L/PEn8PiRwW6+shnHCV6Ak1s2CO0TlVVH4cm5z/IX220IAuTsM:j/w3R/HyHIkclVVHfK7IX2oT7
                                        MD5:D2235D50CF125D64C5A841A95318437F
                                        SHA1:E18141191E5D496C43C0F264EC63A978D9BC0E76
                                        SHA-256:A4268D5DECC9A9FF7552F09208F752342B59B25C1F33B8A6E5BE4844F98BD1AD
                                        SHA-512:1D96A95801A0308CCC345AED460B11A6DF2C47F74C7406661B119BED98A2A76D34924D800200E2B30A1FE5F7528267310A1BFA1DD492958A71FA19C0FECB30E4
                                        Malicious:false
                                        Preview:...2.........\..".|&]...+oF6.7a.j..R..$.g.~.7 ,...McY...g.......{w.LX...T...2.f..T......!...b........... v....H.Z..9..@(.@.j...qd.]>..Oq:.l.q% Mh.<.....O...lr~.f8<.Xn.3..Qx.C....(...Zk.N.. ,sek......]+.H*..V_..._....}5l\..E.f..9d.kH............,...kn.r......f.'.>.......u.].. ..+.1..:p5.u.....0...c{.M5g....Q.>..'..@..BEf.\.iC.,.bo....xg..li.$MI..(b.kG.X.a. 6.`...?GA.hf.1HR&...K|.!...=.........JS4..vl.F....;D..(..D.s`.WH8PDh...N.^.../0.........z.(zJ..B.m....F........\ W.4.;.u.G.v}.w...mEhz$...},.l.0x...>.~...k..2y/...?... ..y2.4..`...5..8.N....Vl%.=..k.0.a....A.gHk...e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):733
                                        Entropy (8bit):7.716416638729885
                                        Encrypted:false
                                        SSDEEP:12:gv7DFs1/NiNUmq9nW24CfTi32jGlcERm5DbE9S3B8X220IAuTsM:0DWFJmCWme44cCubT3B8X2oT7
                                        MD5:23E69F13C6A83789AA20B4BE4DF077A5
                                        SHA1:B13626D13DB976CBECD8BBEB14A302B41B623CFF
                                        SHA-256:0B95285CC6931B3B27C44CA1B0F64403DDA6CAFDE7167D91A3B42663B6CF7021
                                        SHA-512:037A57E4D1A7EE10F5994F91B4CC8E3BD8209153CA5C53EA67F792A46FA00F2802635410B13E9F089C97491A3FA15F350900708CB9FA7CFCC4B465B328EF52DC
                                        Malicious:false
                                        Preview:..u..v..h....E...n.a.4w...".Ba`...yX}.Q?.D.E%...Z.._O.K..o..e...l..$...RA.04....}.s.|..w7..zdn#s...5.M.....yw.*..8ZH..q6.k.....Lr..i.Y.".....A.y.@);R....>.....G.6.W.....b."C..F9.{.yq...H)...P.BJg.y@}.....6..W...BQ..8...&....\i.u.&?..h...x..*....Z.....k%.E..QH.m.?.su.k.......T.Z..c..Rh.....C.%.C.u.....h..(?...)\..E.+.,...E.r....#}..=-...b.h....^6....6.M..c..o.CQ...j....:...5..Z.7s..6trp..."k.Ti.g.lq...bf ......9..6..-c.N..<.E...].5B....N2|... .X..b&+...3W.r.....%.@..$.j...`..u.G.^Oa.~..\.THH...}~.>.0x...>.~..H.Y.1Ro~.?OM....r...x.z#7.I.....c..E.T{1..WO|.....]..}..W..yc.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):735
                                        Entropy (8bit):7.759188536015506
                                        Encrypted:false
                                        SSDEEP:12:/SfwRlj/QUhjV4v7rg6D8/y3ePjYNuxtSD/Y9dbtpgGQPT5FPXunOgPJX220IAu/:jRljIUhJ4v78q8CePjxxtSDg9dbAPT1c
                                        MD5:062408ECE8AFA6264EB15B65553762FB
                                        SHA1:20665C5DAB38BDA51C4F15128455CC22EF38BD26
                                        SHA-256:B5D86DCCE55E95DA0532C3DF6FA51E4BC13BB2E9E6FA2290DB3A2BBE0254E7ED
                                        SHA-512:4DF89358F1BD73E16CDB7359F72CCB6BC2ED8C8E3215598655059C7181EC3FAC142F30127C9F6AEF4FF600194F4B2B7E911791627091CBB0B25607686B07304F
                                        Malicious:false
                                        Preview:S.....'Mu..4zI..v0.d../..=.7.:.....r...y.......K.4.N..Mz.....#c.4^yL.('..k.j.......j)h.G8....'..D..q{..}..F......}'.\...mk....|D...%..1..hO.c6.......y......^....Q.&N&.F.ye.........U.dl..l.*....W"..9...<.u...,.u.n...r....Y.df...e.......1X..z......~...e....a.{.[sT...%.R..1z..3E....B.....+...[.In.].,..D.|2...[.V...............<W.T"...u=.....q.>5...,a.08.c..;-......(.@.c...M..3v..@...^..'..&.#..<.9.J.4 ^#B....................."S....(;....pDO.sO..dN..^...j....]av..........u.G.v}.OC.Zc.Ez~...},.l.0x...>.~......;m>.wq......aoY....HN.?.5W.<i.M....W..m2n.....'.X..]U.\...[&.e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):736
                                        Entropy (8bit):7.726206271764782
                                        Encrypted:false
                                        SSDEEP:12:vHkZS2YMCHXOlOyvlyNqjF1tFASUpJUidVdSiG6gX220IAuTsM:MZ5YMSE5FGJ1h77gX2oT7
                                        MD5:88E86F212A335B2DF5DCC4680DC95282
                                        SHA1:D0AE117E1E2970AB00377C912DC9329FF9A7912B
                                        SHA-256:A962FB82458012E5DDE8C56D61BCCA64D57A994F756A67561FB23932FFFEEFE6
                                        SHA-512:2B21C4971C880D4B0D4622B9F2240D095A0579A39D4B588D29DBF71CDB55E310346ECD3218DBB0D136DA24E293EF6639ED1807D18D7B91D3E1351FE215DBB436
                                        Malicious:false
                                        Preview:.4PO....+..9.*W.?n.g..N<..p..e.j.&I.s8.k. n:. 2.....`....+.=|.QM.:....\Jo7..&....}.....:O..P. :...i.*...GWo....q.=.cR.U.I<........{..vZ...o....T..O...q..Kr..M.K....9.....J..k6=..%..%>..1U"...y..._....Z..E.j.......[....0Th.q....Z{..@...T...3.6*..kB....o.\.......|.a..e.E......f..Y.....5...* ....:....Z.z>..V.*m...v...'......S.7.Jl,4.......h.....i..<.>..0Z{=......3..o.gT....6.]w..t7....U...o..}4.%...wv*...,..).i.c...n..<f.Z........a.@[`@..1:...e\..l.K..E..P....ao........u.G.vy.{./{a.A.A.E.i,.>J0x...=.~........x...7...$..A.(....H.(S..mcC...N. .iI......W(...,...(.j!..f.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):734
                                        Entropy (8bit):7.736113235894547
                                        Encrypted:false
                                        SSDEEP:12:8En6uFOY0tBempMGfYsF6hKDhoQUqOW/RLfjIKd9zgX220IAuTsM:82yB9WsF6wDhMqOWZjUmEX2oT7
                                        MD5:E55E4F0307F3F34AFEA2EE9533477052
                                        SHA1:712F3C3BFB897C9E7799CC31B76F64EC2977538D
                                        SHA-256:D725C8153CD89ED4C97F1DCA31B0FFBB59DD8A83F5E94D011847EACEB75D613A
                                        SHA-512:ABD51AB24EFE39BEDEE3C26AC2EC7AF3F3E4DB009F8E128E472D467A71DE869DE4AF514CD129CC253C98BA147A444E79149A1530F57278626AFF14F55F593980
                                        Malicious:false
                                        Preview:.D!.`=ti..).P........._*T.t"..^1..G...........2.f...W.'..^.w%.{#....<g.X.d.(.U........8B.K. .-i.....S.;......N+.L...4b.h.C\...mi...........wgu'...2. .......I.?.:%.=.O.)JYDm.,.Z.!.y...\..C..w...a.dK.....|%.m,.@.....b...B.w..K....C..L...l....kS_.......s5...o.6S.gs\..}.Aq... .~.u.K...../......-....$.(?.....,1.K.gy.(...&..>.p...TN...j..:..I..D..r.O.y#h.Uv.._...z..H-.Q.h..... ..L).o...4..b.>......7.. -%h....K........H....[.g......h..}w......R.+ej?CK...1../....}1.,....`..u.G.vr.Kr..fmg|J...},.>.0x...>.}...'.2i.......Gh.wB..._E.....G.,.....2H7..b..,)r0m...RM@.<...d.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:ASCII text, with very long lines (1984), with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):20971520
                                        Entropy (8bit):0.015572280617573014
                                        Encrypted:false
                                        SSDEEP:768:mLrTJjFTVpxs7s++T9+XIZ8M0SM8BYf10hfe9:mPTtFT5s7ZvYZ8M0SM8Be1Gfe9
                                        MD5:C8123C26A91489FE55E5F263E66D9C7C
                                        SHA1:1D5B975B9CC7D373DF5967212F3462B8A3F6BCFB
                                        SHA-256:583D0F0E9A32D5229834FBA23BE0A209F54AD86D54B946DA8CAF34D61894627A
                                        SHA-512:D046E066A0491ACB15D60D268EB984D02BF0F05ED14EE9FDDD3A53F9C10153F4AE89262F239CE13641390160547D2B08D53AC56DF95A3BAF9B23871F3E4CA8EC
                                        Malicious:false
                                        Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..07/30/2024 17:31:47.213.ONENOTE (0x148C).0x1754.Microsoft OneNote.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":19,"Time":"2024-07-30T17:31:47.213Z","Contract":"Office.System.Activity","Activity.CV":"6xjKG4yuNUGaXh+RngnWQw.6.1","Activity.Duration":149,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...07/30/2024 17:31:47.229.ONENOTE (0x148C).0x1754.Microsoft OneNote.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":21,"Time":"2024-07-30T17:31:47.229Z","Contract":"Office.System.Activity","Activity.CV":"6xjKG4yuNUGaXh+RngnWQw.6","Activity.Duration":12606,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.F
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):20971520
                                        Entropy (8bit):0.0
                                        Encrypted:false
                                        SSDEEP:3::
                                        MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                        SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                        SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                        SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                        Malicious:false
                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):65536
                                        Entropy (8bit):0.42999452171831243
                                        Encrypted:false
                                        SSDEEP:48:grmMghfBo7ej9GU6EepOlF3S2BAOCcNafqrNsylVlsolDPZ1XKDwW:grOfBiej4KbmckO8/8
                                        MD5:F8D38A993DC6D7FE139888BAB89AE485
                                        SHA1:1B3847B405408504B2CBD21969D0CED08BFDFC70
                                        SHA-256:35DB6A774C975E05208530B90D093509969506A56E69D07F82B391A9590101BA
                                        SHA-512:2D54664829AD6A670EE9BB522C1DE15DD9D8983030437B616FDC2F4300A286C73C8FB4F4B83BF73F0D96EDAC7D6E7CB95DB4F3A975BEF3008E3BF015A7F82E66
                                        Malicious:false
                                        Preview:................................XM...p.. EMF....p...............l.......D........... ...............?....f..P.r.i.n.t. .t.e.s.t.....%...........%...........R...p...................................C.o.n.s.o.l.a.s...................................................?.......................................................kp..?.v&.u....l+.v.&.u(......... ... .......?..s(....M.................u....P>.....v}.kp....D.?... .......?....v.(........?....vx........v...u.......v......3....u@.?.......?....v...u......3....udv......%.......................................................b...........d...................................................T...T..........................@?@.@'...5.......L.......................P... ...........................................................T...T..........................@?@.@............L.......................P... ...................................T.......'...5..................@?@.@'...5.......L.......................|...L.o.c.k.B.i.t. .B.l.a.c.k. .R.a.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                        Category:dropped
                                        Size (bytes):68633
                                        Entropy (8bit):7.709776384921022
                                        Encrypted:false
                                        SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                        MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                        SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                        SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                        SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12824
                                        Entropy (8bit):7.974776104184905
                                        Encrypted:false
                                        SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                        MD5:2628353534C5AD86CBFE57B6616D46DD
                                        SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                        SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                        SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                        Malicious:false
                                        Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                        Category:dropped
                                        Size (bytes):3428
                                        Entropy (8bit):7.766473352510893
                                        Encrypted:false
                                        SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                        MD5:EE9E2DF458733B61333E8A82F7A2613D
                                        SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                        SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                        SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                        Category:dropped
                                        Size (bytes):29187
                                        Entropy (8bit):7.971308326749753
                                        Encrypted:false
                                        SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                        MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                        SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                        SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                        SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):99293
                                        Entropy (8bit):7.9690121496708555
                                        Encrypted:false
                                        SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                        MD5:EA45266A770EEA27A24A5BB3BE688B14
                                        SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                        SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                        SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                        Malicious:false
                                        Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):5136
                                        Entropy (8bit):7.622045262603241
                                        Encrypted:false
                                        SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                        MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                        SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                        SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                        SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                        Malicious:false
                                        Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):40884
                                        Entropy (8bit):7.545929039957292
                                        Encrypted:false
                                        SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                        MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                        SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                        SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                        SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):41893
                                        Entropy (8bit):7.52654558351485
                                        Encrypted:false
                                        SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                        MD5:F25427EFECFEE786D5A9F630726DD140
                                        SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                        SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                        SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):25622
                                        Entropy (8bit):7.058784902089801
                                        Encrypted:false
                                        SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                        MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                        SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                        SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                        SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                        Category:dropped
                                        Size (bytes):3361
                                        Entropy (8bit):7.619405839796034
                                        Encrypted:false
                                        SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                        MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                        SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                        SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                        SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):79656
                                        Entropy (8bit):7.966459570826366
                                        Encrypted:false
                                        SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                        MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                        SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                        SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                        SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                        Category:dropped
                                        Size (bytes):12654
                                        Entropy (8bit):7.745439197485533
                                        Encrypted:false
                                        SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                        MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                        SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                        SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                        SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):55804
                                        Entropy (8bit):7.433623355028275
                                        Encrypted:false
                                        SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                        MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                        SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                        SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                        SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12824
                                        Entropy (8bit):7.974776104184905
                                        Encrypted:false
                                        SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                        MD5:2628353534C5AD86CBFE57B6616D46DD
                                        SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                        SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                        SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                        Malicious:false
                                        Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):53259
                                        Entropy (8bit):7.651662052139301
                                        Encrypted:false
                                        SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                        MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                        SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                        SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                        SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                        Category:dropped
                                        Size (bytes):242903
                                        Entropy (8bit):7.944495275553473
                                        Encrypted:false
                                        SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                        MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                        SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                        SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                        SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                        Category:dropped
                                        Size (bytes):84097
                                        Entropy (8bit):7.78862495530604
                                        Encrypted:false
                                        SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                        MD5:37EED97290E8ECB46A576C84F0810568
                                        SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                        SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                        SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12824
                                        Entropy (8bit):7.974776104184905
                                        Encrypted:false
                                        SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                        MD5:2628353534C5AD86CBFE57B6616D46DD
                                        SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                        SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                        SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                        Malicious:false
                                        Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):95763
                                        Entropy (8bit):7.931689087616878
                                        Encrypted:false
                                        SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                        MD5:177DD42CA99CAA2CCBF2974221680334
                                        SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                        SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                        SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):34299
                                        Entropy (8bit):7.247541176493898
                                        Encrypted:false
                                        SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                        MD5:E9C52A7381075E4EBC59296F96C79399
                                        SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                        SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                        SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):515
                                        Entropy (8bit):6.740133870626016
                                        Encrypted:false
                                        SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                        MD5:E96BE30D892A5412CF262FEE652921CA
                                        SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                        SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                        SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                        Malicious:false
                                        Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):40035
                                        Entropy (8bit):7.360144465307449
                                        Encrypted:false
                                        SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                        MD5:B1DDD365D87605F96D72042CB56572F6
                                        SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                        SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                        SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):347
                                        Entropy (8bit):6.85024426015615
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                        MD5:78762C169F8B104CB57DFF5A1669D2DF
                                        SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                        SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                        SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                        Category:dropped
                                        Size (bytes):3009
                                        Entropy (8bit):7.493528353751471
                                        Encrypted:false
                                        SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                        MD5:D9BD80D40B458EDB2A318F639561579A
                                        SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                        SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                        SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):647
                                        Entropy (8bit):6.854433034679255
                                        Encrypted:false
                                        SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                        MD5:DD876AA103BEC3AC83C769D768AD39FB
                                        SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                        SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                        SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                        Malicious:false
                                        Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):15740
                                        Entropy (8bit):6.0674556182683945
                                        Encrypted:false
                                        SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                        MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                        SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                        SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                        SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):32656
                                        Entropy (8bit):3.9517299510231485
                                        Encrypted:false
                                        SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                        MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                        SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                        SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                        SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                        Malicious:false
                                        Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):52945
                                        Entropy (8bit):7.6490972666456765
                                        Encrypted:false
                                        SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                        MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                        SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                        SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                        SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):136726
                                        Entropy (8bit):7.973487854173386
                                        Encrypted:false
                                        SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                        MD5:4A2472AC2A9434E35701362D1C56EDDF
                                        SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                        SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                        SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4410
                                        Entropy (8bit):7.857636973514526
                                        Encrypted:false
                                        SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                        MD5:2494381A1ACDC83843B912CFCDE5643B
                                        SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                        SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                        SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                        Category:dropped
                                        Size (bytes):59832
                                        Entropy (8bit):7.308211468398169
                                        Encrypted:false
                                        SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                        MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                        SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                        SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                        SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):53259
                                        Entropy (8bit):7.651662052139301
                                        Encrypted:false
                                        SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                        MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                        SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                        SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                        SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):33032
                                        Entropy (8bit):2.941351060644542
                                        Encrypted:false
                                        SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                        MD5:ACF4A9F470281F475EA45E113E9FB009
                                        SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                        SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                        SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                        Malicious:false
                                        Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):59707
                                        Entropy (8bit):7.858445368171059
                                        Encrypted:false
                                        SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                        MD5:47ADB0DF6FDA756920225A099B722322
                                        SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                        SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                        SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):40884
                                        Entropy (8bit):7.545929039957292
                                        Encrypted:false
                                        SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                        MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                        SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                        SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                        SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):65589
                                        Entropy (8bit):7.960181939300061
                                        Encrypted:false
                                        SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                        MD5:8B48DA9F89264D14B83FF9969F869577
                                        SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                        SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                        SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                        Malicious:false
                                        Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                        Category:dropped
                                        Size (bytes):24268
                                        Entropy (8bit):6.946124661664625
                                        Encrypted:false
                                        SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                        MD5:3CD906D179F59DDFA112510C7E996351
                                        SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                        SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                        SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                        Category:dropped
                                        Size (bytes):27862
                                        Entropy (8bit):7.238903610770013
                                        Encrypted:false
                                        SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                        MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                        SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                        SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                        SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):55804
                                        Entropy (8bit):7.433623355028275
                                        Encrypted:false
                                        SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                        MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                        SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                        SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                        SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                        Category:dropped
                                        Size (bytes):70028
                                        Entropy (8bit):7.742089280742944
                                        Encrypted:false
                                        SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                        MD5:EC7811912ACA47F6AEB912469761D70D
                                        SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                        SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                        SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                        Category:dropped
                                        Size (bytes):11040
                                        Entropy (8bit):7.929583162638891
                                        Encrypted:false
                                        SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                        MD5:02775A1E41CF53AC771D820003903913
                                        SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                        SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                        SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):19920
                                        Entropy (8bit):7.987696084459766
                                        Encrypted:false
                                        SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                        MD5:1BDAD9B3B6DE549162F9567697389E1C
                                        SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                        SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                        SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                        Malicious:false
                                        Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):32656
                                        Entropy (8bit):3.9517299510231485
                                        Encrypted:false
                                        SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                        MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                        SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                        SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                        SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                        Malicious:false
                                        Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                        Category:dropped
                                        Size (bytes):2266
                                        Entropy (8bit):5.563021222358941
                                        Encrypted:false
                                        SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                        MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                        SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                        SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                        SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):11197
                                        Entropy (8bit):7.975073010774664
                                        Encrypted:false
                                        SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                        MD5:DDC3CC30794277500EFE4BC6667EC123
                                        SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                        SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                        SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                        Malicious:false
                                        Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):47294
                                        Entropy (8bit):7.497888607667405
                                        Encrypted:false
                                        SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                        MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                        SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                        SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                        SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):25622
                                        Entropy (8bit):7.058784902089801
                                        Encrypted:false
                                        SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                        MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                        SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                        SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                        SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                        Category:dropped
                                        Size (bytes):3555
                                        Entropy (8bit):7.686253071499049
                                        Encrypted:false
                                        SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                        MD5:8A5444524F467A45A5A10245F89C855A
                                        SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                        SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                        SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                        Category:dropped
                                        Size (bytes):4819
                                        Entropy (8bit):7.874649683222419
                                        Encrypted:false
                                        SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                        MD5:5D6C1F361BC04403555BE945E28E53FC
                                        SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                        SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                        SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                        Category:dropped
                                        Size (bytes):140755
                                        Entropy (8bit):7.9013245181576695
                                        Encrypted:false
                                        SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                        MD5:CC087700C07D674D69AFDFDA0FA9825C
                                        SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                        SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                        SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                        Category:dropped
                                        Size (bytes):59832
                                        Entropy (8bit):7.308211468398169
                                        Encrypted:false
                                        SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                        MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                        SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                        SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                        SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):15740
                                        Entropy (8bit):6.0674556182683945
                                        Encrypted:false
                                        SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                        MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                        SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                        SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                        SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):67991
                                        Entropy (8bit):7.870481231782746
                                        Encrypted:false
                                        SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                        MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                        SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                        SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                        SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                        Category:dropped
                                        Size (bytes):2268
                                        Entropy (8bit):7.384274251000273
                                        Encrypted:false
                                        SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                        MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                        SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                        SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                        SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12180
                                        Entropy (8bit):5.318266117301791
                                        Encrypted:false
                                        SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                        MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                        SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                        SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                        SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                        Category:dropped
                                        Size (bytes):784
                                        Entropy (8bit):6.962539208465222
                                        Encrypted:false
                                        SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                        MD5:14105A831FE32590E52C2E2E41879624
                                        SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                        SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                        SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                        Category:dropped
                                        Size (bytes):5465
                                        Entropy (8bit):7.79401348966645
                                        Encrypted:false
                                        SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                        MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                        SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                        SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                        SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                        Category:dropped
                                        Size (bytes):129887
                                        Entropy (8bit):7.8877849553452695
                                        Encrypted:false
                                        SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                        MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                        SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                        SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                        SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                        Category:dropped
                                        Size (bytes):24268
                                        Entropy (8bit):6.946124661664625
                                        Encrypted:false
                                        SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                        MD5:3CD906D179F59DDFA112510C7E996351
                                        SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                        SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                        SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):14177
                                        Entropy (8bit):5.705782002886174
                                        Encrypted:false
                                        SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                        MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                        SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                        SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                        SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):109698
                                        Entropy (8bit):7.954100577911302
                                        Encrypted:false
                                        SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                        MD5:8D804A60E86627383BED6280ED62F1CF
                                        SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                        SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                        SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1547
                                        Entropy (8bit):6.4194805172468286
                                        Encrypted:false
                                        SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                        MD5:0BA36A74DFBF411FAB348404CCEC3348
                                        SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                        SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                        SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                        Malicious:false
                                        Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):10056
                                        Entropy (8bit):7.956064700093514
                                        Encrypted:false
                                        SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                        MD5:E1B57A8851177DD25DC05B50B904656A
                                        SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                        SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                        SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                        Malicious:false
                                        Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):11043
                                        Entropy (8bit):7.96811228801767
                                        Encrypted:false
                                        SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                        MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                        SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                        SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                        SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                        Malicious:false
                                        Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                        Category:dropped
                                        Size (bytes):65998
                                        Entropy (8bit):7.671031449942883
                                        Encrypted:false
                                        SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                        MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                        SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                        SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                        SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                        Category:dropped
                                        Size (bytes):27862
                                        Entropy (8bit):7.238903610770013
                                        Encrypted:false
                                        SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                        MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                        SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                        SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                        SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1569
                                        Entropy (8bit):7.583832946136897
                                        Encrypted:false
                                        SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                        MD5:07DB3F43DE7C1392C67802E74707DAA6
                                        SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                        SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                        SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):60924
                                        Entropy (8bit):7.758472758205366
                                        Encrypted:false
                                        SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                        MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                        SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                        SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                        SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                        Category:dropped
                                        Size (bytes):32656
                                        Entropy (8bit):3.9517299510231485
                                        Encrypted:false
                                        SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                        MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                        SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                        SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                        SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                        Malicious:false
                                        Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2104
                                        Entropy (8bit):7.252780160030615
                                        Encrypted:false
                                        SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                        MD5:F6C596F505504044DF1E36BA5DA3F09B
                                        SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                        SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                        SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                        Malicious:false
                                        Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):977
                                        Entropy (8bit):7.231269197132181
                                        Encrypted:false
                                        SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                        MD5:B7F74C18002A81A578A4EE60C407A8D3
                                        SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                        SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                        SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2033
                                        Entropy (8bit):6.8741208714657
                                        Encrypted:false
                                        SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                        MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                        SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                        SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                        SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                        Malicious:false
                                        Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):39010
                                        Entropy (8bit):7.362726513389497
                                        Encrypted:false
                                        SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                        MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                        SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                        SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                        SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                        Category:dropped
                                        Size (bytes):2695
                                        Entropy (8bit):7.434963358385164
                                        Encrypted:false
                                        SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                        MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                        SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                        SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                        SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):179460
                                        Entropy (8bit):7.979020171518325
                                        Encrypted:false
                                        SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                        MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                        SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                        SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                        SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):14177
                                        Entropy (8bit):5.705782002886174
                                        Encrypted:false
                                        SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                        MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                        SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                        SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                        SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):52945
                                        Entropy (8bit):7.6490972666456765
                                        Encrypted:false
                                        SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                        MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                        SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                        SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                        SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                        Category:dropped
                                        Size (bytes):64118
                                        Entropy (8bit):7.742974333356952
                                        Encrypted:false
                                        SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                        MD5:864EEA0336F8628AE4A1ED46D4406807
                                        SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                        SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                        SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                        Category:dropped
                                        Size (bytes):22203
                                        Entropy (8bit):6.977175130747846
                                        Encrypted:false
                                        SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                        MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                        SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                        SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                        SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                        Category:dropped
                                        Size (bytes):22203
                                        Entropy (8bit):6.977175130747846
                                        Encrypted:false
                                        SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                        MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                        SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                        SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                        SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                        Malicious:false
                                        Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):86187
                                        Entropy (8bit):7.951356272886186
                                        Encrypted:false
                                        SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                        MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                        SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                        SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                        SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                        Category:dropped
                                        Size (bytes):36740
                                        Entropy (8bit):7.48266872907324
                                        Encrypted:false
                                        SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                        MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                        SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                        SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                        SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):827
                                        Entropy (8bit):7.23139555596658
                                        Encrypted:false
                                        SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                        MD5:3E675D61F588462FB452342B14BCF9C0
                                        SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                        SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                        SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                        Category:dropped
                                        Size (bytes):68633
                                        Entropy (8bit):7.709776384921022
                                        Encrypted:false
                                        SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                        MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                        SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                        SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                        SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                        Category:dropped
                                        Size (bytes):2898
                                        Entropy (8bit):7.551512280854713
                                        Encrypted:false
                                        SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                        MD5:7C7D9922101488124D2E4666709198AC
                                        SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                        SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                        SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                        Category:dropped
                                        Size (bytes):1717
                                        Entropy (8bit):7.154087739587035
                                        Encrypted:false
                                        SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                        MD5:943371B39CA847674998535110462220
                                        SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                        SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                        SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                        Category:dropped
                                        Size (bytes):1873
                                        Entropy (8bit):7.534961703340853
                                        Encrypted:false
                                        SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                        MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                        SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                        SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                        SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                        Malicious:false
                                        Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                        Category:dropped
                                        Size (bytes):52912
                                        Entropy (8bit):7.679147474806877
                                        Encrypted:false
                                        SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                        MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                        SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                        SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                        SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                        Malicious:false
                                        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):39010
                                        Entropy (8bit):7.362726513389497
                                        Encrypted:false
                                        SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                        MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                        SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                        SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                        SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):84941
                                        Entropy (8bit):7.966881945560921
                                        Encrypted:false
                                        SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                        MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                        SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                        SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                        SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                        Category:dropped
                                        Size (bytes):41893
                                        Entropy (8bit):7.52654558351485
                                        Encrypted:false
                                        SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                        MD5:F25427EFECFEE786D5A9F630726DD140
                                        SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                        SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                        SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                        Malicious:false
                                        Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):239
                                        Entropy (8bit):7.116143481530406
                                        Encrypted:false
                                        SSDEEP:6:KXQXq/R8z3VGRTrghje952lItGIUCKcpqKsM:zU8jkVnX220IAuTsM
                                        MD5:3E624D533C3E60F51BC12A264ED0F1BC
                                        SHA1:B024ACEBE6FC904F5A29B4BC87DE6CD76055AF55
                                        SHA-256:FBA17FDA978BFD5ED4EEFEDC9EB445F1445B60164F6D70DA9DA64D84B1CE366A
                                        SHA-512:18524D7B9A9EDC2694653E2ACF6502B466E49496B12219E8F52AC07650E949AEEA5371ADAE55832E20161F0AF2A879788E10773419A5820D4287C71A40D17530
                                        Malicious:false
                                        Preview:..u...W..u.G.v8.....5sPEH..C},.>.3x...>.~d(B.CW..mY.;M.3.IO...B_..O.%(..n......FR....(.g...b..AP.H.L.M..a.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):256
                                        Entropy (8bit):7.178348193198806
                                        Encrypted:false
                                        SSDEEP:6:qdy9u82B8yEtATATX2MMEUf6N8GPQS/hje952lItGIUCKcpqKsM:Aa/tAUjrMjyN8GISgX220IAuTsM
                                        MD5:7B830232D1308B6A3BE9F6C2C228A663
                                        SHA1:A621D7820614C0D77DB2E207536C417A2E8AC810
                                        SHA-256:4F593B3E3BE8649370DF5D9F54858BF118DD1EFA2C59EB3F272B16B7C9FF22A9
                                        SHA-512:A9A30AEDE4420FCA7DD011AF9C6672F5B700ABA9A6AA0577D73CD02393F6B8027C1A7C7C606D1C847B7B5A3B9D15E531EF44055CCB0AB1195E1E918D14D3B1C0
                                        Malicious:false
                                        Preview:6..u.l~g|.':.... ..oR.u.G.v(...{{!.YHH...},.>.0x...>.}...'....f. ...9...fE..K6V.......=Gi.P.rT.m.....-..f.!.A<.G.".v.d.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):266
                                        Entropy (8bit):7.195855649607989
                                        Encrypted:false
                                        SSDEEP:6:Ga/4AwF7JiTDTbHdar7O1Fx6gRQMO+aweThje952lItGIUCKcpqKsM:N/4RF7WDTb9arK1L6b85X220IAuTsM
                                        MD5:F5105FFF25540ECFBF406228B980FF6A
                                        SHA1:08B38B587CE119A76212EC71927802CB200BBBFB
                                        SHA-256:DC013B2278ED7AD498F68D5F0042556C1D3765C661B8B168FC59902C9471C63E
                                        SHA-512:8436384113485109BE852D2ACF465F1A6F803061FEC20A3B3CDEA0467C4ECF5034F34B0C9222D7BCD71BCBDEA0114B3945B96F0E83DC35C909AC48148FC2023C
                                        Malicious:false
                                        Preview:........../.h.~'...qu..u.G.v(....{!.U#F.vs_.<.0b...l.~......NQ.k.[.....w.r.`..>.8.0.q..q..D..j.L]..k.0.)'O...a.1....;ub...l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):10483
                                        Entropy (8bit):7.979422403479749
                                        Encrypted:false
                                        SSDEEP:192:mbsLBdSomyrOYUPkGF3fkrJo3ynutPR6VQaTcMG2mDv4KgVSI+LWT5fB:pTbmyrORPT5faOCKR6OfMG2FKgVZ+SP
                                        MD5:F3A8BE0E5BEE56313C892CDA35B9D20E
                                        SHA1:77C050EB068FBE5C831243760FADDF07396301C8
                                        SHA-256:53A0E76C3F1FDD9CC79EB7A026D89F9A4E40F29882579914CD4C5CD764190F28
                                        SHA-512:E17AD812F5912210300F5F1A3640618A0BA7185B69B7B4F023831D2A2554BF822626D074A6B640E2BC79F29CC37A9E31B3306100A52B836793757CC5F21797EA
                                        Malicious:false
                                        Preview:........_....&:..+.......y|Ba..,..".0.!.+Q.d.O1...#.\.M..<.".3..n.......z.HtY@..p..].PS.>.iwAc.h....9n........9.."..D...8..9..7.J.f!......ji..E.?.a.u$n>/..0..........._.W..R..5..[e........>s....7.&..b;a....gy...&..hWx..I...t.....g...V..&..j&*...A..So?9.?.~....:.I..[...`o.L.o.^./.+.?w...>+a..C.?6.Z...4..+.t. PVG..(......o...^.".l..>0.Y.-..........L.........Y...>..R.ux.....`@..i..1M.....@y...W..!.<hM..X.8`(&S..t.W...*..T...;d....[...Ng..W#..i...`;.`...Y.f2........?...,.[...*.B....... j..eid..:...O..&_..w.........CJ...^{.t......86.T....3.Qz..9W.4"........h.._V.#4."k.V....0.U..........*....].)B?.(....A.,%....me..H.D\d..3.b+..9`.../..........+r. ..@...).@....l...H&.."..Sd..%}.N._+)..O>`8.V..Z:m>6.|.Fo...I.G..A([.A.......oH..]......".../..t...s..'w..x.c..d`......jn...[.O.U 2.....|....(r....4.w.*...N.0o....|...{U....n.XL,.K..0.@.8..UU.{...D4..g.e..... .d.@.}.!o^.1...8|2-X.C....8..=....i..e..\......U..>...!.>+my..?..,.j6......0...w..JP...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):24396
                                        Entropy (8bit):7.990686671801429
                                        Encrypted:true
                                        SSDEEP:384:CPdYAmHseIS+YbbBZsugkJhqVkO7YUl4Up3czo7FIwWxiVlw/Soh0hmFffwiA4es:YaAycYgpGqeV+4m3S+NWgLqW0FffvA4b
                                        MD5:0FD0A71C70C4D6D3BE179E202A375F64
                                        SHA1:A87EF59685DE850C56ECFFBC4A93DA68FCF9345C
                                        SHA-256:D665DF784FE42F0C160315496EBAEC7E74BC16B45CA1EAB7EBE7F7AD47A04AF1
                                        SHA-512:61071693BE02FC90A2C4B869D9753D484594B63ADFA3F0184960EF5374C6870275E41DB9534BF96A34AF97DDF5F18EBB2FD33A134863ABF2EEE4A0FE0F79D4FE
                                        Malicious:true
                                        Preview:..Y.<8...l.k..e..8............., ..>......{..z....T5.Z.l.&".$V.....-..$ ...7.&yB....9N...+...y@.....o2..I3....K...~].X. XZ.9...I..WUpUf..O....ni)6....J....*.B.A.`#MX..<.}.FNl..M3...xIhI.r8..+bN\:..M;2.i{.x.b..x.}8.U..z(..F_....n.U....k...VH:..g...dO"t8..e...zu.. ......+.a..p..U. c..Nw9.._!|}.n`S_nj.O..c_..u..$.o.o.......E.X....}..c+.%..Y.E......R..-.g...W*...u.b..B.\)y..u.{G`.X..h;.G.B).(...\y.......H"...Y..O.&$...?._3.O".OS....<H|%./.1.o..&%[.%]..........:m%..Q.jd..\.0>..z."...v".....pi.w".y....In...".E...|.)...[...)"X4..X.....E].J.,4S.\..)..Q...z5U.?..3...@h..3j'..h.....:>...Pe...........o.N:....IR..x'...$v..U..u....y7..3.........mE....(=..D..Z..0....ag.;~.b...7D&.I....Op.:.r.{.Q...7...o>......Z.qo....3..H.D.csA..3.@6 ...31........L...b........+.......q...1T.....d..]I.....iw..N..T... CvU...9W.....%.t.......DX..k..D...../..v....e<..+SV..4bTu..5..I.M..t.......h.>.....+.k...8}38.Ok.....#;.D.u..@Y......V.*..%..-...0.}..I`gw....c
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):509
                                        Entropy (8bit):7.573892753140123
                                        Encrypted:false
                                        SSDEEP:12:0XOLTrNVJt23RsGjrnh16cewZ13LAAX220IAuTsM:0QrnJEdjrnj1eENLHX2oT7
                                        MD5:989A36BAD9D96C23E5D501C3D8A4DBBC
                                        SHA1:451A35AD475F302F0482CF20355B69F301A6AA47
                                        SHA-256:839BB030D5468976EA6670E88702E8B3A11E17C95111C4083DCE44031E350B7E
                                        SHA-512:47E78521439703BA1C601825F7BC9FD4BE14766F539D2F8227CE12A6A0327AFD64CD8F8828A6BDD1C7032D57E6B8A55EDA3BA62BF130E8101743730406053E9D
                                        Malicious:false
                                        Preview:..h...g7.y.?PX..vC....S[x.........y5../...+.......:(.U..~.#...j1..g..h...D!+\..i.a.4..>.S..G.ng...K|..S.G.M$..(..f/._N...I*.....h..^...I9-7.@.{._.^6..-V.}...t...o.`X.c.v)/....0'..Z;L.]...m..s....-.#Z.IV ....*M<k<c...}...T.zV.....m.rn.4L.....4.#......u.G.v9.'...<.?.&..eN9..s.z4..>.~......MQ.h$Yx......b=X.:..\.%..3r....&........q6....ImL....W......#..;.._..o.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):274
                                        Entropy (8bit):7.253786416783671
                                        Encrypted:false
                                        SSDEEP:6:S+wUyriaXritqrhWbsEgihje952lItGIUCKcpqKsM:NwUy17YqrhOMX220IAuTsM
                                        MD5:9A9C39B6DB94E5B216678EE8248AD58D
                                        SHA1:A047447F133B98F2A2F577C8E4785816B90BA20B
                                        SHA-256:DDA6B6AAABCFC789BCC345BAB74A81C6FE35303FD4B8E82ACE7294E35AC330FA
                                        SHA-512:D4C2720155E9CE58257A5B1E212930380275DA31DB748D56EB924830E8E70031E0AB0A0E42C8D1C11D5E79F7945425913D2E15B366CF5829591F816766D34E5B
                                        Malicious:false
                                        Preview:...v.7.?......n....O....;...=...~j.u.G.v%.!.i{{.Y+F..},.>.0*...>.}......U1.E}5B...7=.DL.x.>....~-`.c.....P......E...._..:-h..B..t.H.V.h.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):296
                                        Entropy (8bit):7.314277510817456
                                        Encrypted:false
                                        SSDEEP:6:Mh2Yo7z6ZQqJYw7Var2sbSvL7I6JvjNrv7hje952lItGIUCKcpqKsM:g2pCQ6Yw7Var2suvL06JvjN4X220IAu/
                                        MD5:663A732460002F418F290CE7DFA68A9B
                                        SHA1:7DEEDA3AEFFEB34B35EA6EA1572BB0449F57E5FE
                                        SHA-256:76B78FC4765B4429365A62B054EF1F5C27A7CF67E7DB992629AB2DC244FFA520
                                        SHA-512:CC5ADDE90BFA5C360417A34B3DA6F519A1C0462B687C7BD1E84FD8EA12D30D38664789CDA7D358DFB7A3A163676F7A03209CAF336888E64DC73F86B1EE41DCAF
                                        Malicious:false
                                        Preview:.JJ.3b...Ug.....z.i.@..kz.......5z.5.....9\S.>..0*.u.G.v8.2.JUX.^dF.psZ.<.0b...l.~......NQ.ko.......#....rV....5.0t.e ]..Ah....P..#.+.W.>;x..4[..G.%?k`..l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4456
                                        Entropy (8bit):0.4346421565309627
                                        Encrypted:false
                                        SSDEEP:6:zJwOPaw+/FYyfhcD1RRXUn/cXhdYJyRIq+J+/KRujslll:zJ7iDYyfmJ/U/cXhdYJyRIFw/6/l
                                        MD5:5985760753C3A6090BB1BD61A9160466
                                        SHA1:FE34B58DB446DBC6EF4CEA7852718B09274C151D
                                        SHA-256:C67588322F762E5EE03D86C2195FB5D8E82FAB13606B92C8D53931498D44158D
                                        SHA-512:C593B772A9D0BCC3DFD826E8EBD2ED4BB3EB218A7836B4879AC0DDFCAC8A4081DAFEBD7C40CE2ED8527C71C4995478BF27F74E226371DAB4DB6F8C4E4A786155
                                        Malicious:false
                                        Preview:.%c....L..=../\.....K.G.*.?U...................?.....I.......*...*...*...*...........................................................................................h...........................h................B....G.b..... ..........y8...F...(.................................. :.. :.. :.. :................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):267
                                        Entropy (8bit):7.236286568197187
                                        Encrypted:false
                                        SSDEEP:6:0WTdPHBqAu52zrus2AQfjQihje952lItGIUCKcpqKsM:ZdPHBRR6RfsVX220IAuTsM
                                        MD5:27BB5038FAADA7ABDBD40F9864B25DF2
                                        SHA1:854FB9B270FC4D361ACD574DFF93CFF3DB754E48
                                        SHA-256:93E4123C4EE05A78425B4824A937775CF0B94486FA1E493B18BEDDF73AC5737B
                                        SHA-512:A05ECD70ED9A59F7957D64391FEF8560356CC5E0D7057D97FF6EC9ADFFA020B22EF33EFE528C304D023491AA1366701654F3EB9D3EE56AA88A89326190C818B4
                                        Malicious:false
                                        Preview:8y...of....u.G.v>.#.vUP%^#F.ts.......-..\r....%z.Mx.k$.x\ R*AW<.W0.n..._..o..>.L}S.'.T%.`u..z..+|..R..m.>...g.E....B>..J. qOI..({.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:true
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:true
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:true
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):7.951412598339427
                                        Encrypted:false
                                        SSDEEP:96:b+p1hrHJ0QGI12Rfp8eo7aO5oqAVunsBjl9Uc/7FgZE9DP22Mlq2+R:2tHWM4pZoH5oNEsBBC8aZ4P22Mlq2+R
                                        MD5:5B4CFDD52E01E5BE873F7066055E7991
                                        SHA1:6C56D82831318F412AC3269F116AB9186CA45243
                                        SHA-256:0A724C00980BA61760B5120148FDCF858830A29C666305BE4839F31D580C073F
                                        SHA-512:D525F8CB4914CA379A8F457785A951C436DB4F872ED17AA8DF1047D8E185C0EF1AF91208DD8E97C796C095E3A0831408E7D7D9246CA6E56582445D2FEF2A3B96
                                        Malicious:true
                                        Preview:.i.Ab.]7..P..,@.aL..4...B......a.[?..7...D(?....S..=.......,..n.h............3z.*.V.s...@.dvQ".I.....|.X}.."w.T.@T....(.dj.D.Q.c.....h0.r...S....z*.&.]...&....U.~.....'...%;...I...L.?.5..?.Z.:.h.. P..#,(..+....H..}].ry...T.}..>r=.....H.X.z.'..o.0w...up.\..8.t....C.M7...X...{8p.........%......o%c*...#a.{.].bK......0...]..O*...&F.&y.., .$)^t......^.....Or5.......RE..Zsm..u."...v........)..1..\...G....>.TX*.....\n.....(....Hy.R..TD..........p...}.%..@.(7...Z.s.....(S.#...s.......ll....mW..t0k.jVwV..m.g....4.?jY.........V.8{.O.T.[]..@?n.ZOd-|dl..]..VWW....6..y5....z..<C..{JL_B5.HT.!.f.jZ.[.W.).>.......b..`.3<..@.p|...a....j.5.V..62+...:....T."...........4...4....G.!.-]......sN.....?.....@+n..R....%..]]q8B`J....=..{e.....c.....$..H._..0.....c.... .....h.....WE.*)!.pk<MT..*...v....$..W.U..rHR5.".6....v.p.......&@i..t.....P.A..Y...q.=L.4ve`m....8.O.R...*.....>.xp.!.4r?[. ..z..}Q8..+..p.A...JW..9.<.=.-..0.8.0.K......=YE.s..^.l..;Q...qaG1.**.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4451
                                        Entropy (8bit):7.9607280013120825
                                        Encrypted:false
                                        SSDEEP:96:VWiwIUEFcWsCTJFlFujvuSyTjf0AnOQwh2/AwAC51zReHHjtrHTp:VWiwIESlFuj2Zf0V5h4kC5XeHHRrH9
                                        MD5:15FF56D7A668A93C034A94DBFF36864B
                                        SHA1:D2BC4228EE9B7665F66AB385A2BA7CD8A0FF615D
                                        SHA-256:B620C398E6BE7BAB63878ACA07E8060F68032A2AAA64393223D7B2FFF9C8563A
                                        SHA-512:FB88641499F45C2746D9C0C358E9ACFEEB6C0B3532E606D18546F54928174C00692B8BB0AC433E29B119685DEDDE64880930053C68FEDC9FA2034C89C56016DB
                                        Malicious:true
                                        Preview:........\.}3.h...3..T...xF.'.<m....vJ..X.dQU."."r...u`h....8...U...U\eY.F!o4X.....&2.@T$....W[..y.Oa.%.Y.....i..g...E-J}8.:.q..j.52.n...,.'...-K.~..[V..$:.Tk=T<.....|J.......k..y)......BI.BK..`d .......!...%..?l.v.=k.I.@.`......+.".........)..|......{.[Fzb@......]...<..&..).Vt+...E.E.4..e..V..9.}.W..O.t..Y3......4[.rbc..J....7.@.>.../......H.1.d....T.#.Z.....}...-.G..5.LtR..1h.b....Q.....L.w.'....S..hz..~..I,.~o.;.)...o...O..7{..V.cPb....K.=...\7.y`.H.4b.o%.`......f.YX.qH.t...w{p`5.A.:....,;. ....V{.6...i.>.....D..,.g.?..n....g...=\..dQ,"5....)...0.Z.......B.=.O.K.?.~..d...6.....`..J.;'.K.W..e.d..OU.[..X...xI.s=G...].......W_G..+..a.6.......P..8....9[.:i..M^3.;...z..f-..+.. ..g..rK......?.........y....Y..W|.0...-...>A...s..!..tG...r....z?..<.9..F.E.T.U..m...k#zj.$...16.W.3SS....A.Q..)............wj..t..lZ~0.../.c.#oO.w.....*{.d..oT...c..ZK.<}[b7...e...D.\..L....u0z..*...u....q.-.....N...+.)..l..Xv...H..D...j.Y...I.d#F.h........1..C$D...|..*.{..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):18681
                                        Entropy (8bit):7.990304714124976
                                        Encrypted:true
                                        SSDEEP:384:7ULFUv6h2clkJJMMZ/ixyC8qca3x/Pa7PtFltpqZVlFh:7SyvC9SXMa/ixWgXer/pAlL
                                        MD5:3EF5509D1F4D65FDC3FFFDA13797BEE0
                                        SHA1:02D5C3A2F98DBC9F92D8790AD2BE6F36455BD1AC
                                        SHA-256:B45E9185B4FF025F66E9A708DAC51098E11A92F9D9662E5B642AC229DC52D59E
                                        SHA-512:A7C28545699F1C4C56230BFE1FA7C88918D8EEBCA167DAADFF16F0A87204C493C3F99E80AD263806DD55412EA1FDAAD4FE26C856C883684843A168C64CEF6D39
                                        Malicious:true
                                        Preview:.1....^J.<...}....@.........f./..4z..!.R.@.....l..CMc.../.X..C.E.........4T..^g...f^.v...@.M.3!.>1.q{Pql......fkP.b.0.[VE$..5.(.<se..KE...*"...;...m.h...v..!..}..j.r..@.T1.......tM...j.h^.....[.v..X..V.F......h..*8._.w.:e.~.>.GN...*...D.z...=K..@B...[....>8.g..]..!7.(q$..=.s...-Al...sX.;....9..m..b...F..t3._.......L5|.6.NO.C.b..$./^.-..Ko...T.Y.4Uj.4....&.1.J..n..........:.....>.........#...=..G[..M..?.E.&.4.eP..w.e..h..m.8...dQ..N..T$......CDS"J."....'..3.|..9..;d..@.....\3`_.G4.YYb.y...U..0...xB.].;r......?...`..[%Y..=..`.+.CO.."p^..C:(\56......[q.]luF ..... .K.pN."..z&fW.`..Y...H.B....e.S..@.....u..d.cgT...7nF...hR|..@.9X..g....h...))I.`F.4,.U.]..6!\Z:u.&..O.t..[_,.F.......v^.Y.......I....r57..2.Bb.o`u......!].....7.*F....+../..........`..#.4.ia.`<..?.#.Y{.5.yv:.R..F.{}....a..HH.Mt.:.#.....1.-...?%.m.v..ge^'..._.Ot2..1.J.*."..Y.N<...Rs.-.%....h....u..B.../i`.=`4.I!....'.`.@u.)#.....cc...n+.........X.N...=.@.....w&v."-.,....I
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):18711
                                        Entropy (8bit):7.989865562626448
                                        Encrypted:false
                                        SSDEEP:384:4QtrVPeHUnOLdHu2+tEB1fHBwX9qXARZt1MeLE8+LW3xmd7aQopXGdqNGIQC/3G1:4w9ULFD+tgpBaxZsYMu+Pj
                                        MD5:38AC56B597AD7E891F7B634108040A35
                                        SHA1:D55FC205D29D8060CF20FBEB70D7DAF89E021911
                                        SHA-256:0589DB67CCC46AD5AFF1587166C43CF17A965D7CF467C6CEB32BAF1FC2C05CA6
                                        SHA-512:DE93438DC9C5D1EB66E58A8E68FE42928407270B960B88A3702DEDFE386F8BBC306187A8CB8D046799CE1631B90DC1D908C0A23AE970C5DA816649BAA0420DFE
                                        Malicious:true
                                        Preview:2.>o.m.....u.o,...fo.O........W...O.3....n..i.o*_5~9.!Y.`$*onR....cW..G...t.<...lM...BY.B.rx,.k..[.._..;#..Ol../..$......,F...$o7>.G-..8.rR.&.9.6.Ol.w..@.aa.=.3...:.zF]=S+.#:eA...NE='.3.XIT.K!GN......=U4.bj..s.%*....V.,.-....hLw@.?....i..._.R,{....Z..uq:L"..E&..A.....&...[....o....i,.8...W81.%#o....A..2....:.%2ZQ.vY..[p.N.~y.X..4.....|4.?....[D-..L..{lJ..P.A.K......P...0.P......2(,.O.t.....E.:...G...W.Kh..[w...n....C.-.Q.~E.....>"....)..[B.......k..l..8'OQ.B...L....4..a...t........w..CP..#y..T`.V.=m0.....Y.`.f.%....";....E..q...I;.........T..a...~.{.7.K.b./....83...1t.|/d...#.Wh.....,...7t"...}..:..l..(....i2.Q..gI41R...$....LG8p:....m.....u...0..U..4..)O.V~+........!|...o.........(Q>...Cs..A..c]I.M.).5.5,E..?..M..b...e...u'o0y..fJ.b..D...6...>...6...h.C.!.T,.5H....>....XC..:VI...>]...f..Y...Ou'v.j.G.~...9......3../.#`..._0.../K..PQ....q...^.......H/.............w...D.=.2..A./`.."..\+...........9.}1....X.N..0V...8..3.z..o`.A}I.c.:W.....h...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):751
                                        Entropy (8bit):7.738447854761124
                                        Encrypted:false
                                        SSDEEP:12:X0XoDiKLhKB6XTUpyiHwPu2V3mZETfWf0VzvpfDNfeLXjiFtaftrlHXCU7gX220y:eU/LIBsTUZw2OmZR0VjpfDNfNtolHF8/
                                        MD5:AE18FFAB3C75D446AECCF0AFEB9A8498
                                        SHA1:0461082F24B755EB82B7ABABAE65C513CFFEF6D1
                                        SHA-256:803AE80807DAEBAB230D27F8834D7B8C60C0CCE5E6A6EECB4E31BE35A50BB769
                                        SHA-512:65204C40C3C0D0B1E1F1BE13DE1E83053B266FAF2D5D89CCE82E3748F9DE6B6BE19CA629296948AE50CC46CFD17DA36F738CA314D60DAECC8227B519841DF4DE
                                        Malicious:true
                                        Preview:......E...._^.K......q...N..rM.H...O.(...k..E.?..KJp..4...Z..............X.*..|.....C..L..st?f..g..o..q....,...+won.k..+.....s..aB*.l.fE+dm...!..64%.L&.I5..|.d..x>.?..t.H..aG.....;.@~.!...Y...|....&[i.gf..,..cz...r..>..U.G.CQ.4........!%......N.ol....{.....G..KV..8.Cm...".M.U.J='.....J)xo...i1`1M^H+.e.C.o.2...B.2.....!.-~..=.(d.S..\m...B.....c....>.0@..\.WtV........V.u...3.....)..mF..Z.bN.....E.Iq..V.zy.u+.q......ZQ$9O...u.G.XCfNu...``G....S0.+{<.89g.....HI.hb.F1..=..?-bq;z..k.oIFj.S...u...sHG.:?.`oK..">..........D..w.f..auH...C.."7...z....iG..,A.;......p....KD.#.z.3[@./.1y....d;..`{......^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4444
                                        Entropy (8bit):7.957823598601685
                                        Encrypted:false
                                        SSDEEP:96:kqXkhZFNJi7ThITHm9r30guwO/NrF/I//CplKLPbzmJ4B5ijAnwd4:kS6NJwTSTkrEoO1x/3plY4q1D
                                        MD5:24A7F19E1ED458BE723CF20D34E469DD
                                        SHA1:654EA85AC2BCE7236542931311997B4A60D4B013
                                        SHA-256:6BC3B0DAB337DF5E529485E7A56085B64B51A94735E2537C2407BB724C0CBF13
                                        SHA-512:036C32472A5F92D25F280DC030260E215B2E7DB769539B8BA875D06E1CDE47D8EA6CE406E596F4825A88205B509219E47214A05E8023D1C6D1D219A335B01288
                                        Malicious:true
                                        Preview:....D:W.M}..r....OO3W.WS.N....\.;..i.tB".Ib.\x...%..\....9....0....0.../V..f....ID..D.....&...{....I..A.2..u.i..+.I.|..~}.....t.{..]...I.r.&......es.......N..m*E..{,...%.O]_..l.h.[...41Q'.h1.h.....Y.9.).~.._..@.7J$........UtZJ.....G...&'.r.C.@.8D~.7w.n.....XS.d..c."\.N...t....u...`Lh..;..V2.....Yd...8~(..[..f...[.2.=5)4.a..!.#...1.}...y7;.[.w.4'....^...qs[.5...].p`4*....../.#=.6...D...p..,.rC..Q.=...h.3....q_e....n...K./Ym.....Q5.`..C..HI(7.+z.o......5v.N5X.........$.~....d{...n...1."..u..>.Q..p..i.~j..n."O...../(OwL..<F..[A1.t..E.;/..q"..s.&..&.......Nh.]%.7..m..H......V.e.....6!.m.Y..S.72{.....}..'.z...V.M..)..........a......4."..b........1.......o....\..d.jm....]9.....p..4m7.2.D....O!#....=.{m...j .........z.......'.c....?'....K....Oq551w.O.8%|2.`..FKGI...hD..|.%a..h.1..3..p....N~x.~.A~.5#.]I.^.)`.....=s.....N,.^.)87.,....,...Bo...AXb.I.1..p.&?.}.".....>i..y...P.....:qR...:t...(..oa..9..Y.......H.Q....9 `..*.<..k.<.F.tY:a..W...I..(A..ui.....!..:_
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):748
                                        Entropy (8bit):7.732910518273313
                                        Encrypted:false
                                        SSDEEP:12:JpmUYv26oj8OKcmHoN/HNWVtnwYbTCaWYQX9VghjLbGX7zMdEvz7D/MCvIfcX22j:Jge6oj8dcmHoNPenFfCaWY6XsjLSzccp
                                        MD5:B4C15DDA78D5C8E774F553888CDCE9A2
                                        SHA1:49559668137D461A19594D2C47019A710C1AF159
                                        SHA-256:FB23F04920186B3E28CA8685C1B6ECFED8ADBD894265E98CC87D220D95125FD0
                                        SHA-512:26709AA288F09738DD9A72D94869A0CC5B485E8F9957E90D396B13E99A3784D7F1B7313A1E13E1B85AFB9EBCE8F52942D33B3818DFEECB7284ABE9692C3E740D
                                        Malicious:true
                                        Preview:.y8.K.].Mn......8+.?. ."O...#[...j........'.uc,."y3#.....6!#rw...p...Q;.l..J....`U..'~.8E..6.......~....M...j UxC...B..9B.5..0N..Cj........1u.w.{....G%z....K..M....ws*.&\.L.y..K..`..F...O9.(..Q.....g.....'.P.W..Vi..V...t../.9.6..!.v......z.*..L...EW..7.7.a.n........x.b.xl.}......;........_c.o.n.b..P.^c!..5..|:.F.3.B.n.csd......t.._k.Hm....Q.E..)...u^.8..../..=Y.X_.^.D..A.._.N....}....!...........M..,.%..<.y.8...um.W.F..5w..u.G.XCfNu...``G....S1..z...'fZ.S......db~....>zGtj4.dd.\8.]b.B.a^..;0...Z^Q&...{..k{<A..O.....G..w.f..8....V....p..D...."..F"|.....)....v#~.....htu.#.-...x...,n.I......^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):15298
                                        Entropy (8bit):7.986304096388817
                                        Encrypted:false
                                        SSDEEP:384:JBKgJ7QnW1KBClyRkr/AzJrsyTWE62GJUIg:fKgJY+T+Iq362X
                                        MD5:A7487DAA8025096CC55554A72FC2C676
                                        SHA1:B7F639ED82850DA8CE5D9EF8F905CB166775A6D3
                                        SHA-256:E78C6267B414656EC10481640472526ABD4FB0CA7DFF9F43D2B7F1F6DCC90EE2
                                        SHA-512:7CABAC350FEF26B1DB86040D80F8A1A9EFFFCADAFC2BA06D843ED85B6B6280CE35A8A4F981E6CBCB602F50399E3639427CA07FABF0618D57FFEC2C806F793D03
                                        Malicious:true
                                        Preview:...D.j...)..O.\..V/>..r."W#6...!........%....b.W..J..t.ch..N.H....OHn...a....R.....6...N~..t...........`...U.W..0..t..S5].[......2.=:.[R'u.i..5X...Oq..../b.aCD...j"`.>C*u...$.._Ua6.K...ij...6.J.n.H:.'..6./j.)....QS.K7`.t..~..Xg..<[......ra.`..7.A.m.......o'.Q{}..y...;#..-...t:h.9.kjZ\G..e...6......aC.F..NAlCg.1yZ..~.*.jh...v......a..)......6.B.....K8.....~F..i...P.C....3S.>JV.K...p.K.vr......X%....w*qX....xY.W....%I.D...Cm2.(2.?...By.[.c...7p..;....R.y..(o.&....G....nV2.M,y.:*,..i.\$.....3...z.X.+.g......`......zEtI{.r7..j.....Y..kAO....(..b.:<.....q.}.,....j9...8tE..bD..:m,$N_...oc7^P......QJq"2....J...\[......C...`...y.o.....{.I.;.Z.R...v..<...yK.9.5z.$....S..'.BF..C/.6HD.p.DjX?n5..._iR..%h.j<..$..N2...q.*...JP.h.........W.q7../....}....ZW..?m....z..MK3..L0.....PS`.#r;...'...GE.].vC5...Hc.;...2.k.....C..os..a99...v..X.j._x..)....?.r|...[E.a...;J-7?.RvdY8.v....E.....K..R....,..........H..7V.p...r.I.a.pMd...[.H{.g.M.rn...g.F..e..0.>.,.YG
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:true
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:true
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:true
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):700
                                        Entropy (8bit):7.699041521808949
                                        Encrypted:false
                                        SSDEEP:12:FvzMv/vYca5VJ+vFqgyqmlRan+44X3BWpyC+S0MwvB/yuX220IAuTsM:BzMv/yVJ+vF9yqmlRan58C10JvBauX2y
                                        MD5:6DDD8C1CF7EEF3F2843EB557E0402E67
                                        SHA1:1F65AD77C068C0C3518AE07FD2795CE35643AE5C
                                        SHA-256:2082160E5F121EB072C760C73430CB7F428B6B2D60178C53FAAFE1FCECDBD4F1
                                        SHA-512:EEB9D2BF2127A75DABEDEC20E00AA4AAE0CA570CD104FAD202811678F19AEBAE6D0D06FD2213061CC61F2E58E88C3CCFB7298C7A1A268D79F3E54B07A83CE7D2
                                        Malicious:true
                                        Preview:.;..2.._...Y:........I...]..G}.k.j}...*.1......Z.......RO.Zg. .F/....<.5.Dk...Z.-.....Z7LK;.:...)...>+.}3*..-.S......$..MIx.......-C.oG....#.us\A(....z.B....%$.......~?.uV.....ll.U.-tR...vZ.".5....".`._K....(..D!'~...../.I.~...}6$I....F>/-..x^E[&.)...l!.s...Jz............M..m......[~....P>.#.."xa.Ul"C.~'..r.G.a1.Q{....`..U.....@.'j.h..f..~..}..:..>.........~......).... RAR"~.....9../ ...I..K..q../...@...].Y.a....TE.W....u.G.v!.%.h{:.%.&E..P..N...wq.<7~...O..MQ.h$Yx_ R*.....[..p./4.-.{..^$CI. _.x..<....$..L.g.P..C..>h.?x....?.gI.Cs.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):755
                                        Entropy (8bit):7.67216506986526
                                        Encrypted:false
                                        SSDEEP:12:YRhhbYDlfLJfbcMhlzb1ejgbJp+2SQVf+7P8+8h24oo7XLFagw78EX220IAuTsM:YhElfLJfzhlz8upmOG7Pjo7XLbw78EXv
                                        MD5:D5CF3825246FA2E83BC797279627F2D5
                                        SHA1:CE81EAE8065EC8E8499B7131C894E80D025D6E8F
                                        SHA-256:55467CF486868F514C417D8B667631081886D246C2F13CA922EA73C969DBFD54
                                        SHA-512:71E433AE891922D7CFC6348376D6820DA0F102E4CF992CCE9E8D59BB04504C524EC45E49DF0486FE60D31429A18FA361D8F4DF91FF1A2F0BE27E18091E069AE7
                                        Malicious:true
                                        Preview:..Z.E.+s.<9o'...c....V(.p....@....-.=......*.N.3.r.R...:0.c.k&mL.q..V[...e.=l..P..2H.?..u[.<V.B..w...S3.Ry%..O.'+.c s.e[:.T"k...}...v.v9w.&Q.0KU..0........Q)s9..a.#...q.1..O..O%.!.E0M.......M..Q...N.]..j.......J.B......@..$...g.p.~..$x....... ......c.. ..:3.%I.}......$..3..x...@....q.!'..].......1n.6Uz..J.J.WF~...5...D&f.7.^...&O1.^~.y`7J....O.*.~......x..fUd.U..(...D"...#..%...@...u....hl8.}....S~D..O[;..?.14...._"...7#DT..F.H..}.~.%......]i'.......o...B.."....2.M?...8N..9....x.\...A}...|..u.FW.$N6[i.Wq^JH...},.>.0x...>...N<....6../$.[..XZ..\m...O..`q..U~.p..~$.......C.1..w.)EF.P`M?c`.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1270
                                        Entropy (8bit):7.859009692515042
                                        Encrypted:false
                                        SSDEEP:24:JX5pu3gRm0oUPnRcg6fLO6RHPJNYs/vGvB5oSmNe/WAusPIX2oT7:jpTPoInRX6fXRhN7/vo5oobfQXv
                                        MD5:A2C70D922CDF578478B7BFB0A201191C
                                        SHA1:7A8669A4C7BF07BDDFC1D097E3039BA219CF8B88
                                        SHA-256:A9DE946540DA8381254D969E68038E9F0B00E7D1847332252F50CEA48D8C635E
                                        SHA-512:B375DA5D642AFF426D75EC1B71122716E27A4F1B6FDD4EB1228772D7CE8CE2642890E7A32371C29DEE4C6FB03A5FA205A7F9F8D3F0FA3BD227336E3CB5D96746
                                        Malicious:false
                                        Preview:=...1....[Z.w..~....uy..N.....>.(.n.=..".~......+l.e..r.S}...!..f.I...*..F......y\..>.f...s..l/....G.....).......<......q..@k.....s..t...b......0.fH).........|Y.&....1..).w;.....4.J.y..~.h..h."...)...Br.........K........T.n-...\...Z...+.zE...o...)...-4.f.T.l..RWJC...].)...}\.b_...W.Q...;.|.....I.w..t...\2+!...fe....m.9..Vww...JEqR....V=c.H..."..44.Y.$%v.4i...b..4.4...H7..y.r=.lY`..4..6D.E.C.z:....o.B|.......3..?.u..8...W......C......~J%..'.m.k..c..&)ed/)Kl..C.y@..f...O..f....]..k.#...`E......?...f...ab../..W=Q...*?q.T.V..+.DU..j.f:.1.n....!c.l......h...e.....%...U..b.i....+.=..q-.g.$h..,(.....GT..P..~...-.nv.....BA.'...^...3....A[n..2....H.(....-v9....,...5<..d9.$....5Tw.N.2....m.K.....N..N.3....X.7HQ.y:.o...m..7.....Y...O...SI..c..1"8x.....1.p.Pw....B..e.<..$.rOC....8.L..Y!.Qj.....^......S}.X.......)m*.._..n........O....F.M.8......BL.x(...Q.Z...l....."...e.Y.s..s...Z...:..K../W.....a...4..a(.|.3....g......d...$..w.F.l......8r...n.^
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1269
                                        Entropy (8bit):7.840138334336908
                                        Encrypted:false
                                        SSDEEP:24:mHTUGu1mUcsVANB371z9Lh2+/oglUG1e9VoOo10pOVd1qKVX2oT7:sVu14so1zlg+/oglUiaVe1nVrqyXv
                                        MD5:E103091AD53D40481D585E72944E8901
                                        SHA1:1B0C69A6DE311F5C4E70A96BE100F736587D408D
                                        SHA-256:D736ADCA3137FCB2C4F0D969590D9F1417B976DD254632DBD840E02AFDA2200F
                                        SHA-512:05661EB7441CAA376000917052802EE122BE60570CCDC382479275591BD23DA8F0FA47664FEC872AF7DCDA64E7E4F53A3EC8FE2091A05AB9D7A18EC8630418C4
                                        Malicious:false
                                        Preview:DfR..]}I..G.9F...r.{3J...!&cEO4..62...6?e.ic..-2.D[kZd.....*...............%.U.&..Bz...ms..}.k...6._..q.....%..c....487....!.=..u.x....ZS..C...2S....]}z....i!}.M...f.!.u?(.......*GS.Tgk.t^...i9.@#:n..B.D_./uL....w...y...e.+..`T.>.F..._+../.u..A.=..`y.....M"q.=.3p.2.2t...L1..K+..?m..6S...`..ed._...m.3m.l...RLFs..X.@..Xh........B.nj......v;|u2.Y.K.....]..z...[*.........MG@....{...5....hu..y.|.....Q....hD&.v.*6.6@..2....}7.=.?......>g..y..j..T...]......D..%.X..6.Sj.Az.:.uQ.%..<.E6.=#z..3az.D..J..A.J.-..S[i..SP.V.}.ODS....f..+...x..._H....s.....rP.kdc]9.E..'o.z6.......9&.qw..p......3j..#/P.h.C8r.B-D....VA......[..W.CD.=.?......~..,0..."M8....[.W..n.dL9...B.....?.4..3.v2;.^...x..28..'.M.m>.d\..........Q....m..dA.F.?.J)F.....cL.DW]C.RC.a.E......G.3X.3.3.sP...#.~..E...D.m...y....J..........Y..;D.V..b.Q.b..3..6....yV.-o.aOe..9......q..p..#......S"h.g.f..JJ[.wC.7g...in5.k..s..M...ysd..+..u...B](.z<.br.....9......G.....0..a...|]... bj.f...tg..
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1271
                                        Entropy (8bit):7.839974652007249
                                        Encrypted:false
                                        SSDEEP:24:qMiAFahXSPG4/mYKkzz29OmlTGJewD6HGrgxqAkXX2oT7:qMizXSPZeT9PlT6N6q0qAyXv
                                        MD5:00BFEF3A807BC3E2ACB0AF22126BC953
                                        SHA1:50B12F78E31A541C0161EB52ED7ACC79E5F5A443
                                        SHA-256:3B4B08B766DDA9632EC50F480A42EFA29C2C8E0EAB85B04D43B397765F77D08F
                                        SHA-512:FAFEA3AF6EAFDF7B987D153B2E9F370C49794AF0CFCA3A894C4DEBD5197D2443793C56123B62EF552FE2AA0C39B7AF9C6A5F709367D835DE6555262A381FED40
                                        Malicious:false
                                        Preview:.X.C5..W}..vyW.....]...f.x....R...V..I..<.>Q.u.Y^.A.6.....R......s.r..H.. ..jq..z%.O..6J.\.S.=.M.G.X...#X.u..Cd.-.y.{....;Ym<..d..d..F...<...w.C....9..e..m...o...E..I..J...xgn N.d.%B..h]"...#._....XV.../m.U...[..A}.,..xB3.2.......;.=~Q....#..z..5..i..O.u..)..t..5L..f"..%(..:u..*m.[h...s..W.....`....p{.:......C..1>g.....c.v.B....k..C-.J..,..>...+..&.p.TG.5...<...:.|6.Ni..LRP...:'.bm....[3.W..:U2....O.D.,.........R.St..%.S.%9XG*..*u...&.3..:b.N...~.......zT>..j.../.y..r..t...</`.>LE{.q.7..O$.t?.r..tc........(.y.[Q.W..5g...4<}......"A2q@qV...~.1<Z.....l."..em..a..g.Ae-?.t....8!.^.Qy.;q]..'j.q.k.Wf...`.\.p=.h5.xm.]..9...@i...w.....>.....B.V...`](.6.C`?....b....P.....N..;.........|........E(.....4|..VWa^.T.rm..Qr^.B....7i.P...a.D..R..q|*....e.]P.?.........x.pt|I...m}..s.?c...F_=D..s.u.G.....yz.cY. .V..p.68.T..n.z.T....}.7.E.T-.b.C............k..^.(....!......}J@...Bn....'.o...L.vT<............V....$....%.............N)...^......t&.3W............\M..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.838106902997786
                                        Encrypted:false
                                        SSDEEP:24:1nWhq9+ifHu5QujU6KxoFfnrDESL6Y1VuOL1/W+X5h29Ysu+D+X2oT7:j9+mBsU6KS9sSXPLZ5X5+ZqXv
                                        MD5:07B5FDEF9516ED83DA45F029839A5FA8
                                        SHA1:DB935DA4D2FF4CD5108A4A0FFAB122D7D10102F2
                                        SHA-256:1128446C5B0A43FFB7325588C9CECA05DC8FB49CD4FB1721C2FF8F644526F3A0
                                        SHA-512:42BF305269C15D860640F65E28CE44ADE6855A148C9A2F142A0EEAAB4DA75464C47D2EAC4BDD3A46FCB48F7A89759282373C3D6C3EAD418576CCC402F4BEFE27
                                        Malicious:false
                                        Preview:...x.....jH....|......b.=...5....X..=.fi..*..qg...d...4.V.C...fa..m...[..u, G...hz.4...j...LV..._...$6...;..p.._..o.(.q.O4G..Z.q..i..'z$Q......L.8..i.%.z......`%..h>H{...(....X.GH..nv.....O..|..L..e....RgL.N..;.l.D.4....>.)&.L..u. .".....8/...`.....z......d.{"u...J.....hc..",F.|.}......J..c}2.y[2..8.O.w...?4....J............Y...'...B...!...v..C..*.3.........[...P...G..J.A..5.$Pq.-..QCq..p.|........Lx.gF..........f3..e.'.{ ....=?..p.A....-`.:..7..I[T2-..v.../7.J.../..].........L.#u.Q&.LV.+.I.E..R.Ge.(.G.....n.j.....a. ..tA...Z.a..}....d.E..zDZ.y.!g,...]....&$.A./.=...d....^k..#....[G{L....c,..:f)m....8.....X.'....."........T...Pex.{.H...[(;.,...L..Y.."b...Iu........{.]O.....<.s..q.<.|...D....wi.l.c,..3.]3.......>.u9Q...jP{..,.%..d..i}.`@..}W.Y...a..DN.B......S0Fzj..9.....7..X..MeY.H@.Bg.XV.;.4..Bv#..%._Oo0....Ti.V..6W.X.u.pg"...T.?.. ....=.......&...Q...O..G.Bm..c....M.v....q..+............+..?.Q.P.HY..DIaV..rm.......1p.vjL..E
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.854208242947432
                                        Encrypted:false
                                        SSDEEP:24:el7IXpaQ51c0ZDmTQZFhlRAteOH97eDEdGdf6l8MeX2oT7:ZX8kcgDnZFCteOJeDJx6KMeXv
                                        MD5:7D027971CC80CE39781DB8F71F9EAF72
                                        SHA1:73B5064B11871BBAC274839857B6E5FC29CAFC2D
                                        SHA-256:2180626F12B3147FE380F447C95F2A4A0E122E8879E4D635942C65E8D2DA1E70
                                        SHA-512:AE170F33D9121B2916242BD6316B2D34CAFFF3982814DEE5AAECB3A4D10E07D6885AD35F58FD82B5A2663AD09996BBBAE39EF5E96868400DD09266EC2BB7C446
                                        Malicious:false
                                        Preview:.:...]<......+..}.....!.A.$U:8.F..g.I.[L.....2$..v.]a...`z.B...b.C....[Q..}_8.l...BO.=..;.d...k.v...u..?..e....P8.]{...J.f.9.d..q_......A...!.0._.B... .$.0.,K@..? n?AV....\("nC...>M...J.r..k5$...B.o.h.9...k.KOe.}.Kz..J..6.uN.#!..D.^$.J..Y.?!..~.......t..J...............}..(..0Q.=.....-.P(.4.....{W[@..*.uk..5..c.+.x...t.{..bV.{.qB.t{60W..5.>.LA.....(....-..AGC....f..^NJ%..Y...C.......~..2.\."'sW5#r......fe.K..b.n^F.%V."Q.....$...KA..y.[M...Sn.q,J...?.l..jA).....!..}q....di.............PK\....M.<U..W.)g.o*3..I.l...t....>}...n/S...x.I].a&...Z....3.60.O..${......U..s.^."vc"........?.P.>..2.Lc.l....x.c6LZ....B....T..:.~.N.....>..,..u.:l...7*..l.!......HI.+.U.....P;5DS..gGY,...'..Hjw...^.s.......h)...eI....E.'.4....1.S.....M.....DnE...~C5..g..0\-..*`.H.{Xy.?a..~dE......^.:F..p...m`6...e..n{u1U.m.x...(..f.R.K.M.!...:..;B.-4....@c...11^n......%/....}.5. .S..w.0+..N..!.Z'.{\..Xx...@.QdeU....%-s..".I[......z.y.u./..lC...j]..N.le..K .p*>j.
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1267
                                        Entropy (8bit):7.876531388299395
                                        Encrypted:false
                                        SSDEEP:24:SOaX+qTyDVstD+jyXoxev6Lnp2pKUTfnoAm/mGX2oT7:SEqGDVaD4AMpjUboAm+GXv
                                        MD5:216013FC768B8B82539363268FA13643
                                        SHA1:D53CFD3B46D8FF21CF68D7417223AD68D7A12863
                                        SHA-256:9AD6AE63A7FEDF8B51084F7B1B96BDCE75F149F236BB5B20CFE5BC43C7A44BC1
                                        SHA-512:D60B55B3FC33EE67DEDD9ABF87D9E81CC75E7012B88216A6B8C57FB6AF9404716C0A9A607664491506E7E635C89316339330EF6950BC03F6FFFC34B62BA7E136
                                        Malicious:false
                                        Preview:....[.N.....C.{2.{q/...}....5.Y]d;.:o....5Xb|.P.....v..e...p.x#....@T4.....=....o....TOG.z/....~<E....<.i&X.q.pDHA......r.b..f.q<..nD....:.o..Kq..m.L.^.@$k..IO..(.?.........$0nrul.E']N..w..q'.Mk.}v...ap5..[P...}!.e.......k..]..2.wrH..D.uW2y.M..v.4K...5._R...S..m..'`H}I4..E.....4E..M=..W.F..+....S.aKb.4i..z.^s._...F."..w..$.I.......Ja....*.t.Af.."WJ....aA .c.M.l..8d..n#.u.I.P[...9........A..S.......u.w...c.\......?..&.."...2G....,.."\t.......9.....CZl.Yr/M...!,.BA.nE...............+..#...J p.....k.Dt....<\g\.\..!m...'.{.....F..].....F..p.......gw0....a.:Q&/m.P...+$..ad.t{.z...T.kB....x........>..0.".x......X..Mj..4.x..FF......ko..8.h@.8C..U.?MN7........W.^.s..A....U....G........}p..K8......#.6tg.{....."_...Vr...?%.2.7Q...B...;.Erg...n.R.h.s ..H..xJ.F .p{Ycz`!x..|.T........,Z...K...!.A.|...J..mwi......e..3..~..$.#....\:.)..M...Oq"K{8.H...9n...nn..]...>........fT.......=.L./...'y[9..p..2d-...7....,j...{JJ,.pk;..-..SZ..;..0w\..}....hT?...e...D\LU&
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.85366421951069
                                        Encrypted:false
                                        SSDEEP:24:2+feNhhekiTTkSl8BbfUvktOj20mr3XnBIhv8Yf6GhZqnX2oT7:2+IOkSKbfUctOy0OnnBIhEONZqnXv
                                        MD5:03383A1750457B7C25C75167FC7B5450
                                        SHA1:BE916F5A0C5DDC1161F24042A871C12796D9BC7E
                                        SHA-256:E8349A40BE86ED35BFE7E550AB2B7880A2FD007E7B958F5CC7BB57CFC9CBF68B
                                        SHA-512:FC9065E0B0EE773286376C25883C6A0BA0712CFD97E6FE7CE1B13ACA4FA2B85978616B0999F75D3DEDF85764B39D726D097E9AA5A3ABF634CAAC86C86291CFEC
                                        Malicious:false
                                        Preview:....e.....~.:.K......_....6R.,2.&8O.7..\,K........-k.g......M..Y..'8gp_J.............y..v{.9.G4..h&)^.....=.A..W..>....(...S.+.!.RHI.q...up.\....q.U0..~.k...`._m....v. w.4..\5#f'..=..k\ .P..n|.z.\.P.8.Rf.......`.0.....d...47.W_..:w..\..f.P.i..V..K.TL..k............/.....FV..Qd.x!;[.%0(.svu..I...9..v_.H.V.E...NV...cC...O.v.O0..A6.?[up@!....;..Y(...h.......!N.....2.W|.F[..{.Q..f...d....I.....Q......8.c...f.i.....m..CrLP..m$.......^.......+.F<..d..-.O.....27........\..k1..ng.Z*.#...Z..-gJ.D_..Um.50.t...a[>)?....u(.F.....Lrs........|...o..$@Xn..FM..@..v>....'@.e_.Z|V../.G.o.....Gz.h.A.?..".W..J..t".......XZ.e..Ul\..=..[..c.F....a8.d0pY3....>.3."..B9.X..fs....4..../.2.o=...1......$....r...[.[6J.D..... o.!..J.47.r.x*T.v|.[.".D3Q.R.?.4..".Y....v.V..Q..%7.wU.).I..v.P...\j,u...5>......p....3T...V@1....._.'..H.A.j....}..,...pS.."..t......c.4..)..H.T......P.,..QzF.-...S.H...F[....~BY...2..-Z...1^=.o.....JA. ...J....,.{.P.!.#..j.&.o..z..Y.r.~..M..
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:modified
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1275
                                        Entropy (8bit):7.831886832437183
                                        Encrypted:false
                                        SSDEEP:24:fXGOD78pbIPYtdBrBYc85wyXSNdEzcRNZsHh1XStP2RvO1lBxHZQUKrvFxG7X2o/:vNDWIPYv16PSNdycRNEzXSx2RozRPKrK
                                        MD5:96317E5D0DCC11531DEAEC149BFC1DE6
                                        SHA1:51675F8A1B84EFB8D97816FF973E010003ED23E6
                                        SHA-256:9B272AD70304756F11E1F939CFB53CAEC7F63626A6B9F7B3B2E2FB5121143658
                                        SHA-512:640EA123C2270FFBC83E16A38853B30966EEABBC8C58C110152095113D880DF8A7A7F9CB1DEF10B959627086A022091870447294590B91691FF55696E28AA2CB
                                        Malicious:false
                                        Preview:..D.....sT..RS.]$}G!.............;....v..m9..c.._V..J..w/0%.....L.....l..\.].=...Y 3...wz....}.....v_...H..w...(7y.)qy...sU...i....U../..9.>....8WY..:.....Rd{F.A.Ze.....Lj..]...2.(..i`k`'.:H.k.5..-T^.Vo..x...d3....../..T.R.E.....W..?.g..B...!K..E...D....^....<Z.......dp_....X]di..k.S.b.U*.u(...._...$.t...xx..m.q......8....q.Vx...p...X..V...W..~9...A.X.......Jr.....v.K.1-x..o....{.ke[..,}...|...........|....mI..+#GB..s3...g.c.!....=.......,q.;RX~..H$.....RQ6..'.d.....X.....?.^...S.4..{!...M.Lo<.[).5..#..Wg.....#u.;..F.Kg?...<C\..!R..G.....:y.....8..8d..1.. ..V.Ut..#..B.%G...C.`..t]a.3..ec.......A>...@^}X...g=.I.Q..N.....s..3.d.]..!....kS5.m. \..;...r.o.f......G.r.g..x.:".=..`a{...UM....PS..?AOd6.>..L.m...H...B.?.7|C_.....ka....e.:.... .....L.;.z.V...ey6..xE..*x........#F..7.r#RF.6?....ax..}?.G(.5.G.FHa..0.N..[...(...!...x..h_...]..._..3Svw....Q.f.F4.e.....x......q.%....@1^..../?....(P..+.ys.H..X..c^m=.K.W%.C.....R........_..Z.4Q.DD..*
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1273
                                        Entropy (8bit):7.837416445227854
                                        Encrypted:false
                                        SSDEEP:24:c5Ui6WtnPGvFlofe4PAPtbTqojwVcTHijjC9zCKTAdX2oT7:cGWx2CfVktnL5j++9zCKsXv
                                        MD5:62A0ADF5F6D922691E071AAB7CD7B204
                                        SHA1:FE9A8E99BFE6BC44AD1E2D77FCA693ACCB9E0260
                                        SHA-256:6DB72A4C134D4BC2007338F6D19E4D2B4668E7ED65B715211B5366F503D24B64
                                        SHA-512:D21EB30EBF8F19D1E1F97BA03B8FD68FEF636510792F6F75838423E4776D6B446967EBDB45334957F106932FF847E29DA2A1A9E39367751D90E41CDE6FDF7FA1
                                        Malicious:false
                                        Preview:.m|*m..;.m:T?.v...%r..`6..a~.!.6..F@.....XE....`...b./.0...MQ.. .E.R..{.G1..vk.PT....q..:..Q..f..<.2Fb.b=..pW_s......I.K.u.N..c..t4..Wy].j..S./...X[."..+U...UC....1.*D...J.R51..b.....a.M../..<.M...dX[&h.(D..e..{&.N.y.x..=...........tx.[;..a.b.Q$.^..We.{3&...i8vN.`..2...@.?..C.'......R....,..L.E^...... .[:B#......[~..t`".l.1.R..^:J....=....~.v.4..B..<k.k.........P..I..6...#.....(oF.&.j.....T..fM.1.Q.m.6/.....h.I.(..p.\. .....JP.r.@........y..#..m........3..-..MLL\./{..Y..1..jCd..ln.V.2#U....t,..E.....Er.}U.".\fU92.z..o..6f=.G....f.._./l...("\a...(.....0"gV.....a2..|.._k...{/...=Mc...}..[......./L.%5..T.....#V..h%I.[*....)........Z#..u.....-.f.6.......H.Wr+[....Bo.4...j.....@....'<1.~1......;...TJ.Z..o2.aH? 4........+.....w........?..;9...............+...1.*L..}q%!r<....4.Y.[.t..Q.@.....Dc..~c......l~`.d...). ...lx...oS..d.7G+...B@.. ..4.-....M.N(.!.v.I..:~.o4.].....C..B...2.l..oy..Y........J..g..iVR..3..}9....e...E7.U......'..y.U.n
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1268
                                        Entropy (8bit):7.86084891549607
                                        Encrypted:false
                                        SSDEEP:24:uVaBET5AkFLiYlciUk3q/kUSfhWp/IGvaOBZOUdLCuBP9lJ9P3Y4X2oT7:2aWFA+Uk39Um+IGrBZS6l9P3Y4Xv
                                        MD5:FA53AD571C067D635FD648D45D45297A
                                        SHA1:AA752072BA5A66B935EFAD5C2030BA1DDCD26B8F
                                        SHA-256:5AD47C148C6E13F5DE0373F404DC91104C68DFAF66C93E0007EC144F04AF9913
                                        SHA-512:A56A6E9D67C180B34684BED3D9888524C3A99E3FCAC1E04E21236AAA35A4991BE217A635C8D265D4A6481D06C06131560455AA2E6585BF5B3DD113F1C8C06FB9
                                        Malicious:false
                                        Preview:.........9[.%...%.N*Cr.....c..G>.JhC...Sh.b...a..X...b.(........i[.Y4.,.+.1...+....oQ..N.....U.w....../..k.2.p...j...Q.V....;.!(h....8..s]......7v.gT....R.bU.R../O.&.......*];.&>..A..Zy".. ^e- ...Q..x.(=.J2k.s.......f.'..Of...i.#...4...>p ..j.Y2h..'Gu....X...0.+...<?.x.;.@.....&C....~P{...g.-|c<H}..1..'*.2..Bb.:....K....Jp..&.....d.R.!..r...;KO(.-...3.OF.yk:....m8.F...`y..tZ.\uX.$........`g...A..h.LC.......T..U].....U....!.!r...#.).U..=.K.z....'P7I.54P|*.J.7..gd.......d...>..e.....>..Xr.G.)...y.pk$bH...T.9..zS..Dv....i....}.'Q.p.N.^.A..\.....J#.hX...3.\...\.G.n. ...).X.y..f.W.........t....h ...%....X.k..3DbJ........e..]...2F].s".f.=S6.<.a ...<...q.zY.....`.@@...g7.6..8...?HW.........c.#&K.2.7..sT...&@G$.z.sodv.0...bh.. 2#i[.L...........~.k.+'.{C.Hefs..K<.Q..5lD0_...T?.~O&...c.IK...S.b.M\....x..jr.v.......5...2..^.[.{.F-....iH.h{....y.....JM..u.H.."....a..:.1..@y..Id..6..f...d.&......Nr .DDto.=M.Z.y..z..4..?...{.,..oN..r...Z..{WN;A...'Z...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.845952284202222
                                        Encrypted:false
                                        SSDEEP:24:YBrGqc/6+f/l30SpTrpICG94tATBUGedOiE0ZpEHVnscEwygFKX2oT7:YBqqCft3ZBTGVNefpE1PEwyHXv
                                        MD5:72E40AFED09CEF221E4B22C326476F09
                                        SHA1:2FB4CAFE0D4ECD886D30D9C1190440F8A88DF32B
                                        SHA-256:EDED8C6A3A6D95B133E4C7036DB8593A8EFE325465567A0F3DD2E08AEF24086D
                                        SHA-512:EAE45209E22A2561D6DC740DB4658E68BCCE7D598C9C2DCEBA6BD61E9B6B8A5BDB1729499665F2C7D4C87C07CB8D4B4ECEFDD4C4B929184A66D3E9A6CC24679C
                                        Malicious:false
                                        Preview:";.Yc.(9......*[..{.....!....<. #..*....-.C.'w8..A.....<b.f.H..B....5..t.q...7.u.e.;...*.d.<0..s...p6..&[C...g.La....zR...8..Nv91.(.T.M....h...rI..:..>.L.....mT..|.*.........]...S.f.E....\.........*G.do....$..d.T.eC.G..........(.hr..T..2.z.."....ssY|..A.e..ow....Lr=..7..(...0].)...o .j.x`_.:Om..jq...63.z!.q...R.6.......Z..T..$..^......C..=.M1..6..too.....J.Ti........)F.N.&...\5.m6....H.?./<..4.}.\7.W..:.............1$..{.Z........>3....KR(.@a.%.....8.G..~.@pDS{i!..n"4a.-G.D....8k....r..^........0Y.r.H.rF.C./.@TeM?.....]..qvG...]....s.f0tP+.=.#".y......=/.......M(..."~...M...A...=....m.].s......lV....g..!3.......g...rv...=...).~....}.f.2...Q...*.....b'.l..O...~.1y.h..Y.Sh6.%...B.......ba..K...G.....r../.W.x.t.c.MM.....Mjz.....J*F..%#iB......Y..j..we.Tm...\.K.....W..S......7.p.........7r.^PK.F-.....B.*..|..m4L{Z..WtJ..x2c#.<.X.....pW..B....-GQ."...B....j.t.\.)Wh..F..I0..d.`.$r....G&1[.x.m..h...i...A7`..X.^..N...<..V...%.)8..h
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1270
                                        Entropy (8bit):7.853852605698707
                                        Encrypted:false
                                        SSDEEP:24:djFTnJUczYFyvcBgHBFdxUvpuDkPGwvxTUGeb7mHsTZ6U8X2oT7:/TnJUczYFyvcBqLdahuPWxTde3nTZ6z/
                                        MD5:7C57E124D4A7D82D40EAFC01E0480DC4
                                        SHA1:E854FB29FA6495CBDC6C5DC48D3E45999BC4E3B8
                                        SHA-256:8D5C81D3C022D18CFEAB53B472F3011283077692EE7ABE4D1D44A092F2F87FA8
                                        SHA-512:BEE588ACF5956FB601064FB00E37DF7028AB5F1585E7E744E443BEEA28D426F2B613E69B0BEFEDFFF7A882E8EC91326AF9570AFCABF68E3E774CC0B4A7D445B0
                                        Malicious:false
                                        Preview:...X.I......g...N.....b.x"2......2.t.y.<...F..z.K;....?.....<p..+....v...7..f.b\.......F..ZN......i7j."...#9D..B....e,.."qB...7L.I...J.+.d....i~`..G.l.n.....D@..oa.eN.H+,*..Pq..o...%.<...JB.. ..Y?.E...R..p...m{Q..dT..zl..#$._..`'./......8P N...(...^/...zo>)#..m*.]G.'."..Tx...c..&.D.d.v..J...{@...:X.p,u..4...N.G..T.......?.R.q.(6.j...K....'C4.6......U......X...`."H..1..C......{..mI.....-h$!..H.....jxl[j.(.+|..Y....G..<..3..-.WQ.D.../...^.f.....ET...Pb.n.E=....J?(.:O..7.!.....Wa.+i.B.cb.'.|..4.K.M.e..v..I.5f"....R..l..D.;..S.....[7..Z.l....M.,\..c.,...O.7.Pql..%k....vK..U0."O..xu.RE-7..?5.Y...K......UJV.]..g.C.F..X=~!..u....B.[L.....D....^..,/h3Wj.J..=..V.*v.%..G.D6....$.j!C5...j..Bi.'_s.rk.n$.W.0.d....=}./.'.].../U...g&.|.....>*..h..~...H|....i...A..D...&..I....:..@`...s..I#....'BoL*....K...n.*.tF....*C...A....>...u..T.&"{,....%9"..uG..vU....:..J..?hR.....A..-.....7..../.<.G.[2...I..;R".0.L.....0D..0...gA.|.....l.q;.."..l...oq..s\._.......
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\ProgramData\D9D5.tmp
                                        File Type:PGP Secret Sub-key -
                                        Category:dropped
                                        Size (bytes):150528
                                        Entropy (8bit):7.9970376816949855
                                        Encrypted:true
                                        SSDEEP:3072:XhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcPTe/AHYKS3qYuAhSwdshoVxcq:XhldSoVxcy/J3kAhldSoVxcy/J3kAhln
                                        MD5:06FA60F5A1EFED722B37FB0CE7771CF0
                                        SHA1:80973026C6F2AD688F84AB00912BFAC9C332D3FE
                                        SHA-256:3B8DAB7E5B55111C3FD007C05875841D9E483E57F31C3D9AB20C1B66EAA22ECE
                                        SHA-512:E2AF7AAA0282351B72B8846AF2EE7277FF02734BFC00824D195C34CCDBE2C59C04C6E09D2E201CB214D723E03296314C7D7B90D23195BD896941C3989CCC123D
                                        Malicious:true
                                        Preview:...6..a.....P.G.+.T(..tYHg....f...v..![e.u.3.Y.A.t...._E%.R..Q.......v.9,..j.O..|....Y.|(....'H.;...&..&......`O.{."P.(.].8v.TY....o.......~..&.$;.0[...0.$......X.[[~*)+.......0I.b...z...%A.....9../..7.#.c]..?p..c*.."..o.)(D.[..DM....2J~.s8.....j.;.....9..s..I..]n..6........ .....k.b..Q=b.S.r.;.a..Q....EJ..].Kd.d9....oT..m.......dCE....S..'."_..U....K+..1p.|w....b;.z...Lp.#..".y..0.-.9C..^.)O.i.8.Q...`R.-..n\..3w..F..P..Il.'l.....&ZU..)..\a,...\v.....ha..}..cF&...5.g..|...5.I.@.~..5..M.G.......,. r......{%....o.A..\n...r.a..c.do9..).uYB............:#..g..J.DK2.L.b.Y.nK...mM@hl...E.f./......Y.}.q..L....C...........Ww8D.<.M..,.r.%`.Z..Hl]..s_.a.K....G..D.H9n..D.n.....d.....>.L..0.+.y.F....}R.........S:ks.K.[..^-.~.....\......Lk..zJ.J...<...yI{.P.z\.....L.O....Q.=.W..L...$..6..n.....S...{.u....a.3..(:F.u...}0|..........x.=...U{.....(c..@.f....0.K....r..R......../........v.`>...ANg<...?....C...s.zU057....|........>..5./..t.q2.+.e.d..$...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.86393860695395
                                        Encrypted:false
                                        SSDEEP:24:qm9LoGnz6ku0MtJGstvJQdGOjGDUmG32PMVa8WADE7umoqiKOGX2oT7:ViwmpbjsaD832PaWvxFXv
                                        MD5:EA8AEB98C58AA2BFE53A73556CE1E66E
                                        SHA1:60CE7090FEE7C143C407A0991A94BF4C39B6FEF4
                                        SHA-256:030BF68FEBAD5F087FEF3E2871DEA0915DC87619BE70E5B1B4EB1DE3CAC13069
                                        SHA-512:D66B5F6A2BD0DDE25CFB7502769BBF711003BADC3B40677246529978A6B022A733A99AF1CDE86A4EA143F19F1FE8ACD70D86126582BD0C4172427BFBED70CCF3
                                        Malicious:false
                                        Preview:.&.0......bce.h=.p..E.<..r+i....7..w..gP..B.|...#.1..6Aj..Z..w.M.bILL;...;.....F'8..S;..ZJ.5U_..Z..^5.9....<..x..d.q. .........u.7..Z2.W.......f...Z.>[.j._......n.AYN...b...q'Z.i........C..Q9..:..%QBZ...B.>6.|.OL..c....dB.....)8C.....H.M.l...om......U..,..Mr...t..^....!*...`...........a.j5.......3?,".M..p.......@DJ..Z...R%#|p-T.T/...]...!xC..Ek....+.{..M7..s3.=.....v.(#.....s..?... #...Hjt.....O.B'<.X.......R+>..2k...'S.:...u..Z..e....i.Q......}u.K.....>.AZ....4$N.~.+....`.....{..n8.EW8c&..ef..\?i.\.[....|zY.Hw...U......x....d..5...r./>.k..Br..{.....z7.B........a....,: .I...~.xmf0#..0.+..}....US!"..*.0.}.)...u.V..i"C..Ag.e....X...m..}...z."O.+.S. ...@...FJ3..V."..5=.i.s......)4.g?...N+w.\........Js.A..Z.2...0.0O. .KO.I.........m.....4...~..WW.8..P.::..0......CDI+..W`.....x+S.&....$s..7{...oF.zG.0>.@..B!T...C....i...Ag....}*t.. R..8.....q.....q........p(..c.,!g.L.G.......D...Q......T.R.p.DE1"...(...i.<..NW..m.x4o.{..>}.."?l.!R....=`).".".
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.837579519059529
                                        Encrypted:false
                                        SSDEEP:24:IZ+GtLrmB1rbleSsdvP5lVKusNft3iAlYPCPeeLZIX2oT7:IIG0nrbmdplM5ZYE0Xv
                                        MD5:28934C6D99310AA959E8F8A99396B750
                                        SHA1:7DF02EF6E021274D1897F1B6C2AE2A6C436B1AEC
                                        SHA-256:226ECA775A004E8B292682E2A8A9AC5CA7F699077F815CDDD7F77674B75510E6
                                        SHA-512:EFAEC3247B461C77F7CE6584AC2B2FF080BFD7E1017494121E3FBEBBFEA6492B4C1A79EE7FCFB5F330CD5B89CBE87278CCD507237A37DD98438288B250213110
                                        Malicious:false
                                        Preview:...s.{%.UdQ...L...x.B..W...lN..4.M....R..6..s..."...]6..j-1.Z.r.....4..{...".TU.&8.....M.O..j...W.....OL.m=.]PNV...vA.-...h.......<..]HeJ.....V.A....zVVm.R.n.z..."..ie6....?...~.......Vs.....D.......6....{.:.Z...9DYQ.";d......<M..65..ZEp.+..R!.~.1.K...d.Gz....7.v.hk...<+....!...........X.c..N#..S<H.^.......{.hn.=<.....a....\4...}..{.R_J...'..3.^.|vy=........rd.&..OT5.....e.h).b.....r.k_._....~..Q.E...d...4.i.)....=..g+....n.F.w..k<.K..[^W.....v(`*.Y.m/BA.L.xv.LZ.J..{...V&......`.(......c........|e;.s.......ita......>dF>m.P...a..x.c.M.~yi...R..4aPn...]....IM...d..s.v...Xu"-./...vL....3-..".J~^..UV&...$...t.xlPs!}..|[...}........*..v]..B.-..}...j....x..k....SP@G.....I.Y.....a.`o.M.....@F..4.r..).c&.<....tq..ZGg.fn..t..a.d.(.....u...........\.&CA<P.......Y,...)..c.........G..........?.2.EMl.+7..#|....oY.....VMG..K.(...;........y..|sF!..u.....G.Vo...?.........v.F....F..{.......g:..$.s...vD.bxAD../oRP}.:.D.G&\..y.0w...R.NlmAU.....H...(.[t.W...@E
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1269
                                        Entropy (8bit):7.844510026769595
                                        Encrypted:false
                                        SSDEEP:24:rQFiJw4GIEF40zqPQjT3iU8LF3KAKKpLYSXC/nwt00XVwrCqzX2oT7:rQgJ0In0zV3SlL5K3g5ewXluCqzXv
                                        MD5:6DD27D6977CEC1B7AA57D3AB0C76C9D4
                                        SHA1:A5DA62E174491EDB1C7ABD757B462D06A19E3E03
                                        SHA-256:85EEF83D3E18C8CF045D8B38B0F680CF041325B6FCE9E6F3D2BBC5C0E5A9003C
                                        SHA-512:15E59DB862867C996213F54AA30FE3F236CF38A4E27776B062EB46109482382DDE81ED6CBBE08620170A5DA012332635EC37D77A9B5FB17659F0CFB32BF0D093
                                        Malicious:false
                                        Preview:..:..5.....7n.i........{"St..~......sXJ.$ ..u.'x....Z...p~..v..../.~w.`;0.....d...N..9....*..P@..}6.a.4R{.....+.^;N.`Vu.....+.;....c*r...(..t._....%......p.K.N........!2.......@..Yk....u..8..y...&....'.Ee..n;M.*.a .b......P.......K...7.w.....mb/7.M.7_3......S..?.k.B@B.M..."h.`.h...sT4.....$.i#ms.....,...3.....c~......5.&.|(.............O....&.R.S.7=.P+....ps].S.Pu.*2TV........my\.......-..$......a...i...X#.Zw........T......f...$...uX/j......a.:..4....d.I.[..6e.a.J.P.v...C.gm...>.j.C..3?#R.{....7........a...M&.p.Ml.s.i..TIS.:..$mT.t"...h!........J1..w..dO.O..Z.|.Kl!q.-..%sC...\..91?....d-.`X.X.7.....H..\.M..FZG/.~..._h..6.>.6.......=...Z..M.1fv......<nO../.f.8...4..].c.u.@*.!..?#K..c4.~9BcLe:..;....x.I):J.' ..CQ.'....]_.n...+k}k..Y@..*.$....`.tvh.]w.W..O4.:.W........I..=3m...t.E.=q........VY:.%...P..2..H.*..d....UE#v`+.X.....;.99UI.k..T&.$..:T.pJ.X.tn..."..#..2.3.-.t..ty.W.p<9.x....k{.......S8....g.......X.t.1Z.0..X8..+..-.t....r..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1271
                                        Entropy (8bit):7.85727453429031
                                        Encrypted:false
                                        SSDEEP:24:NuYpvaMVQtsXWjSZ6qwglwfODhx5Ji/Y5q6nzGbwP8lVrPVX2oT7:8YpvaJVjcLwKPrS/Y10wo9VXv
                                        MD5:9CF2FC7EC5AD3C99C45141F4C76C4B2B
                                        SHA1:EFD71D6701B92444CDE892234958B1450BAB819C
                                        SHA-256:B7E9755192A3AAFFFE331E69CF107805B608BFA1D5AA42A704D419FF462CB6FA
                                        SHA-512:E0030CC734662011656F1A7DEDE2A6A9058AB62EF1D969465AB71153113A2252E6E841B8141947C1A4F42FE2F3780D761A59444554CBBDBA243946E68E7DE4C2
                                        Malicious:false
                                        Preview:..Dm...^.~.bOy..k1.d.7*|].BL.ao.. D..d..#Y2.'.x..}t^dC.O...b....(K.-.....@LoN.S.)2%..T.Y{.2....q.5p]Z.#Y...gU......].V''.......n.]yU..t...a^........d......a.G.56...b.'..^*?Iw..p.O....6P.,_....O.5.%.Iza.....#...Jl....?.N..).%.......Q.s.E/k...].E.Xu.#y...N0.l.....*-.Vd6...#.m......<..d......;.J[.h<........dc..I.......Q..%4..Q..iUB(E@M.n.^...v0.a*s....."........M.s...~...%.....^.3....,.5}r...".M$....&.1k.9.'.H.......ZxO.=.!..Q ....[g.=X.!.v..........Y....Y=.......fWi9.....D.....R..e+...z..."..7@......W..Av.Yq.`..l*..A...).(L........|..V....{......^..1...`../.)....F/.tAB..m....?Yn....`e&.......!.......L.....o....%Mx.,..LA...Axn....e../....u..y.......}"...RP...m....I.*.. ;...>.f<....)h... .6^_..w.....F..\.....L..fey....7.3.`...B%..\.{....`..U.O....qX..@..w}....p..l.g...*6&F.Z.'...<..v(....&.]$..0.R.....)..g..U]&.EP...d.$k...gi7M..=..............5E.y..E.].==.(OC..2......5.S..!.#.j...*....?....bw..A...gX.W.s........"c.Bx..g.#i(...s..*(....7..F@....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.856451004164777
                                        Encrypted:false
                                        SSDEEP:24:Qt6rF1IYmfarybfiudRd8SMmE1tSbo5OcKXmNGNBoSyi4uFegS9uwdwrLNkX2oT7:S6rF1Iu4fiud3E1kwGmNao7oFeL9PAN2
                                        MD5:92307D9A7A215026000E8E4A76E04225
                                        SHA1:54DF4FBDCDBDAA9BACC0CB8084810F6B256BA0E4
                                        SHA-256:15107300A73C88B6083AB8636AA6C628EC2445C9DB0661719EDEA7BB60DF431E
                                        SHA-512:06AABB73B72562E17B0C168530D4D2C130119A4F9EBEE0D9BE84DFB6ABC614BAFC52DDEF32F9EDA7F0718F58E3F394B09551B982A19DD80EA828054075B293A7
                                        Malicious:false
                                        Preview:.$.p\..D.....b......<.l..'`.......ll..A.1.^.7P.k.}4...t....O..T^OZG......bm.E.....Lq>.%d.&.....8.....L......s.C..q3....<..x6..]t..G..7.h......&....6.....f....I=...............8X.@.G._...v........_&.n...d%...(y....Z.V....)..a...:3V0}k.4........2.Ye...b....F.....{..9...{.j......$..&.'...M>A.....PY..aU%.TQQR/@..O.....l...`e.>'..).,.z.Q).&.....H.;v.....`U....?...H.."...h!.*..........4..%8..)u.'EK.s......=Xl..EY@.....U;1....*.H......V...o..%..z......Y...<K...?......b8.z.l.S.PL4..J.d.cQ.Z..+..g...8'..1\.s1..jL..^'4.&.n.............x.tO,...U>D.;r[.x*..u.....6.8X.k.......c.n%.Z..A..<<."..0.gI.S...o...g..-;.K..v..7....\.`..O@.p8..O5.(....;........r...f...??.{.,.%....A..D.:,kr........w.l.W^.. ..S%.Q...]..UK.Q.3M.=...V..!kZ..%#...{.].....#1.........b..%N...\{#U.....g.WJLz..n1}..@....m.N...i....H ...j..DK...mu...$.}..^..qA;...G"pJ..!#._.6.e..!.Y..=...B....p..I..Rxj_5......:..'..K[...w.+..s..L.h.T...S`..*...V.M.H.d..'."...OP\.1..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1274
                                        Entropy (8bit):7.851626888737249
                                        Encrypted:false
                                        SSDEEP:24:ZH2Gj26A4QORAw4R7uySVhhxJ3Zx7Y43+wVSjbCFqpxKXNJhgX2oT7:ZHfjVRALuySV5NZOjuFqKXzhgXv
                                        MD5:EC5ABA4B8B541854EFFE403D3F85A225
                                        SHA1:9611F7BDF03E7845807FB3C46755923D5E6147A5
                                        SHA-256:7DEED3F8C408341F20B1403137DC78D4D98A64E296CC566AA7B91DD5823643B6
                                        SHA-512:8BC064F73C931E2149DA17E837EE347B675205710F8BA78B642320EE3807082C9AA45C8181D7D3DB9BE33878E24C95FB9110390B490498774A1CBAFF673F4C3D
                                        Malicious:false
                                        Preview:...3c7y.s.._.b.Z.7...S..h>..J.I.m...*:z...}.W........`..!Z.j.;.....\jN..".@....,.L:.....x.......&.Sj.p..S".|+yq.y..~Fv.\0a...d...`.z..;....[.('t_=s.g...4......gh.i.gjR...(.../&.".0JC^37........:.8.x5.C.Z`0S&....h.(N\..L.GK..J.Lw..~V?...F64..Wb([.@.i'Hb8Qi.Z.Wb/8.uKt.N{...~..XP.a..;...p..Ef.....mA....f+.x_=...Nf^.o..`?.........y4...$?~5y...}.%....W..V..ogh.............R..d&zr..Bc+SQ.|....[p..|(%...%........R.......6.I....Y.=.7.?|K. V... .%.6.E..Z(]g#.j."....(K.I..|.T)..h=$0!1......p..u.......G.*..f.O."c.d.S?...r..i..../.k..C-%..rmy......*.[p'......[,..-...SV8... ..S.....3~7...}.Y1v.C.......|y([.^T*n.X.B._|..u$...c.......X..E.......,.;...!\....;Y=.{5*..h'.8....x.5l...h..i.y..9H.6&.%*W...iJ..42.......U._....;...C`...:.e~.P..!.Tqlq.z.w..C.6.f...V^..=r..4....&.c.=9Rx...D.5..:.^..<........>......\.D.r..S6..M.R...i.~.G..-...).. .....;.L..m........h....Y..qH..)_ ..T.d.$.I.,.1.'..Y...0...3...-..5.rd)f...........X9.h.}..,.|s....e..~>..x...=.Y...D
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1270
                                        Entropy (8bit):7.833678801493912
                                        Encrypted:false
                                        SSDEEP:24:N9nJ5HPUbMWEVpDe+jx4ZPJtXNVS0sl0m4lJ8bNemksubJX2oT7:55HsQWEVpC7bN8l0m4AZRubJXv
                                        MD5:C38BE0B76B2644B62EA962A32B80A893
                                        SHA1:72077099DC21906FBE277D957D03ACB8CFC154BC
                                        SHA-256:ADE5673EE3BE653D64BE85C62935CC7DCC7182A06F33CA8A1C33F8D8AE3595DB
                                        SHA-512:8DF8D9AE5F21470594B57FC84A7863C783903BA24BCA60115CAFE6DF3403D42A45C54B16FDB302B5237DA4FBF04B3CF07EDE9CA69B6CA944E88020B06AA0B308
                                        Malicious:false
                                        Preview:.f7...Z.n.....5...F.f]S.D.}1..Q$l..-....r.&...'V.H.#..l&.+Q...$:\B:.Jy_5..r...'w...%...g.....~6Q.#['..HY..z1Z.g3.|..`.4j.OW...M..#....^..v... ....g.u.......9!.s...^.K.q-..hSi.{2.:....r.y...8ja....T......Jj./.g....pJ..oqF^M&3.&......%.$z..gA[..E#.G..?.S%..%..T^N8hH....#.#.."(.6.3......~Zc.i.f.a..#.[.o........@...{...*..sQr..RC.K..../.. ....\...PP...zqc...C>.... .>.9!eT..Yj....+TE...|.W.."d.h.m.`.h..H$..~\..D........-\z#[..C. .....?..k.y.;s...+.f^..t.h._%..Y1...n..........Cl..........a.....i.&..u....x.................%i9....T.W.e7x...Q@i....;......G.Y3...M-.NYuE.o.e.=.".tj7...p....^i..I...H..Jl...%...x5.lRz...+.C.r_..f..``..=....U.....h.N......Te.6...8.m....b.;a..._!....X5.N.gg..[..k..N}....jVFa..s.y..\{...._.N.G.......@.a&i...].ih.....y.}.M..}......&jcW....>..b..9../,.&....V.a.$......N..c)...q....|...&.Wu...O{U/..1.K. ....@.k.#aS]q.. .]...6?.X.m;@.?ci..@..I)...z4.."X..z....A....6.t.......6......P..u......-.u...LhTV.D........u...}. E..)9.. L.G..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1269
                                        Entropy (8bit):7.846245800993056
                                        Encrypted:false
                                        SSDEEP:24:DLeaKaoO1XhS81xRR90xDnvw8vFKhwin9SD0kXkrC01pjX2oT7:WBqTHcMhSAVCCjXv
                                        MD5:1F349A558F904668285D4B330F711504
                                        SHA1:27E3F109E6C83595A10FCCB321295B5E4D2D4C7A
                                        SHA-256:5A9C0A2E746A638C5E0EA695E95F908FACF4ABE17DA4CDD8185E021A39DB1EEB
                                        SHA-512:EEECB906C2089DB75E60E431965587D49B57850410005C2D82BD1054899D05ECF7ABC8A05AC175C882DD448D4AF15778D6308D7624A5322CB5B26023FA143C29
                                        Malicious:false
                                        Preview:..K..x.Q8.8.L...>....9R..8."..BE.s..@[%../.(.aMk..."......`'..q...p..U..P.!.AzS...q\3..*.Z.8...>h...3.6.........M...O..A$~V^j......pZO..W..,.._.L*z..p.!.....3..,(P&.M.fa...)..M0:.G....P..0....G&<nm...4.p.....?....._..o5.A.E..y.#..io'y...M%4$..JKB!j..kj....h.{F<.B.1......:.i]..-..*..{.u....x...d..q..*...{v.IS.7.?...'...i....37.....C.r.B..Z..{.bP9?...a...cW.j`........m.-.\.35@.k."n...........*..k....bX.....wN.zU..#.`.E...{.-....#p=....wR.-U.g...s9z.]..|.n"o...GR...l.l3..c..gT."."w......[.....Q!....3.0|P.1W.=.y.^CXi..'.H......dm...L......`fqh..U..;........]........fL./nHT6...]J..[O6}L9V .C...... H.#f_....o.AUrog|....`...b.D...FN.._.....&.t.m..<.....T..(1..,N..6.E]./.lf..Vm@B...V%..1.R..d)...%n?.i.`.-E....(0..._.=9..d.k$..O..._{....CQ...$z....V.~..R..8-.[.}h.G>..#vT.F.F*...q.m.......>..XA.._.(K...qc$..Gp%...X..._..mk....t.......~|.K*aE.K.GU..n>A.a..X. .....%....1je...].M.x./...,..G..........*4...q.....rm.........H...U.K.H.<.=U.8xp#|..L.mK..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1271
                                        Entropy (8bit):7.833824135101305
                                        Encrypted:false
                                        SSDEEP:24:YdwNIH3KVOA6sR4EswLed+3C/Kv92r3FilGFOVlIqhX2oT7:GG86VOaWLwLed+Ok63FilDbIuXv
                                        MD5:43CD23D94C9D745C5D3D71196E968FF7
                                        SHA1:62D1FEE55073EE6EB4D5BEE3CD2555EA25B2C784
                                        SHA-256:9AB7DD38FA716ECE5CDA5C7E1CBFF78A1BBB34178F5249880BF6E4DB4C68D9CF
                                        SHA-512:6790FBA3FFD4BF0FE811B613811E5C6474E300070F00671DD6BA761E7CFEF6326D107928DB0CDCEF97EE0C7974D647D52F8C2DA718956B7BF76FDF7AA86872F7
                                        Malicious:false
                                        Preview:z.M%Y!.x..!Z\gh.....:[.$.e..q..\.A..>.Z.GU..k..7...../K...ZH......e.e....}...q........Du.....|..C..BI,.XN .rFs..%:..g.o.Z.8m.MWl55s..}6?Q.8..A..[..@{$.(s6d@.....f...:*`../.@...C....g5..Q.r....m.....^7_y..|...(.(.o...O.n....N.........GJx....."L.Q?)$.w.j.....(C.Mw3.....{8.9..|..Rf..TsDm..vl...OS.-.(.N..e)..T.......a.. .7..%Tqv;G.(....h...MD...*.(|..L&<....v.o....^f.$7m..S................:C..,....}.a.../.k.k.Wg..Q-....m8.2....`....Zw......K.C.-.....QXG....G......#......w...x.9t`.n.*.y..........vV.H....Ei..B...8 G.h...IZ.t.586E}$8...-v.L8....w7F.....z..$..=RM3k.p+X/0.[...o)..Q"= !.@.......o.;...))..GT.......a.{,NRr...:6....T.9.yq.'^......`U..cH..Q...7...IB..=........\nDb....:.4...CF2"..../(.t....r...y'".9..[7.K<....V0X[.O.S.8....}...Z>.%..A,Q....=./.8..#.V.......^.....&..p.O8.N+.....|..'.E.97.~..........(@1..g.%...#...%W."..:..0..".W.+.MT7..I..8.4C.2'...v.l..E.R...+....P&^...A....<V....K.z..G......S.dG.UM...%.c.....h0...?.fQ.SC|D.6..Y....
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1271
                                        Entropy (8bit):7.837882623006829
                                        Encrypted:false
                                        SSDEEP:24:gc/CHzQSQKEdEzEmWTk80AO4Gf825eloUaNSq4YuRxvOWX2oT7:lCTQSQKEdEpWTkGi02V+xVXv
                                        MD5:8C4DD976C3EC011CBFFB6D8E9153ADE4
                                        SHA1:D2190E743DE70B398E0128FEE4237FCE9B3BE960
                                        SHA-256:7D3E0553DA068882666E27299D458FEB7F23CBC894B1B77AC4FC33892CFEF405
                                        SHA-512:A47DC382D308A94748B02B29245B5AD3D7E8A2EC98E28CE01979E7F9D98BA56CFCB6B26CD8DD62FE7C03A80F8929910B137A8F35C0C884FA9E4A6C9E03112E73
                                        Malicious:false
                                        Preview:8]...%C)......:....."..k'..s...w..."5.uC../..h.D(ZU.e....#'....@.S.F.\ ~.F.~...&. ..W.......BzU.C.4....B^ .V...Q_.K.....A#e..U.O...K...9E.F....x..(~.z~B.../.@y.E$..:.q..L.otk..k.ct.$N."...O.i..n....g.....S..........X..#.T...........E.\:.?.]#..$-.....6..z3.oc.....5<...7..O.G.*............)g...0>DG..m..+\Z..pm..'.Z.\..A...[...j..K.....!7..&...Wb..j..y...!..?}&.1...9..".......{2..\..Y...(......[...+....N.<.x$..0..M.....F...P..g,K..o....S..!.."R@.u..J..aA.JD9.r=..\V.E.#._.JR..r!..L..QP.9.@j.n.V...Nv...djR.+.....?........<.d.R Ad.xh.=$;...Y7.{...&A.X..H...@.8....x.v.G...y..B...;..k}.G.._...1...1.*i@.F...u......].L\.....>.{2.0.&.Z..8.e.^.C..]KE,..]H.(...*7...H.]`^....8..3)...Fy"Y.T..f.^..l.4....G...>)!@58h..^f].F..pt.."./..1..5...u.....eL}..r. Q.....#....;...=.....#.X...0.......f..y.5...j%....)..._.Z.=.....]3..KZ./.. ..(.......7g.{MJ..........v./.....N.. .Ql.^...]3.|.1...f.Dp.....0....d...........m.....60?...5....,....;RLN..Z.+.O.._.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.84430072371477
                                        Encrypted:false
                                        SSDEEP:24:XaDPFLDsp8grd9aZFZZItRsvG57nvNSb5VJXrPm+EOJ3UQ14k0X2oT7:KZLDspH9ALathln16BXrPm/Q3Ua0Xv
                                        MD5:B7855AF5BAAEC0C6DA51D2E0257DED2A
                                        SHA1:7FE0EDD665A5EE85B2AA2C73B9D2FD77EFAAC92E
                                        SHA-256:212991BC2AD10B230B8CC0464421BEAF1F53AB514BAD2C0D4D1CBD91C0DA73D9
                                        SHA-512:BC775E046E6C522BCE0FACF4271D0F3F63BE774FFCC68333FD8DFC77A2B786A7A38B87B3723C5BBF2A1FED7C917C8F913CC7D5336E0B820FB5884194498465B6
                                        Malicious:false
                                        Preview:......xGrK......l...lv q....Ly}..JW1....)}._...+].....D..4..8~TQ.T..x6b..1f.9.e...1.....A..:o.8?..Qj..1Tix]..G%.B@/..p.V9.n...{..b..Z ^....oW6zK.k...qGf..g.t01..8F........5@.S.q.....Y...j..N..iz....Cn...f.0....H,`rt...d..>.D]M.@..s.L~... ......=.T/......>...P.7>c...cJ.H.&.\.7...(.B...-......4...-g@.K.b..-.K..4.l...n....B.N,jO..F..sw...9P.*.E...P7.)........q....{.a...%.T}bQ,.R.&...oOl.......0y....n.......F.#LKZ.]6......._Yx.C......x^.|.g.#..,...B....Jp..}r...{.[.E...N...9..5=~K..ec&...."5.bP....i.Ok..x..g.:...i...2..+.9..`....b.xE.-!...jC..(`s..!rH.*.s.T.&...|..11y.t..]...w.Y*f...e...Ggb+.v...f..._.z42.r..N....0...D.|..c..uU4|..}C.B~y..ul...=.W..BK.S.G.....E...V.g`..8.V.U.....|..i..DK....n.c.Y..m..I.......M..5}.5.w..k^..}.5......@2./...].d.j....<:.A...;..:....q20..I!.L&...U...*.../..dH{`..s...._..D.gOV.....l.>..1.t.~#.@[q...l........=.,.t3.$../*...p....3.,/0?....lo.v..{=...:UNY.e.]5.K..3....4wChR..K.....W..:..lhc.L.....S..}s$..j".\...........Y.1.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.839963313448846
                                        Encrypted:false
                                        SSDEEP:24:jJaixHRJ4NeAUkiEzbmufM7xlA36WcdBsxSOuwIfWg59UX2oT7:oixx+NYu5fcfucdKTYAXv
                                        MD5:E628B5BFBBABBAFF34D8C59CA4B1E0E6
                                        SHA1:AD6652B50DBD65C01F51716F8B729B67EA496DD3
                                        SHA-256:E0898C8626A72B0764C7AF42EDF1F6189434843AEA59A131E0AAE61C4ED5B058
                                        SHA-512:8E638459633ECC7BFFD99BD1925BED9235EC52894141B902530752A7FD88F4B631F056B36278FAE81E0B6390E1D711D1707E427362702CBA6588B6D2D65D774A
                                        Malicious:false
                                        Preview:....v..j.l.. .O#\.TF..;&7....A.2. ........?......f...0. +..u..=..0.*.&`..:........6I.p..t..X=...........?}k...Q.d]..}...mY...\.YS.j.T..w..o.G..O:..X.uG.Z...t.'..2.8....../..........a.....F.`..qO...gH....{xeP.+Z.Z.xb'.).$...4l....u..$.0..`..V.BWs7...K...dHC...f(.u/.#..noxorO.f..SR.=.x,.....[... ..T(#w..r.Ba1.j...x..I...Fo.$uB....S.P.OC.........O....F9w".....*.N.5G..wt.=......*.X../M3..w.R...QL...r^.......n..t.. .|W....!......l..~AAB..CO..\....v.a.jV......v..|<..=h.x.(.dW.Rc=..J......8.Mi$.....&...........K.......(>.....~......\Q.b.RS(..:.9........KoF.D"Z...3..f}3.57.wV.....lG&.uhu&6....Ov...,...p......8.....O|......K(.)0m....4t..V7...z..vy...4&).....)..nn..8...o..EjO..e....s...A..e\k...u.<'|(T.......r.....|....O.[...=...T.u:Q....Rv..O.....Qdf)...}..L>.J...j`._.S...;2...j^..).....j.j.O.._v..-..H.m........=S...v.!.M....1d.......U...M.{1T.Gf...!.....S./..m.>..Hh.Q..3... <.....C.max{j...dz<.ne.R7vL/H.sI.!.d95......^c.......YY..esU..f.N..h...c.@..H
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1267
                                        Entropy (8bit):7.856797684770952
                                        Encrypted:false
                                        SSDEEP:24:gdL5khvAUdMS0pIQ95v+N8XiGA+tmbFLMlJKX2oT7:gdlFv95v+u9Rb4Xv
                                        MD5:988B4160497E6CD1DD15585DF4F515F2
                                        SHA1:6A550D9BF89B84E10F9DA406647E07B9C2B30BD6
                                        SHA-256:C6719BCF64C3F2DD94A2A989DCE412079B1E07F10CD5A1ADA313B9887F8A307A
                                        SHA-512:9FFE5C6C0C80A6830401371902A24A8533959597D5135C6196E7B3CB0A9B846D1F027B4866B503C680534FADFBFE696656CA0B87CF0B21AC7D685C98CF986479
                                        Malicious:false
                                        Preview:-qBTg...6.=E.;dT.6..b\.<.........h].l.......0q....K...M..<_ZVC`..do+.\..^...w...P.$9{.;.z.....M.......8LnyB..H0......L9....H..Y...Bn.....X@1.....0.~o.... J...[.{..B+.....eR..F..j=....#$......N..BJ};t.C.S7..J/o.6...|...^y.Y..vO.\..!..{m..x....n...M.`..K.:&V.-.n...M4c8...f...B.G].$.M_WN`O.Zk!.....z..'7....(...|...s@.n...0..(m.f....)...b...g2..*A.y.E...0..F...U.nn}...5.(''c..2.n....bbI..A..4/.d5cn..j.*.MBM{0...i......,s...x<,.p!w.dP....Rp....,.R....4$.......".z..#.K-.Ux@G.'..I...&.$`....z..J/.ll....H..W..m.4oR..?H..w.a..O8.h.z@&....#...l.....z..z{#..Z....z..{.Lv........K#..<.+.,.l.....3.-.|..H.).f.`.`...).....i..s.Kdz_..LB..k..J..K%(...D..p.2K....S...iZ....P...a.)..6.*|........*.y.G;='. ./...6.5'...3...y.i1....X5M.w..td*_...}..hn.......r;q9U.g.^...$..u...TnN.i....$)7.c..`...\..F.o..dB.=gOx.E)?..9eU..G*...g....u.S.....f..f.#...)...6-..x...c.F.....6...k../.R..e,#....vz.[_=.6N...gZ..L..o6..C...3U..9..&;.......(.agR.-N|[.."...-.\.K.P@...co.xw..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1275
                                        Entropy (8bit):7.837932700768345
                                        Encrypted:false
                                        SSDEEP:24:/Vsl+Ff7WRt/7wiIK2fpkYuJu+DnwTCw/AvdqSY5NptjGMPYosKIkiL1GMsKX2o/:jFf7WL0i6kYuWmwmNY5/t6M0KI9GMsK/
                                        MD5:58F7DE3FF05943E23A31C1BD589A1CD3
                                        SHA1:453721F117ED347C7BB2B5049837C032306E55EE
                                        SHA-256:029947CA6F0FB7C73BAFF0617894598C50F58955D5A4C865A4B669398B025CC6
                                        SHA-512:7F330D8BC5AE3841D659E4253B6EF6913D0161F1F7234057A50C73BEC81910A02F9F6623A184B9A49CF5260FC1CB20DA18133959AB740AEA182538DA31FCB496
                                        Malicious:false
                                        Preview:.:...4l.ON...y.......m.J...%.J..Y...b....t...@%7....f.3.......P...@.Imh...3:...mSL.r...UXH0-6..H...W.A..P.p.fB.>(....J.a.`Us..n.@....S@3`..$^..r.`Z0..Z.Rz..6..P]..iW.emI..I...a.WT"...^..N..w.......=.O..)H...~...%.....K...i.......0..n..,...^...|8.x.y..........q.....T..@.A..Y..._y./.4.?..4...O.r..Yj.H.....j.TC]..D..[.J.i]7.~!Psh.Tf.1....piEHz.o.\.e?....8....r.M.....L...t.p0''$s/.....p.......R.^]n....8#.(.....p........fL...Ed.....W.I...*.L.).}.ug..g......z.1iz..ZW..*I....U......R~.#R..v........../%...74......W...SI.l}4+.cf.1..w..?.D-..p....2...+.[.....Z..........[.N.p`...w5.l ....U.n.....1./.....K9...D....M.=Q0o.)F.h.Jq..h.......q.$r...a;..m=....F....p\.m..*R...2oB.G;52....l..I..{.......9.MU..-...;@.#5.Z:.'...6c..)..1@.'-.F...Ez7..!3.-....R....+.!.@.i.l.i..WM....m.K.Ry@...L....j.9.~........n. .,~B....6.S....iy.g.Oo.O9.7.0/......qAt...+.j.!xW*.....4...~....v.^...,.3.q....&.4.4..P..+~.....j.Y...4|.&2..f......9..V.^x.b..Se....8..f.t.9F.u....h..x.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1274
                                        Entropy (8bit):7.827547613193213
                                        Encrypted:false
                                        SSDEEP:24:kZpXfMB8BUrLv8YD8kZXnTyHM9CCvOPditUmisK5jDwtPOMIkSR0w5QGUmOXYCKs:gpXfM6Urb8Y9TWM9CCm1dsKl3KeOICKs
                                        MD5:583AAB8390F5714715584F3B0F4D8043
                                        SHA1:72A1EC4B33A87631360B25A256FBA18A82E6DE66
                                        SHA-256:673E3D52A67BC18437EB0DA7CA9E48DF61EE7EB319F82526478EC26944EDE08C
                                        SHA-512:47F9D4AD16DB67825F688DA407F7AB468383CE9AC387CE4039BE0B41926F616E0CCF0EF66E485263ECBA1350ED7F593360453878039026DBD92ABC2981AD22FC
                                        Malicious:false
                                        Preview:....B....L^.B..7..8.P^...:...B.k).....1......./...P..P~hgQ...C..TpU/.=.`..A..dJk=...B.].....)...9A...k%I.a.t.X.M._.$....(.qvB.*..E..#:.m../.<..G.m(.....y...YB....7.....0. .........G.x*........K...R.L....QzP.......->.....<.....MhM...VV*.....I.xI.K7Sng.U/...!.......4...e...b..Q.3v.45)..i....=E.?.M.|....d.=..`.n....C..VT.rA..Ev....:P....jlT....Go...c..@Q.U.}j.>O$.2~..A....G..t....Q....Ia.....oit{.,.......;$!c..>,.|.N..{..E....".v..n...zeg'U^j..?|.Q.$..n.#...po...."...#...{...9T.:...p../.....#:.6@........../.*}.z..{.V`......F..H;&.V..3.m....g...6.Y.<......s..yj.x.n5.*....9N...Y../..tM.I.qj......f...XGG....... .s.=soL.a(h.'..4.-...dh.c.R...$.O[.z...{...o9S?."N.9..Dg.....i..Y.h......5.zoS..n2dN...Yf.O.....@..?|S..#.IVL..q ...U..D..RD.../.]..fZ......v..h.^.p.SJ....UQ.......U.............P.4.%.}.M.t.P.hK..6,#]6.D....J..=J.@~.(..R]M..!....;...g.F..#;.I\|.7pT..S..r.&(...i........W.uQCx:F...6yb......U..{n....b./..DL.l.9..v ........@...;....:...0..=.uC.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1271
                                        Entropy (8bit):7.860456791372
                                        Encrypted:false
                                        SSDEEP:24:Gc/YMtid9rBXyCJKxtcSWPjcOZjBg+uStRhGjSbN5Xij5yX2oT7:Gcnid9rRpJKPc1Pj313bhGsti1yXv
                                        MD5:43A850DAFD250CEFDBB9627D99D6DB55
                                        SHA1:9AF9EE9E19CF498767BFA1C37B34F46399CCED02
                                        SHA-256:D8FF1C125A34FC8CE8A6250D61841E5C17B5B6AE9F3B6FFDDB7D02721E9F6977
                                        SHA-512:10A8E785BD0F949A7684455DBB6CB4D97FCE8FDA8C640CA498A15A3F5047CB586E045A7B705658C0E3BB4F442368246C9FC0334306DFE96FF9B4792C8B4CFCEF
                                        Malicious:false
                                        Preview:.|......fwVz^..Q...~.+uX....5au.y....{.-...s.5Sx#G.U....zF.'.._.....N.5l..i...K.y0..,yO..D:VXS|._....gS.......A!.....2*..^..1.*.U...Pk+:>..^)9...X...K...U........(W.p(../......I...*sk....2...!....o[G...U.%B......P.(~0qH....&(..T6.CVX.u.<.&...ZWA...J...S*X ..z.....G..`.l4pN.......wg...8..}...W....o..o....&.e.>.Z{!....n.Db...}.........?.\.<....r.O.........g..$..P...F.....1....tQ.,\...8....pm.~..L){,.+?....E.A?W..eC&.fG.5.i.z.....k:....$.}G[Dg.i^3......,a. ..o.[.=..u...{..=..M.y-..>,.y.......%..}..=AY..4.@|...SLd....s=;,...,Z.z.m9hI.!m....g....z..s..jb>C..M.a.o.d.........|......=...&...gkk.L..\`.D.=h...o.o..E.5.8.Er.pJ.]-:....."%...'..Y....i&..z....o.}.R......t$..5...2Fr.....c.......{.........e.x..}p@. <..........o..w..._.B.P.C..h.......v..`.8.......j.e.B..\...9..wvJ.../..A....P..v.. ..(.fk.d.{......'.I.J*..E........|.c..."...t..A.4..9U8D...y..5...jgT.|.?X...&..G..X,.{O{.....o...|#9.[..C.?x.@.u~......4._..Gp..\..."Dw..c)b.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.850373762931301
                                        Encrypted:false
                                        SSDEEP:24:bVZrLj74cjlnSlyjGEq1p4I03FDGIaZH1bHP19T0X2oT7:hZr37lnSIaDluGz5HP19YXv
                                        MD5:51E0DAFB93A2F8FEFEEFE70296B825A5
                                        SHA1:A731BB3B47646828B1A952D326EBAF39C16093EA
                                        SHA-256:6A825451607C93B8EFC18C31E8FA5D677B9846D60671ECD1F07F400E8218CE96
                                        SHA-512:E3C5123DF6E01A2F1A2A13A7DB1783C49C1B46559EBCC032D790AE4B5E44AD6F98DB5C47B1B6AE8DCE63FD2390848B45488E52036EBE0FE02D1A87DE3382371E
                                        Malicious:false
                                        Preview:C .._...T..[..j:.&a..*.5|......u.S.N._B.A#...<...j..M.0k....D..%[N&".^....v...</..#!.....Z:.\n-G.......#.....+....\s.f.s..o...j...L....m&XO...?5Z.q.e.h3...Z....5QT...bEw..COL.......t.L.89..E......Uj.x.......'...,..q..=..J...<'`...._..........0...8.V}..........g...\.c.;.5.'h38.2...*.s.....%...~...-!o....[.fY..c.9.m..6....W.(._.R.Rq..R.|&..P`d.....+.....V.-..@.o...z.....Z.kq..l.#..V.J3..t......|&..a.E.H".U.5L...Tb.....[.B...Z...A..|...=S....99....x..L....3..j..17...........v.i..F....m2..Qp...;.%...=m...4..3.e.q.n9...........n...{-. .B|....ru...o.B...V...[&....)..&_G..ah/..S.|].r...?P8.i..R4......R./&.w....&....a...r.X.'.,1.B....4.[...V.)qQ'..4..gy..?[.C..Xz.s.y/.W...D..m....L...q.a.q.;.K.Ow...s..._h..q...f.f.b....O....c...73..*..c..e....@5.A..&..?..e......."o8....Wa...o..?.g.1e.[.k...[&..F..-y....H.e..~........k.g.'.v5D\..:Q...8.n.....k].?.!M.3.......t...x.....,n....I%"..9_i.h.v..(..\.....1l.lRJKCh.$..U.1.E03.....8.u..M..q.x.De...n...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1267
                                        Entropy (8bit):7.840520733838761
                                        Encrypted:false
                                        SSDEEP:24:NLCkM5uM/pqAMr1HIxSLx5nFw075BGVcy/gsuloKX2oT7:NRQ/pdM+xgFw09IV7IDXv
                                        MD5:8B3AACB4FE8FF606D9121EF4517F727E
                                        SHA1:5E586EA3752A6CE4B85FA25EA5C981C1C7136339
                                        SHA-256:1431F0BC1FF7003EA9F8A3EC890E0EE6F9BDCF1DB5BAD55D913DFDC9EAC896F1
                                        SHA-512:C9B56A9CAC05EA367AEFC8F9E052326EE4598E2D8C6C07DA48A64142D0C745AD8BB981505A737FBF71211D48E457109B250ACB237AB6E1B8B2EEDE6EFC530CAC
                                        Malicious:false
                                        Preview:..PZ.".v..#(3...)^W..).d.*......ky.k...`..u...74..i.....;..\..P._[........$...........5R\.a...."......B.....X.9.w..qwG}.|..e.J....c3...T.A9.0....M......>D.&Q..:.-...L.f.......a.#t\...Z>E.....&*3.....2.....L...O*.\..j..../.....\.?...Q.,I?..&..5..&b.9..J.N.$........"U...l...fM......!.p..7...s..9s.3^..Y.Q..CZ...O....0.."1y8.....6S.......L..f"`.Z.....J.!....B.7nR..#Yc..;._/..,..|..r..4... *.2c~ka./.....t|.........]..i2..JY<5.=[o..B......Z[....A.<...5.Pa...U.*.s..8....Zi...Q.D...9.X..CL...;.~6..O.V.:.(..yN..=.66...E....*. `..^...Z..M.N....p@.m.M....W^\.U...r.j&\G0@mg|.~....%.......t...$.....i..B.T...A..>F.8..:|K.o..1..<.C..0^T._...dSO....E.>.'....lB.[.....pFj\g~a...qo.f..[..<.,{.^'t@^.E....'.9...<w>.B;.da..?+f.C.~...."..#g...,y..D1.N....b.lW._.PEP'.._.t6.L...*.....c..C....M.<..W.3....2..i.Op.....a.f}.l.......fW..t(y.8*..@To..4X.....#3.m...S....&..K....r.I3.U....p?i.._....U..qo^sr..G}.+..Y....>~.....r9_m.h..l.ix...F.&du.<].V.R.T.'A...z..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1275
                                        Entropy (8bit):7.837717567885317
                                        Encrypted:false
                                        SSDEEP:24:+/6PFQkEFxlbMGhmVdLtNamfT15cj9ovgnz7Rqo+KOFX2oT7:+/6RE6fVdLnamfx5q917Rqo+KOFXv
                                        MD5:8343B40A0B4CA8F8ECF38903B4028A74
                                        SHA1:514FA83FA44AED9D3B5D5D74134A15B1316F1FAD
                                        SHA-256:13A2411204F768DF34F54848988E22F20D69FD1353D8CD298D20D36FEC8CD95A
                                        SHA-512:EE4376C01ACB637EC81E1DF548FEAB7475ED603A31485DB603E15BF573DFA0BC82DD8EB8DB0441E378EB488192B59D8000D0D4D34087AC77C001405F74110E72
                                        Malicious:false
                                        Preview:..%.... u.....e.eX@@k..2..N..j.Y..x..U<....K+N.M[.L.E.0..J).c..G.c.....a.r.)....z...8..$..X.?K.tqN...z..Q%.F:.zu.|b..T..P..!..n.....v..p..H`...d.g.S.]...k3P.\Y..^.r.x...U......2...z..<P.m...XzA)..J..2.H.Lu..mB/.....].w`.nL.....n.&..P\....itf..........bw..Lt......=. .i.H.U.../..gw...9 !...m`.K..)E..(....%..z.R.Et.Y..0\.K.xNr.4...9.3...{}Ug.6X.k....e.O.Z.cr/..=z.....j.BS.ww.D..w..GP."....`..i....../1....EX..+.Nsy......7@.......J...".Oo.....[....v....K.<...E.p.bW...9....l..j...Q?.oJ....*In..\.P(*......df.h.2...km.n....M....#.H.e.Vn.+$.!....J.z....mx..Xi........2,y@.e.?.....a.\.$+....@O.Qm..l.y|5.......LqB.Pqm.'C..R1..9........=yu......,...(.}.."..}.q6...E4../.Xh.%Q.'.P..2...6f....u6.......`...3..yrui.H.W*.....M....~).BO./.7...."j<......r.......X.x.F.O.9.C..h.nF.....B..vPPU..^...h..{..3......6T.&..zvE.........../..j.@H"...O80.=.)y.\z...mw....R-pC...\...P.Y..&.....e..L...Q...A.+.V.s.N...G.yA{...a.q.4.<..NL..........C...]....[X.gG....i..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1268
                                        Entropy (8bit):7.865961263084095
                                        Encrypted:false
                                        SSDEEP:24:kR4MYC3mFvN3jQO4gFen9dxWnUw7TEv0mHE6iPs3XJ9ptq4X2oT7:k2MYimFV3jQJgFMH8UmTE9HEFPE9ptqi
                                        MD5:D2F31C34F3E930BF8D014A7E2E181280
                                        SHA1:338D5A5948E16A4CDA357B3F430939CABC475832
                                        SHA-256:87C9D5166AD124116445E5F9EBDFE94887C3560691AA2E09AB27F4BD0B7F9588
                                        SHA-512:EB02F89CEB7F1C2252880E67977192D4FAE03F693612C6AA705B8D81EBDEF65EA2444EE0926962A39D5F9F3B4197420689119B859FC0B6F9DCC0CC8BDF1AE5DA
                                        Malicious:false
                                        Preview:Z.vC.pL..K....r..e..0!MI......E<..2VkCge.2...Sy. _t.T.c F...~.....WW3@$..._.....Mm.'...a.(.w.v.....+.a...p..p.S.X...H..*...a_3...yAu.8..i.TS\.>......".....9sbL.{.......r(A ..].L.,n...a.q)3JVz;.#|.O......N2.}....T....s..g..0)...N.m.....YB...0.|..Z.?<.A.:..d.G.dg..;..8.R~...............,@...."A.FE..}..=..6.:$.r.H..O.&...D.....SO.....y@.Y@p....G.;.i.WwMl..K.D.l..f.`;.,.....3`..f...RukA....@...k..HS.P/X....|._P.Oa.].e..y...M..........a).[...z.Bh..D..)5..y`.S.D..J."9...eO...T7..@G=...Q..3...v.(FO..........S4..Z..0@4.6.2C.....wA...g.2.G..D..H?.mZz...n-.A6..1.~.Ccm.c..~.`TS....%6.:W......_~%.3j...#.. .J~..Up...l.zZ.\Lm.......2WSV..?...".X...J...n....?.Y..-.Q....-)A.t.J.J...\..\c..xR..V!c.F.....,(,;.[.@..I..........Ja....r..$..".]...k}G:VR.I.M|......w.d?.."...rx.Z.....p.U..........Um"...p5..R):.<#.;O^<@Y...K..:.....u..[..g..o..c26.f....S.../.p...#N.8E..|.%E...\.UR.........~].I...,.L..V..\t.h1.jU.c'[.-...v.B>>.j..M*p.xQ.<..,yO*.-......H9...=..........
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.850532705767002
                                        Encrypted:false
                                        SSDEEP:24:So2ouRDhm6C8bIEgl3sE9yydFvgF4nD2oRDMnEr7WiE174xOJgyNeX2oT7:rzym6HbILdF+4nD2S/rE17ZRNeXv
                                        MD5:72BEB4A12373677168DED191E75ABF7D
                                        SHA1:D6F706B70CDB9076EC437EC604825EE4C20B403E
                                        SHA-256:6BF3996ECD1DC87A820C9F2D253FB1370AB9B7609B75544401ED20968126D110
                                        SHA-512:CD89C6C931193E2C3E8D9984C194A924078E196F929D93FD166C63876DECED02201847E3A5C6EE6B618F7B795051A265355E075EAEA7583D85DCB45B3681EC04
                                        Malicious:false
                                        Preview:$Du./.......9....'.2..Th%.0<.S....B...}...'r.>..n...L*.....y..|...M".<.B.>.XV......b.a......O...h..L..3.....BC..*.#.)X...XR.9..W.........O|-.5.$.&t.....>63.h..X......._/r.e3z.(......IoL.J/].Hu.e.P.g.m{...aY.'4..0..>.......].^.p.Q......H....{P..%r.._5..t........q....WT..@........X.T..K ......."..C...8......l3..j.R.y...uZ..[...Z3xPQT.....x.3G.........X..pS.J&KC .b..r..E......|%..u.\.G........&.k..:k:.O...r.Y.5...y...R..o.@.../........M...g.qn.W..[...`"...m..VuB..a0G.?.O.....:..1....b$.|QE..)5..T....j.%.o....r..0.D.... ........6b...lW.f....1..$d]R+..M...|.G..Qf$.<....S.kx:.J.;..M.....N,.p?..!YfO..a............N..E~nl.p..YR...t*......^....U..p[..N.S..=x."<.~....`.N6..]...Z.... g!>S.|-.#.h.....u..........{.....T.y6..\0!Kl1..;..>..z.......tP..-G.}.........$....:...1...d...H.B...>....].1.D.H.`t}..d............/w..24.h..Oz.p..3.#...$..I.q.3,.Vt[xz.9.......<...*Q........H...8....@..S....2...:...#}ska....E.P...i...14.[......N..I.).......t.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1268
                                        Entropy (8bit):7.864615132786079
                                        Encrypted:false
                                        SSDEEP:24:x4EuaT76hPt8SLVLnPyJNWwngWpERc5thCYP0uAhfsJ9q7V870X2oT7:xJTTqPt8WdaJR/pjthxAhS9aXv
                                        MD5:016CB4DA1D5A4EF3BBAF8748A6BDDD32
                                        SHA1:CF032184C0999F246B271A481AC8FB1DE17B64B9
                                        SHA-256:9B4C9A72494034171CE7EAB63F520EFDA13CADE05A146E5EB07126D8A4238A55
                                        SHA-512:455DDEA8D68ABE75CA28A8239652EAD2D5FA8011EFE1663E11A850A3F22152AE869B984B9B8B682C7A899E2BAE84C113AA7BD07538EBA257B7A6F846C92CD788
                                        Malicious:false
                                        Preview:eG9.CoT..o...v.;<N..`r..(......-}..a..........b.H.#......d.R......<....7.............l?..}gj..n..OI....;..pWlf..H..$..g..n?..&.Y..9..8.B.H5HZ.C..@..k./.z....".}r.8.:....H..c.y~6cF.0.E.r.^{y....)...qTg9.+.CXwH..Z.{..5e1...\W.R.\u..q...{......K.. i.8...\J..aBMn.[n=........nBi #..1.mMKz........5)S.4...lR.d....h......OX.wFl..q..D. .........,..hN..I.a.0.^..*.*.#C.3Vv .,b..y..^..S..O.4......S ..E........#.......K.|_.-..DM....G%_..|...,..Fmu.sR[..ve.....H......J..o>}..N..C..$..j.>..)..[Y.#...N'9.M.w.Z.&..3..P.q.E..g..r@..!..=v...^O......".I.S......I....(.5...S.$(.}...?w..g7..WdZ..x.1L...........l.kPVMl..d$.,..c..V.k\...'\.{{.h..FD<..c.Hw.d..bH.f....N.`....}...........zJ.......O.....U$.;b...=_c.)L......K.N.[.$_....D.zW.~].s?...:A.s..mC..[.2..=)..S....}\.M.q.._y.p`*.8Y......G....S...S..Ao.*58.............Pa..6..'X{.1..7{.M.U......MM..d.F...s..d.I....)....T....Q.g..,3...c{<...v..D..X.o-..*..O.re....Hz.....].5..b.T.f...f.).).'%.f.............CSS.....K..`
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.8706643155184235
                                        Encrypted:false
                                        SSDEEP:24:thfJ8UYwlZl4WH6y/sUf5wHI8dfrDsOBlA+I4EXPO5WkWNgliX2oT7:th6RWvwp/UN4CPOILNaiXv
                                        MD5:8EA7DEF1F19CEFA5937ACC5F6F85DC36
                                        SHA1:4FE268D735F8CDDB7B1027E2A5AF608545475DFD
                                        SHA-256:4970D14FFA077B59C5A0A3AA4D51DCA2D5FB009853C634EBF5013956D67BD2F8
                                        SHA-512:CB28B587BD54B4FA968F49078A2F28EC75EE458DD4875252DBB2DA1E29B86D7F0FD400C39EB473A8DAD4ED26CCE66E8BFBE3ED8044B5E9DE3014A568166C3B2E
                                        Malicious:false
                                        Preview:,.?...pZ.z....^$._.#..iX.$.....3O.....+......8f>3.\...A.<..2.$.Z...............{@......<T../.%..u.H....hh.dVr5.O~...3....;.y'_...A..KD....=...(2..q......:m...O....v.N....~c...E(...s."..#(5.Si+.yY..+wJ._...... &.... .4._*.5.'.0......2"...o.6.=`.........[k@EU.d,....:GD......&v. ."....=4g....?..P..C1).c..4.."H..>.X.O..g.)*6...!C.3..W...$.Jq..!...x.p..Q.<.N%.Q.Z..,.MLz....]..0.....l.c..p.E.5...,..i:....m....PXF.].g.!....M.y..`...............O..4).oL)..+8..\..z..Q..i.vX.....m..-..M..S..C..?..qs...9....81~..t...m..z..W.....X..T...Cx.1....,I..kr...."{...].IGf.^k.Y.....NNAk...a...f<.. tF.....s.3....a..g$\..B..0v3R/^B....TUWtf}..E.3.TEv3;......~.1E...3,W.A..~..Za.j.s.......Be.jZ.../.RCw.n.y.4+.B\]P......:.:L..6.. {.!@H...;...Dc.K|y.H.s...b=...I&%..&....3u".K~)k.m,......,...DR...)......-%.f.8..A.. .5MY.jJM...L..X.V....a..&o..,O..i(E.^>..0i.=.n6..]$I.V.X..'...m.q...._5%.V.W_C.n^...U..AU.]*z...*.....Q...87L...n.c.#`&DW^l..)=
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1270
                                        Entropy (8bit):7.829365220691219
                                        Encrypted:false
                                        SSDEEP:24:Bp/uzYaMVwK5KGI9lKg/PRjnWcMrZ2re0AGjwb5TqPSGE0jsrOwOX2oT7:Bp/7VZ+9bcIrf3cVESGE/lOXv
                                        MD5:75E120059EE5A809893C2F6B6AED2F07
                                        SHA1:1837BDFF8741A499D41308A21DB52CB3DBEC4CD7
                                        SHA-256:9B1FD169C373F0C22511E1B54742947E2CAEB157930959CEBFEE3D82855E5E40
                                        SHA-512:3C645C97DE4A5E5CE81C5BDFE65CEFBAC5611AB29C7A3D405BEEB8DB907FCAB7E183B0EFA31467B25D1CD9A79671CDE132A6ACEFF4ABB663DE855DC31868E90B
                                        Malicious:false
                                        Preview:F7..d......z17X4...rM.?.i.$.r..3.........q~N...[Q6.......~i*/....>T.]..T..u..3.O...'..p...C.Y.Yu..%..2q...UN.T..w&......^;...H.......Pv....Y......\.l.Ej|.....m....4..*F.{...|m.n......8p.s.!_.X.....+\...Z!~.!=.....#+.....^....8....jB...-....O.r.X..hi.^..F..+.in.........1..5l.....q/69....Z.tt.A...g...3{.9....p..c..D..F..z0.:>..O....N..0d.5.vFx..?Q..D......i$..s3.>sds51h.}E.D...A.@k.9[.T......^h8..=...{.....Z....kJ9O.......t..f..b.Q.h..@.]4...e...;.t..h...z..Y...)...........]......7..XZ..F.<....... p=/..-...qx{.c.}..7.)...{..../..`.kG.f...Zm%sj....m...Q....tp48...{.V..%... J=.<#n..js.O.FZ...P.....L."...(1.j6.)...."D...e....+y..p.8...lp.......Sw~ukD.....=...k...O7..;...>?....}..k6.......+.........NW.....e.+.y..o,..e0.7.....u.Jj...o..P/./..Z....nA..t..|.@;)vy...n..........v..4vy...b....rXDl.l...{....t..G..e.&...$.E.%..F.._...FD.>.&bt.'.D..m.Y.!. c.H......^}...........T...-#...p.zW.O..EJe.....N...$..".>..^=F.....(1J...k....N..E...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.842490610211404
                                        Encrypted:false
                                        SSDEEP:24:RhXcxqzJd4OWUXkcUoiv4Mn+mo1uY9laWGq1OlX2oT7:RhM6YOBXkBoivtNo1uWazXv
                                        MD5:0B43622F688AF09032B02148EF97E0E1
                                        SHA1:9480E7BFB1BED654868D453E8635D8E66F81DBC3
                                        SHA-256:71F088CF4145D6FC64A0C77F173B7C9C8622A94452E8C5C7041C758388E19AC2
                                        SHA-512:D66172AB68FBD96AEF6E5C4D17CF9240F690E98EAE55B43F38D7793ACEB75A3C13B5D90108020C99B92A3F9CC5C5CE8FBAB3309E9889BCF1E51FF985EDDB43EE
                                        Malicious:false
                                        Preview:.d..W/....X..fH%....s+3..gi;.p?_.L.ES\Di...%x.........iLO...D;......z....(.&lO.....&.W......j....7.Su..b............R.`.....YR.....{.v..?uX...]...;......D...).N...r,,.DE..g.@n.&B|X...^.A.%MTW5w.!B...0W.0..z...Z..5VZ+..>F.&9O...,......tw.QH....g...T.-..Od.%..L=.....{.e4y%#.{).@;:.....'.#.f~=7e....o8j..+m.f..!..v.TL...1..~W.. g.2~em7\g..x.U...&..9.N..g..h...s.C.n....<V..~.F.....Q...........!......=....";k.~f.....(26...^.T..F.....!..bu...<T.g 8r.H...2..3..t.T.;|...s'......+y.!....wZ.U.....z.q.c.=._[C...q .E..2dx:I.#......H...e....P....[u....Dmh..1.R...|.Q`..Px-.#..&...x..S.W.?.`.w.../.....)&."G..8.....>...3k...b'.+..w../...........2..c....X.{.D... =t...+.-.7 V..D....c..a...m..+.H.,...?.a.N..N..R8uv.....f......nC..cj.S...$../w.Lm......3ZKcE........F...K*39.v.!.8).>..........*.?Q.t..{..#tU....0tfX.../Nq?'..>.$.......9....i7%9..un.m....{E.$..I.R.v-.d...EC..`.....P...:..#.<....ZV;.*z.....|.o....^...{f.9nT...k.3.z..-R`Y..)..F..m5.h. f.xo...a
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1269
                                        Entropy (8bit):7.846255232105146
                                        Encrypted:false
                                        SSDEEP:24:vSbinkUC2wb3czzBGTHBxApPk+9TB023dAsDFwU2yiOz+C8NrCUX2oT7:vSOnkU6OwTHbAp8+9TBPNA0B2X1CUXv
                                        MD5:6CE840701F9F0D65B5E8E15EB02D9789
                                        SHA1:15EC3366F9119BB8772DF69DAF217AF34EF0D042
                                        SHA-256:5B8880A87B6CF35CF535525269C3B13C0A75BA938BF635BC82CD5D1624AE251A
                                        SHA-512:2C10CF8B183205ECADDCBBAC7515744CEC25F76642D31D189B2943C5ED3DE8A01C2208AD1C7C9C6766C03DD3C136AFD67575823B4BFAF42A362098EC2DF49492
                                        Malicious:false
                                        Preview:R..8.e.,?.' ......u...%..bV.,..8.5.."NLb...y....j...W.X.\.....!.A.'...I./.1r*..]....G.....QO~...(.....L.......r|...=.X,.Y+m....N../...p.BfW..C...&S.G.-...q...\..x.Vle...~......3.)../FbP2....T).k.Ljs.......fva....,!.;.......-_QIB...../...rn."!.W.E..}r...ex...o."..U...ut...Q~..&.w..'v...0d.5........'Q...AbB,.0vJ......N.'.m.\......"...4...'..w..!...M...21./L#..Y...l.Ir..........Q....I.........T\......}6........<...n..@.O.`>..m.n"Zx.~.............~a.Kq.v..9...L@...M.r..g.:.,.9K.X......b..4s_..+...g.......2C...o.6.Z..vV..a0.X/.i.1..TzE..Z.......=;-|...).x..w...'...,?.";.s...\n(..pS.[%b..9~.....C...........B>s.._.I....M...c.0-...Y\x..R.J.q.....WjZ.+f.>...1..j1.Q....0.X......S..O...h....d\.O'.kg.OP..~..".....\..M.s.q.Cx`}.i^..b..2.T:../.l......w.Q#.E.neKS.Q..phb.{DC.......te.ZT...QI...?T...{.v.Q.W...)-..%..$:.p..Cu.J..b.8......*.5.1.RL;.f.\=....G.....J2.)...c0...\.R..`..@..!<.W............r.Y/..A..f.o.........cu&.1V......L.[.Ri.%..|..~.S3.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1271
                                        Entropy (8bit):7.851073824467581
                                        Encrypted:false
                                        SSDEEP:24:9fWpjzQzwzexKsRnEtWy/ApiL6TNA7xWFg0QH6lSRGvIX2oT7:Epn6waxKswBApM64xWFJQHGSR7Xv
                                        MD5:C7D1CDE6EDC3C15538676BB1C49358B5
                                        SHA1:6260E543F91D84364D79FE21818675206E4C69A7
                                        SHA-256:0A59C1D1F205059E1960A0754DD5790AB6D9709199D38BC33DD670A1D8FAE497
                                        SHA-512:A63DE9495A1B9A63C974AC10517446E9DE401046BB63EBD1928A01C2D9365053608385CAB1F4998DFCEE171E20DEB8EDBB68FE680C379FAE69E697DC499E7D64
                                        Malicious:false
                                        Preview:.bO.SCa2..8..S.#$...^./....j..H..J.+.....].......k..:.Z.....VZ.P0..8.......r..C....Dw.3.jw.E.;.r[y......4.U.....A./..c...N.U..7..6.~Y~.0......>.0...l.A...a.......A..L...o.!.2.....tl....T...0.....].. .B...hI~X.=...y.Dg...d.[....(.y}^...VK...4...R.J..pmZ..Ql.x...b.E.........Y..@J.L/H...$8.%.T....$|a.7.h.=.|...>~...*1...[.....3S7'.6._?_..5.j.e....{6...W.~.w#....|...,.t.M;..*?[k.UgA|.OS.Q..GO]Be...20.....=A.....a.*.......M....Lh..i0.C^..f...}.n..].P.(....6..S.i..v..3 .Z.Qs...dOE....M.!....(..%......."&.u...o~w...SAM..J..'Iu#Q........]...,.sgS....2#.....$z\F/..........\.q.ugA...Rg.jU..o....[.A...(...N...*.(`.A.o8....>....cN....P5up...33.4........HP........?.p.P)......[.Hul.O.\....5.W..).#.W.....&.f.R..'......sG.....T| ...WY.\.k.>c.{.Z.1....S..OK.F.=../.5.B..x.....ow.......I.(e..g.1....L...W.MS........k.'.........._.K.ni...7.H.qD..D.q.FGL.L.=.....vYt.....h.Y&.....y..x..."..n:....uX.b==,.$.=.65.B..Xu...X..k@1.M25.q&k.R....%L..........w.j.K.N..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1271
                                        Entropy (8bit):7.8404339556304
                                        Encrypted:false
                                        SSDEEP:24:arCNJEpt8d969m2xHlnv+RE10ZkviFlCnffLGSulB4GKX2oT7:aWGCL6Y2xFnWO10ZJYfFulB4GKXv
                                        MD5:672D089DD232A73F2D3626E3E5C59CF4
                                        SHA1:0E7E1B503463EC93254634865F3E5A6F96A92D2B
                                        SHA-256:5040F4E0B409E31017B833A3E602E4FC8B04BAC8CD5463D0C81ED15EEC6ED174
                                        SHA-512:B33A3BE7F5882E24FCED074EC83EBABF181F164146C56F895730C2186A818E42A5F148F99D52A22E923145646B5941A645058FE805A9D805F5E0639A4B863CBC
                                        Malicious:false
                                        Preview:.>mj.L'+*.r..0,..,w^.2..Nu.@.)"..*.<...n?@L...30..[..<..@&1..#z...V..|Em...Y..[.X..3?......%.^.C.:.m....1.."*Z.@).Y..=c...H..T@+......p.%..{5f2*.U6...7..j...9`-.0.v....Hm.k.}9,ir....&f ....K.r.>..G..../A.*.Q(~...eE..@:.k.0.X..;..|.Q......}..;..<.w.+.{.E...._."...o...3.@...W^......X...Z....[6...h7[F...x.(.T8.y..}z..Dde..dNR.S...|...M...."..n..A.._e..A.|...D~..*.?a.U..>..b.B..9.*5-..O._)...z...C=..>...\%....9;.'B....j..,...x.F..-...j-._..R...q.5...%(.Z...........R..X.i.Y...urH.S.....sk...R. ...w.D(......F...;~1.l.].|..E..[Q.....I>.{.a...&.67Q..%[).A.|Vt..p[,Xi,..._..D..k...Fj..3h..pSA.".3......'.`....n...*..sH...D.6.J.Y....b;...({.T@....4.....HS...j...[?....b.q.U&.bm.>...].Lj>..ii...g...;:.;./.... .zt..U...\..0...h.....2.\hP'U...'.#14.ho.o.....M..i...L......s..|..jU......j...VwT.Z...4o<F*.B:D(..G.y}....V.$...N?W....,.(.....Q!.%..5.z.k...^\.._..GFB.Z....~.f../.Q....!a...Y:..8*..v....t.}Ko....Y..k/y....._U.H'o.1..X...M.(.{.t.C......#Ww..G..H.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.823297875911561
                                        Encrypted:false
                                        SSDEEP:24:iul8sZGfNVS1CmbNUklzU2gA+5PqjgCU4vXBWwMIyAzgaHAkH8SX2oT7:plnZGlVXGYASPqjgNGuaHARSXv
                                        MD5:4913962E839ED22040493E343FB791BA
                                        SHA1:85B8D6B8AA32DA2A7DEF1BA5F3A57A47F3CBB732
                                        SHA-256:9C7CE0F703AF9084BCA8B2D81AFCD4BABCFE687CF5E242AE21998FDFFDDC787E
                                        SHA-512:FAE21B812CB41E0AAD5CDC3308EE4F263C15922DD62EF2DE87D305C3A10DF4257FD986F6A7B3A02DF7F3434883C51F07455B027EEDEB373D9BE248E22866431E
                                        Malicious:false
                                        Preview:.s....k...*...n..9.hu...}...T+..~z...2vL..%M..3 ..(.}...h...g]...._....kP9......^zX...^,.0p.5...s.7...m+$.$.....r.Kq..e.D..0..RM..XZt.......D...HK.K...}..).F..f]...D48.......z.$...;.#..m....D.....j....[.....-..q..d...*...R.#....C.P..}.j..w..5.....T.XV.....m.&;.G`...`0..3... n.dP./....._T.....j.i.*}c.V...`90N~.R....,.`3.......Q/..AT..6..`...xR.t.l....R`-.I.j.....w...r.(\-.D-..k.X.{....V.o...O....7.Rt']M.iq.N.......Hp....6...!.%..J........e..RQ..9=.......I...lq0.. .....9........H*J.k.W..!.68.g.....M..P..;.^....1.........6..'&....pK.#...I.;V....fQ.[...B.9z2.9..QCAg...ZL.....1e#.hr.... .B..w.F..}..z0...a:....RE..3.r..~....Cx1........y.3......b.*..#}.).A.|...7..M....r#..\..43~h..;...mT..m*l.J.=..M.i.cF.:..d.E...s..o2..<....~..!...b....bXQ.7..V..y..+.@..2'X...U...s...b(.Y...*J....<..z(*j.KN.j...........;!\..U*.......M.....P.9...Uj.sp.\I...wTO7...;..vS.5/...g.4...`..T&...N..+.I...e.Ya$...EKpio....[.IK.=vV..........2p.L^z..2.1K...r..Q\2]s.(.Zp
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.859832809504377
                                        Encrypted:false
                                        SSDEEP:24:PkLEBdFUMKfoejV5rzVQYRMjL35Irx8613ymvQxBe5hCTDi1NsWX9X2oT7:Pk+2jdVyYRMjaFNymvgfJO9Xv
                                        MD5:9126B10F880935B4EA72ED35AB597013
                                        SHA1:F676DE1EE3D750A5E3F6E92A0E13B560793F758D
                                        SHA-256:309111C21EA5FCE6D820E73DDBA2C2B24F892072E7B249983BD787E36230C391
                                        SHA-512:46C8DDED612F00EA71A34477857F1D4BA1D2AECB30D323093318479AE3AD8B2F80899C16538F013BF0D3BBC0B8E0BFD6841166E7AE55C8E9A927A3E64D9CA82C
                                        Malicious:false
                                        Preview:mw..j..S./....`.7K....3)O.]@....:.<.....\...}kKT..4..R.y.f.....ZD.r.k.g..2^...t...8.#.<0.5......1`}|._.m.:.]....#.I....uO....h.Fu.R.K.[..Tf...iO...B..c..v...#.5.........?E.=8X..A[...v.x.Y"}C.~.\..y..`'.F......u..............<Jf[.C(........J5....y;T..^.R.....Y...i.....B....d..]T=e<.ugmn.K}........z..>.C<.N..6m..iR&..t.C.O.U.8.9W..\8.D...C...x.N.......... .8.?.1z...........Q.p...4.!//.Q)....*.v...t&.X...U..SO.U.b6.Z.N....m.]L.\r...`f]...~+Q........W.G.a..q.~q..........Y.a.... ,n.LQ.w.#...>.-...7./.J......cY,.nu....&......w..ha..H..x.....n...@4c...........|.i...I|..\f.M.!.GX.d7=:.....y.?~'..*c'"752..K.!.3.?.u.J...".0h......A....=.%...#j..+.3.H`...........f.....|..D...|.(...rbx......a....w,0.L..."p.h...U1.....!...C...w>r,...l..-.n.].-...g..J=><<.....].......Db.oq..w;.Gb..=%.9...E.q.*.P..:.!LW.'...JlV....J.~%.O...M.*.......}ye..@....r...34.o.1...W....Z.4.b....oJ].!.Mw.C.@._1O3.5.k..j..."Z..~.*.U|..vy.8;...y.).`.q*..h...RF.N>^../...'N.............
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1267
                                        Entropy (8bit):7.839440672684118
                                        Encrypted:false
                                        SSDEEP:24:vkEyruAoyT72dPaX2Fccbxv0SHMxxUdvLlWUIeS31OwO+Tl8/R8ZIYKHFV9KdpXv:vk3unyTyxsWxbHM3+zlWUu1s/RuIYKHY
                                        MD5:0DBAEB3EFBDF8E99FBE617C3497CCB56
                                        SHA1:3EF37FB40A9215A405D41948CDFB203F54F52C66
                                        SHA-256:BDF24E98FAF5869C392296A3E6EADEFC13C45E31E33B35252AFDE5466683F161
                                        SHA-512:BB5BC56C66089F08ACBD268A689908ECD56CB2D64E965FDE160F5D7844ADB6A3A6FCB6E1602DD6A558300396F7ED4A7061D65C44C3359E7E62B6F15A161BCF3F
                                        Malicious:false
                                        Preview:....._../..N..<.. .y.c...t..5......$Kt....\w..&:2....(.+#....d0... .]..q'0.9\(5U.F.d...\A|P...V.HC.........<..\Q.C.'....h(.....R....Q...;;..9....q...&.=`...O#I.....}..{.o..S..@..%....,.a.N.9e.|..6.X.|..Q..N_t)wX..{...U#U...>...^.l)..S..(^.>.......3g..0.......'....@?" ....:....O\......d...A}.\9.A........8...m..U.....'..#P...d..S......3. .Zzl.Ah[.a.......?=J .......B.U.{B.lO"..1..s..CGP'.".!2/...P .]..>..A.....><..1.K..LE....X....\.o7.}....J..!9...f.=..3.4..[!.....X.l...x.j..Lq..l.=..w|HM.X.C*.....{t...k.H..%@....;...o..$.....b.>5r`....4=gc....(D.....P1.@c.Y.xk..2..fM*.E-..P9V.V...A.....PE.C.q$.....P......,'.A.g...0K(....l..f....`...v3.X.X.@...2..C.}_>P...`Esz...~_."n....+....Q../..Ag.U]..0.0.n...3\....I.#....)..\.../Bl.g..-...O|...P......9Q|..jo...B..1.-8.r!|'g.^bw..}}j3._l6.$>.eF.....%TSv.o..~....\.0.........2.E._@AY....I..+!.Xi,2.$..we.&......@_P......A.;TCs..J2..7...L..8.....M..7AX.;..'.]".Y6T..D...,..h.....%.AG.(.9.W.....s^x...b..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1275
                                        Entropy (8bit):7.834644490112407
                                        Encrypted:false
                                        SSDEEP:24:XSyV2JVDn4wXr9fV6QQTMpEwVva/XI4YmJ3hZaKU91pcBcX2oT7:XvV2JV3XNVFKMeFV7JRZaKUTXv
                                        MD5:A9E1D2433098F2DCDC9ECB7693EF44AD
                                        SHA1:175C2325F3F656972C1DC509F155653B980D1BBA
                                        SHA-256:D19508ADD5C8E783004A1C907C5FB59E37460A4A3C2960C54D29A146776D82EE
                                        SHA-512:936189CB238DBCB0398553F5C7D1373C91841979C9BB8633775C622719859A0CC0F5D61E8A7CBF2C30054AADF9F4CF70344A3C8E6C2FB0AE59019156EF4FE609
                                        Malicious:false
                                        Preview:S<{....EA.4;..6:."l..N.#;.o..V..iV.....P....i.f..on"}....'...mg=..73..V......ia......B.v.(.".kG,.$G.'ug...G..<.XX`X..a...2..=.k.o...y..|g.=..A......... .1....[....%.l.(o.b.;..Y..%..E.v...V.}.`J ..IC./.c8..{@../ T.R]..J']..z3..rq.l.EI.................4.@WQX...ML.U..#.!X"!...../...cz..M.|.v.|..+o.R..........T..R2Q.4......i."..F.....;.....9.......8\...N.=.T.......,.x(.....b.....J.CO....44f1."E...a..$.......)....E......d.=.>y.=5x.(.\.]m.1......yn...v.....s.. ..-Q..y.`...kE..._m.....R..E..=...Xh.pd....c....=)0...%..3.)..j|.........SG...qy.$Kd.d..~.d..c.s.......&..l%o...x.}%..d?tZ.v.fgc.$.1.+x.2.......E...Q9t...PE..R..(....n.9.Ku......W^...|e..]?Z...Y..&...fsm..h.mdJ=..*;..W?.I.4:.rn...h....L3.."G|...X.>...8..n3L......:.ul..X...6'..).#.l.2...t./...w.!Jg]e...`.K..v...]....sN.$..?....&...l..:.OJ.TG.-.].......qS....e..Oj..^w...K..Ap.......+......J....0"....0...'.H.s.M..w..m....f]ft.....t..n"s.N..i....O.k..C.?.s._.cA^c."._...~....9.`}.S.e..nu.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1274
                                        Entropy (8bit):7.850820636404036
                                        Encrypted:false
                                        SSDEEP:24:L4ALMJeVNLUt5Vhd2wmiPwEnyNcyQ63Pre6q3XNKXNSkgX2oT7:LmDH7tPvny22q6INKXYkgXv
                                        MD5:DAC9B409CC501E5A88FF30B37D8DF5E7
                                        SHA1:28FFBEA65EAF79C84DE1862390957FAE50A233E6
                                        SHA-256:B492A4BC323D712EDE66A2392FEB1B56D3DE955AEEA160F6F132C47D1AB4BEC6
                                        SHA-512:5C294DF1B35CC8B3DC45B5E9B449B3D7D953CE0591BDB8507E50F1D4763F9CDFB75EACF7F63FBEBF4A74060C02C32A24C8BEA170F5DBE8BEF7AD77712A9CF98B
                                        Malicious:false
                                        Preview:.1.0....%6]...T..8t......"...\.ob.{?....,.6Tw.LCbKg.\.3B.P.....v{S%..;6..|. ....T.ls...y..s...n..F.......S.v.O..Y.s...o..%.hJ.z.`..-[6+..Ff...s.l..c ..Aa.....WV....T...<..O..Q..7O,.M.n...m..7.....#u....Y.y.*...........o...FAD.u..w|!.....\"...........Y. 6....b...?.........y..V..VR|X..]f=2.u..fN#.....U...'R...Z.c..uF....+f-&.>q....w... s..B.)xQ......S&.oF..z9....$..$wB...u.....c... ..j..5z.o....;.D...`...t..6.MH...y]j.*.r..yh>....W.v.O.*<4..m_.....=)WV..b....s.n~,.G..........X.[...\ws.u.D.-z.Z...61.~i....Ls.{.c..c.aV..'.s..L6..Pg...K.../...x........"....m.9.e{..2...........u'....Z...j..<~..WgQ...-....t..b....K\.`.Xa....-.y...F.&]....>.....|..<....'..;i..bNp.....@."ll}.x.s...2^d.....`..-.G.G...S.....g.....ia.....".s.g...........K....zG2.....~.b\...}.."..<(.u...{....ER[}.B.....5.m.........\.g..:..~...y.x ..5.....P..^......D.Nj..z..!Wz.\3).Z..7..+..j..3o..._.,<n.3IB^YJ.....E.......P.@..Q.........K.:D...>..>@.a.%q....W5...-C.+..URYI.k
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:370 XA sysV pure executable - version 11208
                                        Category:dropped
                                        Size (bytes):1268
                                        Entropy (8bit):7.842321321533381
                                        Encrypted:false
                                        SSDEEP:24:m0sWYQ3zb80a/NXvEW1YGFrEa3RTYVvMvHlvSl/bHlmtJ9XZnYX2oT7:8ujb8ZxvEMZRTYVvM/lKlxY9XaXv
                                        MD5:16FB2336657EBC5CF499FFAD61251C55
                                        SHA1:276FDEAD980C71B25593D31BBB97F070DE130C2C
                                        SHA-256:2435A6046A52EB5D7DCE8EDF6139CC70BAD0F61048A9D39224F25D71D0BB409E
                                        SHA-512:5FDD665FE1D334F8C6820F21E5D72CC8CEBD78972A0A8604C84CE4AEF71276EE04F612A983CAD3091F8BACF9E5404A83ABC5CAB2821363750CAD8022C3FEDEFF
                                        Malicious:true
                                        Preview:.Z.g.s.E.....#.Y.9x..+.......9....Tt....Ws....nF.J..a.9e.y....E8.].G...!...].....4..4..m .]......3.....C.......:*.....Cy..^?.j..'......,u.....(.8 ..^hh[.W.p.......k.q..j....... 5..].0p$..u...R....*..w.?..n.....lf.;n.v...L.T...U.V3..>.z...V..L......H.......8.e.....W=&.e..3....&p...T|.....n...Z..3.....e......z.Ej./."....y^+.8.h[...2...`...]+C...l3_..."../.3......Q[.e.S..... ....e..l.........9.N.O.7X.X..#cq. 9.#*O.k....{.........Z...*M#....A..f.YG...:_..-.#.au..M.P}.i..HU...8.g&....]...bq..".B&...Po.BX,(.....0...4...........3..6.'...... ...9.v.oq..x4..-..U.../#...oS.o..kI..^.-.=..7.........S!.._.........7.......RFt.:....A...b8k .T.s..F..;@..FeG..Ib.{.).L*.....i.goCi.4.H.c..L4..N..Z.4.[.C*......FDL....... M.\/.C..Z......}.Y.7.j3.CJ.B.K.]x.Ob..:X..9...2..eXV.W....<>B...^R.`2c..K....n[..:....}...J..R.*l...5...>.O.,...k.a>..~...gm...q.)...|7...zV....Bh.i#1.......1..s.......YV]G{...N....A...W...+t..Obc.-7u...w.$..3./.Y5b@_N.p..+.FT.p4.&,.u.1.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1272
                                        Entropy (8bit):7.813171572752426
                                        Encrypted:false
                                        SSDEEP:24:o7JVd9HRuUzn2L6r1ESKYCeZUraKMzwDtfppE3cou0L08jg6J80X2oT7:o7JVTRu42L6rlKYVoMErpE3cbW08j3b/
                                        MD5:C4619A3B68E7599E9B41A9554CA50B02
                                        SHA1:BDD65A8E8A652F92666CFF3CF82CF9299106DBFF
                                        SHA-256:9E46241D18711D152427B675757A34AC874B9D67BBF2613E21F68CE5D4E72F64
                                        SHA-512:EA94547C5BE959FC9066A5C8C484E82E501840E29F9CAC819CF84069C63BD0FE0FA1F8E796EE9E0A6E401285362665F3227B9305016311B2225DB2B3CCA021AD
                                        Malicious:false
                                        Preview:.X....e.u.py...}.!".2.V IF...i....`be.....h3.e.6e......`3..H.l!\.h..=.R....n..-..B...B.......6...VB"./...?..-.......@..$.j.|Xa%.C.OB...O..Z1.B....c......GET.y2IF....wW....pn."Pl}..0........U.(..-.-....W.....2..?.`..Xt#.B..*...-.n.r.)..hep_.U[.....V|...1R.o.&..f.|8.P.O.-yA..~...{Y.$XP....$\13......p..-.7.....].&u1.|.1.-...G.8..._f.C...Z...{x....Io8.?...K..Zj=mh...T^\..7......L...V._].....L.....y....&...G...5....q...e.....g...G0..\..........c)..1*....4)..A"..`..yi.u.....Z|.......N..).M..@.t......f..x...!..65H~E.&.C.S.U...`!.[[....}.>....Z..k~[r....i..Ag.]Uq..x.iY...OCW*....frM..2....c9P.]..j.....u..P......v..A ....8...'.X...O......2.#.....i....9aME....._.....7...f..d._OJ,.V]."?$...........c$W....V}\........cNi"Z.c.Cz\..}G....~bq.....p.b.O..U..".I...~.3.XW......i..z%..s6...6.>..M...=....j...W.....To...rBM.O..9......^.BHX..{..rpV<.J...:<f.y.w.B$..Q...!IS..l..$.~.n.G"."..i`.b.S@v.8.r#.../......YBS...|.t+.........|..X.'k~.'...*.....Q.Q......
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1270
                                        Entropy (8bit):7.845842561388851
                                        Encrypted:false
                                        SSDEEP:24:nQD1+o8eNwwcEvgpWe+0bdIelk2wFRdm313Ys4SX2oT7:nQk2OwcEv3e1djW9de4SXv
                                        MD5:3FAF7FDE0B68D80C9579606F5264B75B
                                        SHA1:65F6147794A0305A6F28AA31A2D640C7DD45456D
                                        SHA-256:16A1788CB61E0E35E824ADC1CACD9223A54B8BD465994071EF0744E64B8B2A29
                                        SHA-512:F75227C100BEEEAB94E88D0F03D7CBA2CC83A419249684CBFEE1880AEC19951889EC1313F51F0684C809FA2428BAFA2D37270BDD076BCADDCAFFDEC7999A8C47
                                        Malicious:false
                                        Preview:..<......-.Z...Kk).u...P.k...R...W...b..B......O.MZ.f.p...`.BH.f.F.8..".9".&..n.a.lAk ......d....R..%.\.h\<;.L.y... :f[.......-.....:..%d.......mzZ....]....1....q.S7....l.....Qz.iX......W..Q...;..~M...m......B...AW#BLV...S~.c..m..ejyU.^..;.....Dd..q........;hL.L......K...T.9b..O..<;..U../....Q...v......z.*.....U.N.N..*...7..cY.....iUN}.HV..&\4S;..5........m...r~V..j.|....+......v..;.bQ....Fs/8.n.~0;Q{1;......L..&..0....9.LZ...?.^<...-pn.g...U:..PVc....z.x82....6kQ3:...S}.aV.j. ....`...5...-......Q.A..~9T....l.G...b.%Jk..:'..S..z...W....7..UgJ..H..Q....^.....OZ.@.T"./!.n..P='+.3....M>C..{n.!h..../B.}{p........f3hl.x[......;.2...3F..#..c.aEEL..c.....J....q`....J......c.....Qb%./..]..G.Rb.U.V..\.%.......=.OS......sI...M.7^..CP.F...^......%5.t_3.....x..$..#.\...D....C.t.I...Nn.D#.4.k$&3a..SF.8...UE~....Zw...w..P..>..-.t.f.v.}]v(K,D.R8..{n:.4y...J.6.B'..h...1....$].(... ....B...{z..0.ms....y.*..igI]5q.L...Og.|..D.......s:/_...k..<..pR?.$..
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):350
                                        Entropy (8bit):7.398765023233902
                                        Encrypted:false
                                        SSDEEP:6:mb81UeqJBwZyo5svzGpQpT3CSJafcf4o2rOUd6Qihje952lItGIUCKcpqKsM:jU/BaevzjpVkfJzQcX220IAuTsM
                                        MD5:41975012DC9B6A16735540CCC6D20344
                                        SHA1:90EA57AE07D341D1F698297FB1B125927DFF3154
                                        SHA-256:7BD9AF6D2802FB49C57E1EB6391258C9993A54389A29704FC8FDFA6F18F202E0
                                        SHA-512:40EA04FEDEC7171EB43A4EC5CD559813322B3BA91BAC34C21DCD03C4A2F3842A201B8A6452BED06509C75C8BFDB7E74AC8283E6ACE4532756057CA956DA13099
                                        Malicious:false
                                        Preview:D.~.....Ht...T.*...C.N....L#"y.<.R..u...$j=....o....JdF..f...?.%....6..M.....n..w!e....C..;r{....[D........u.G.v0.-.t{{.%.:E.....).0x...>.~......M.....OF&<I..$,....&.|':.K......%w`.\K..D?!&...s....q........i.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):443
                                        Entropy (8bit):7.525230695833713
                                        Encrypted:false
                                        SSDEEP:12:yPRirecRyJz7X2ZdzPplVzm4hWlMQX220IAuTsM:EdcRKzKTzplVzmd6QX2oT7
                                        MD5:CA5CFDBF1C2DA035D3F381A196C96697
                                        SHA1:A61C3AE7876A049D825F1BF12A7C92CB6F1F7956
                                        SHA-256:FE6812BF46B4591F458B87762B6D424C8D8699EF37BD8A312659CDC2C9062523
                                        SHA-512:0D2BC32FE67670E672C96831CA095D008C4BDDD833CEF9B620F94575D839422DA987747B9C5E22BABDE1B5D4AE042D6F98FBE4208FEA0BED1E7D7C8B8EA27CF6
                                        Malicious:false
                                        Preview:tE@.....nY.0..*-Y[....z....e.:28.E...hsRkS...o..apS4...]1h...2..,5..<...k\wk.(.....3Ez........?..&)....u.^A..Q..L.[..sWlM.`.gl..qL..V....ci-....`....b9I..2....4U..0...%.<..T..m.6...=.?....v)..@'*R0..u.G.v-.l.o{'.<.....},.l.0x...>.~...:'.R&.....dt..lX..42J'A.......%].e .?...........*..D.VMy...e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):355
                                        Entropy (8bit):7.3931246340471946
                                        Encrypted:false
                                        SSDEEP:6:AquCQ3RrY+n6buvC3LgfarlOqcgQx+jaghje952lItGIUCKcpqKsM:A/c+n6YUWars/EjuX220IAuTsM
                                        MD5:16061458E1FC1EBF3B2C4B33D6BF78E5
                                        SHA1:0124963C348159C75CBFD8C73333857CE0D7F1EB
                                        SHA-256:DABC837D5ED0F6D5B5009A9B0DF75458AA594B7F92A67ED8BE735FC2CADA49DF
                                        SHA-512:DD815F30529ED59D03D8DCFFC53CCF03D6457F5DEBB54868A8ABF81F43105BCAF444DA956CFA2281C2947143AA08F9DBEF849D842941CCB681BBAA196E31001E
                                        Malicious:false
                                        Preview:|...n.r.\..eN.....E[.4.B..N...s..t.s.0{A.t.....A...Q}.rF.IL.X......PX^Q.j.._$.\].<g.....|...V:Y..h..0.....?.u.G.v/. .uUP.^dF.cs@.<.0b...l.~......NQ.k....xI(..s..!f..`m`..6.7m.X7.i..b...]...y...A9....=..(s.+.l.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):347
                                        Entropy (8bit):7.418067547180364
                                        Encrypted:false
                                        SSDEEP:6:iYdbxTdevEuNlOjTnMhkyfQeMwyCV8kxw7pTaJo6D/hje952lItGIUCKcpqKsM:XdbxRevEwojT8dQeMbCWH798DgX220Iz
                                        MD5:46F17D729A972EA932A5D6C462BDC10E
                                        SHA1:8095D6D59B7316EFC62CF68E8057F800E0B9A329
                                        SHA-256:15F3120559E2D89EB5F6C248A7585C293E4B3881788D611A652C4EC3E4303464
                                        SHA-512:4CA701D4D5634D0C5B0E6C5FCDB34750B8D97B41E83367CADE5722A8F99C36E2EFB8248F42560E65A7E18E7E60E60458A8E1C59A909192E55301248142E142A1
                                        Malicious:false
                                        Preview:x.Q<C.i....V.r(.x>H.;.'.e....g[..WG..|..)q.VryT02W....b...(.y'....]..~q.Sr.I./m.^...]...i....%...j&.@d......!.u.i..D>L"..[.]8]...i,.>J0x...=.~....{..'g.j.NYb...L.;A...R......g.q.boq...v?.....'...#...W..Q.M.f.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):344
                                        Entropy (8bit):7.358210641556898
                                        Encrypted:false
                                        SSDEEP:6:X8qH5GFCCcN1Rq1UlQuQZonq7CM4QpOdJ2esXZU2YlITn/hje952lItGIUCKcpqI:X/H5CCCqlQuQGACYgLaxYKTgX220IAu/
                                        MD5:03F4AA8BC3CD5C59B58DF4CB409B3A1E
                                        SHA1:198A6F7C727409C7B58993F3736A081A9DD5B8AE
                                        SHA-256:9B6B93C604C4E7CD7DE5393083280ECA0DC77685423E31341AF5EA73959ABCD0
                                        SHA-512:3E2EE3FAC6DD93B7B90B10F7FDD9978C66827A701038480279E203FC90C016079EF25B3D562F00C1E01172F83250499E2E01271C56E35EEA37A1677534A80302
                                        Malicious:false
                                        Preview:.PUCn?....e.)J#q......^1.n)ds...w?.....K.R..`.oLV...B.2..:U.......nD.....J...D[....c..'(nM....0O.......u.G.v/.l.o{'.<.....},.l.0x...>.~.....b.$(k.......@I.c....D,?..N...s/.'..x...Bd,X.K..>.f..6w..%..e.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):353
                                        Entropy (8bit):7.374769983864686
                                        Encrypted:false
                                        SSDEEP:6:Wu+ak6+HZxjTcBrPyl3zLIbIGJTKEZfdpubimUPCsMihje952lItGIUCKcpqKsM:o6MxvcB+ul+odIbimUPCtVX220IAuTsM
                                        MD5:BC5594E5C6C5DCDEFAA365F1E53A6DC2
                                        SHA1:38C25F2A299438C5B73596BBE7EAB3F619D2559D
                                        SHA-256:666A5E4AA4BC671EE013C2A84BD53C895094F5F9FB93555C3EBD1E10B9A7AA0E
                                        SHA-512:DAF00BF093BBD550D2DDB2E9C1508357BBD93AE282A58A476DC2A15A1EE8EA362BF186CC33391391CC509366DFAC5F26273C95F0E9865C4E1047E09F7A8BA754
                                        Malicious:false
                                        Preview:..*...^~..w2y..o-P.WQ...+2.....8...!2l.......!..1..=.e%m..dSO.....kvp..j.._ON..6Q...B\s..C..G.k.i..}{.P.!w..u.u.G.v#./..{&.~.=E....G<.)x..Q>.~......MQ......]X.yX0'P=...5..t..j..2...R...U.t..#....)&....!...WQ|H.w!.k.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):349
                                        Entropy (8bit):7.451265237514853
                                        Encrypted:false
                                        SSDEEP:6:lBVw9So2r458AoGopkuQ4S3PpdpUURqvfwnZ3hje952lItGIUCKcpqKsM:3Vw9RK4ippjQ4SpUURqgnZIX220IAuT7
                                        MD5:5BE9B31D44D04356F4824D34FB557C9D
                                        SHA1:5D3F7B19B6AE2308FE8E86129BDFCAA4857C3D08
                                        SHA-256:9161D934D5EE61C0F607466253ACB729883AD4C9106C04BD95A346817353890E
                                        SHA-512:D239D0AD6E6416AC06168E3506A820FF57BEF049D40619BFB3EBA62B75D5B0CA088921DCD5067F3402BE451A34BDCECFD7F69B42D0041FB20E98543C93F71DD2
                                        Malicious:false
                                        Preview:.......c$..,H....B 0O.N.......J.K.p..4.b... (.@..U)..%..i\VQtm........)..lg.(KW=....r.!..$0..!(..j..#N.i.u.G.XO;L3..[.^8F..},.>.0*...>.}........+c.lI6...E......X.`.#.._q..x..M.c<IH./...M..l....Qf"...O=..h.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):350
                                        Entropy (8bit):7.3162771220816785
                                        Encrypted:false
                                        SSDEEP:6:Cc80MhL22JK5PV1H/FdCBJUw4tOpZepHH1KdJJx7hje952lItGIUCKcpqKsM:B80MhYjFdCi2pgpn1Kdnx0X220IAuTsM
                                        MD5:37AED65865119117DA80DF68769F6D3F
                                        SHA1:0EC73DF5D30ECB745120658FC4E315A3781DA96D
                                        SHA-256:E73E91C3A268F81C6F92BB10CFE495D02D032C3404FD5FB728AAAAD3A55B20D9
                                        SHA-512:BD144613FD15546041B20B30365F0EC7845B213CC59BCA2F1E0C3C29A73701BFE4D0D8B69510F78B16C7A56F0DAAA946423A871297C7C7E70C8E2FE4D09F0B82
                                        Malicious:false
                                        Preview:..\-l..:...[.c {.TT#..E............b).p8....,D...iH._<Ti.<...1/...(..(...Ze.4[.I.(t[.2..(.0jVrC..q...b..s...u.G.v>.G"..[_\?E.d..,.>.0*...>.}.......}..l.s-..4$H.?..ML..,P1l.M..>9.$.......&V4...H.....OW.B..h.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):356
                                        Entropy (8bit):7.390889042086023
                                        Encrypted:false
                                        SSDEEP:6:Pdvjqiw/kblRIT9uaKEn01RUDrGAnarplweRPim0tbD7hje952lItGIUCKcpqKsM:1jZTRuxua+RUDrGAnar7rR6m0tbD0X2y
                                        MD5:DD90D3EAF44FFB272F80A3B3C46D2725
                                        SHA1:2AB066DE08BCEA4B934AC1D8D6041F29D9F1D80A
                                        SHA-256:FC696D29D690170620C82C5D061B04538E643D6B2F4E4E9FB131BE8D1C753089
                                        SHA-512:366688ECB8590DEE42DCB1123AD66065C42469F62F8F74CE7D76BE804F5F6B8BB540BC122F8D35B27E76F477B5B6D4A65F1EDBCB2D3DD7FF07A32D82B5FFFF79
                                        Malicious:false
                                        Preview:.B...nO...$SmP5f..?..|.A.>.G..j.bF.a.|.[.....`U.I..d..m.9..3NX.T\.\K..d...T..T....k...y+.QFZ.s.T..q...*..L.u.G.XC"L"..D..d..ec.@...0b...l.~......NQ.k.4....ws..$..QS.';.Mh..*<.`D..Q......a.okl.U........e.^@Q.Fl.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):350
                                        Entropy (8bit):7.387150933044558
                                        Encrypted:false
                                        SSDEEP:6:jjadZmq1JwNKZKndQNzJ0UmEnwjoHdldrvRczhje952lItGIUCKcpqKsM:jjadZm5NKEGNzJ0RoPdLy8X220IAuTsM
                                        MD5:48BF06C723C81875471E6F2F9AE0EB9C
                                        SHA1:DE3978208643BB2BCAFE066A8EB0C1353B2B6546
                                        SHA-256:485AD0CAABCAE9507A7D5E262693D9D37282F7FA1058D4D9787AB6C8B9869295
                                        SHA-512:404DC12B525D666070ACBDC5FA97DDCAC023224F6A92DB4A5B03388755A3E5EA765DE06CBE98CE483936D713F7B810DFBAC04956A273A5F52924CCA4CD940205
                                        Malicious:false
                                        Preview:...NX"... j.$.VB]+..d).....L...lfX6..|..K.}.6.........C....Wh.....W..+.....+....D=w"p.`..]..J#..rn..*w..w!RU1&9.u.G.v>.K%..Y_A8..d..,.>.0*...>.}..........:......p....{.X..a4..b7..|hIP.!.Hi..n.o...P.UP.?...D.]...x.h.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1173
                                        Entropy (8bit):7.85271733873682
                                        Encrypted:false
                                        SSDEEP:24:4antvTEI16NwNM/SqW0ycZIiy3P/xp1i82oavULX2oT7:4GYv4ecBcZPy3HX1iwavUXv
                                        MD5:A3C5B66E576E594DC907887DF05A90A1
                                        SHA1:C630E272ED0A4BC9B59DF322E627969E5E00FD26
                                        SHA-256:20476CF66744844D3152F48421B2ECF97420DEDA496B39AD21429C07BC39F799
                                        SHA-512:BC62B9D78320FF9CB95170A7F75DFB67D1776992B37A06D95BAF0CB9F09E033FF99E6C82C3441A57BFB1AD23311ADAC2E94014F53055E1D4528B78C8D9A4415A
                                        Malicious:false
                                        Preview:T...b....^6u.j.z....._.W+....s......&._Le..i..y#....F}..h.\k2....b.,...)rFk?..@.N..<o.m....m9J..R.y.v..2......1#..i.N1....+6S.....S.Y.:.UFL..W.W...X..`.[.....o.......,RL.....az..v.-..k.1.e....0q..\e.[.h:.5...9..D0..Bp...0.h\.....m>.M....o.4....D.W.....cI.d.....tNS".PS.C.w8......H.\..pa...I.z.....4.7......v).D.!.....N.u>..;..W.o.`Q'.t{x.....~.......,..J..(....,..>.#.*.=LW...+A......;...!..>.j.`...6....;...K......MM..?.z.....Q....:s..5(...2)+....R..Go.2...H........UU....He...*D...C..k.}H.r.....j...X=%. @yK..E.k.._....,..\.;..u..S..O..h........].k.1.g]."...,.$..(..;...T.W.R...U.]#;...(...T.(...`."n....Y.B.m.y7.k...._.^.v?..gQ#....OlsgY.z....1..].v..:/x../.....Yb0.t..N.{...8$D...B..*O...=...{.._)..ub.5w`K...h.v.I.>..9..l...9.).#......H{.i...[.i.u."..G......=....M.`.[w7.....;/. g....q.-[b..G0..G....u.G.v8.6.7UP.\.E.M.H..4n.}..5&.t...z0..t.._..]m%e|nw..a].b...#`...~..74.o.3L.*...o..2^.....?....&..w.f..auLj.^I<c.,.<.E.L_......p...tHt...
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):239
                                        Entropy (8bit):7.15371858609671
                                        Encrypted:false
                                        SSDEEP:6:k5/T0q/R3okBGel1JmKhje952lItGIUCKcpqKsM:kFr3yqUX220IAuTsM
                                        MD5:6C61C395E5F62A0C28E5144A16508369
                                        SHA1:B83E6B3DC17DCAAB755786B8209B8524865B7CAC
                                        SHA-256:EB31347D368697D050621524CD7409501D3032C8D09491433BBDDFA717150EAE
                                        SHA-512:C57065701DC538A2EAE95788641242F861FB3F216B47E14C6330736B2F36EEFC394386F40876482D27DCA3881DF3A24A0879DFDA98B6196801B5B49C601951BF
                                        Malicious:false
                                        Preview:E.).e....u.G.v8.....5sPEH..C},.>.3x...>.~|..g.,..hj..8.q......^j...f.X<[..v\..B."....xz.b...P.;.....a.....^..N..:-%OP..+jv.%.)h(k..X.*.n..@..%Q..e...Y.t^......#...<.I\$.U....3.NB.tY.B-1.}.`[.....,..T&@9.2gx..kO6..R..'s?...j.*.
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Windows\splwow64.exe
                                        File Type:Microsoft OOXML
                                        Category:dropped
                                        Size (bytes):13756905
                                        Entropy (8bit):7.892738997603115
                                        Encrypted:false
                                        SSDEEP:196608:j6eAGaClHRrJUHLaBIhV1kZsxTx911rlc1aXt+mZn6ooQLIap:eFvL6udh1rlqhQjp
                                        MD5:DFBED66B95E0C396C809FD51AD3D6DA0
                                        SHA1:E8121E93302CD33188AC070AA2D3A80E9A4F514B
                                        SHA-256:0C1B35EEA279037BF6B217E030979695C7D0061BFA26C6ED080632C77762E0AA
                                        SHA-512:B8431BB38434421CAAF8A85CEA6E1451F9118DDE1A3B75149B5CAF97D2B306175FE39FAD69F59AE4D450A62925F405F5D9F3EA8BB1783548315B4297007C6181
                                        Malicious:false
                                        Preview:PK........-n.X................[Content_Types].xml/[0].piece.....0..W..o.x .....e.(....Ql!..<...S^.MMw....#Nr.9....p..:..J.z..`3..DM....T.n..J..-c...3....&a#......PK....X.j...q...PK........-n.X................[Content_Types].xml/[1].piece..1..0....eE$....{e.C.&..X.........H\., .....o.T..i.."...K.s..4..VW...i+.Ak.....}....\.+..O?PK..K..jb...l...PK........-n.X................_rels/.rels/[0].pieceM.A..!.E.B.w...1.....9@...C!...?,].......f..4.qp.,.._^I...y?\`.....Cc.jF". .^...#g.T.A.e.c.........3.....PK...BpJl...y...PK........-n.X................_rels/.rels/[1].piece..K..0....9@&.....nk/.....O3S...s....L/'.UN...'.......P....UO:....=X......B..gD...c]...[..[..3..9.9a.... .....N.PK..4...u.......PK........-n.X................[Content_Types].xml/[2].piece-.A.. .F....p.u.q.&....!...m..[.n_^..kA.......>|.......f....`........}..F..(v.6.t...0-.n.C|@.N-.Z...PK....[Pm...{...PK........-n.X............%...FixedDocumentSequence.fdseq/[0].pieceU.M..0.F..fo&.....H.`..2.....H.o..p
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:ASCII text, with CRLF, LF line terminators
                                        Category:dropped
                                        Size (bytes):1236
                                        Entropy (8bit):5.0934401845799835
                                        Encrypted:false
                                        SSDEEP:24:3RMN1i2JeMLweurSazgMU1ocFRxKJSJEnGeqWRCX0ROsRc0qTlHczRqxzWPFeY:32N1vOecSeQ1ocJG33XC0wkc0qpH0pPV
                                        MD5:C98594C43506B3F4802EBD608BA6BE0F
                                        SHA1:D8E090434533229FBDCC104B6A43903BFDF8C081
                                        SHA-256:804575F74FE5B2F28C181F3413B23A0355693FFD9A2C1E69546BB598CE67EBAE
                                        SHA-512:5E3767A0606DAE51C49A41DDFDE2DD90A17EB53C79212D46C556141BCC6C54BD1C06348A7077251FF75228A5E3604880CABB1309A68490736203E3C49F5C6CBA
                                        Malicious:false
                                        Preview:. ~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~..>>>> Your data are stolen and encrypted...The data will be published on TOR website if you do not pay the ransom .....BTC amount 0.01 = up to 12hr..BTC amount 0.02 = up to 24hr..BTC amount 0.1 = up 48 hr..BTC amount 0 , deleted all files from you PC, and post all infirmation to public.....where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST...Time just 12 hr, after everythink will be removed..You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. ..You have 12 hours for the transfer, ..24 hours for the amount of 0.02, ..and of course, you can always wait 48 hours and pay 0.1. ..After that, send a request with confirmation to TOX , faster way!..You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. ....Using To
                                        Process:C:\Users\user\Desktop\LB3.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):64
                                        Entropy (8bit):3.5006992659656038
                                        Encrypted:false
                                        SSDEEP:3:4laL5I2Y1AnNv/EFRR:4lnGNkRR
                                        MD5:2B372F6CF06B740F9341C5CFE7F50D2B
                                        SHA1:894C494276035009649032C347E8CA1D4B9FA594
                                        SHA-256:5EB035ED6D8E25F46989C9D2B9185A8F6DDB3242E92D69388A8DC6F91C683D5F
                                        SHA-512:777D0A77221EADB9B49C564F71895FDCBBC767B1C2193E863614BD2E34DD3C673DE84B19C51212022490AEA622531C738DBCC6C51D075C8256FC479102F1A665
                                        Malicious:false
                                        Preview:....2.5.8.5.5.5.....\MAILSLOT\NET\GETDC56A55C22............ ....
                                        Process:C:\Windows\SysWOW64\cmd.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):22
                                        Entropy (8bit):4.186704345910024
                                        Encrypted:false
                                        SSDEEP:3:otlJRln:otP
                                        MD5:2FFF65AE0DCB46048EBC56B8F60A6738
                                        SHA1:DD6DD2EEC634790B342D67564B3C9F67257F287B
                                        SHA-256:0D2A0F6C80307744E412156631FD7275C875CD05DF35002527329F1CCD7EA527
                                        SHA-512:CD61DFEB26BC23B55A86DAD7E9B498C6C56086C557BB0D74E8FAE166CFF3655922D1BF2CB20DB05C82FA44BE39E01A10CBE03F2B5A3B85C33A10AD5D28AC670F
                                        Malicious:false
                                        Preview:C:\PROGRA~3\D9D5.tmp..
                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                        Entropy (8bit):7.206192009985595
                                        TrID:
                                        • Win32 Executable (generic) a (10002005/4) 99.94%
                                        • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                        • DOS Executable Generic (2002/1) 0.02%
                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                        File name:LB3.exe
                                        File size:150'528 bytes
                                        MD5:11c051782c327c662507801124f0b95b
                                        SHA1:5dd92a1ab1cfc5b73b5dcdb3edd6ea6d498339df
                                        SHA256:3c13ae9a53b29849fd3bb75d3259a23658cd687441f8bdd610487007c51d2eac
                                        SHA512:239f6eba567c59cf956e4f6c8ffe6588bb2b16ede03e939f79db69ae23631881285475f634780a40f94038035fb1329743c9b57c92a9690ec927f6d372d9ca2e
                                        SSDEEP:1536:GzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDuc1UR7zBEDZhT+IhMjo9Uyz:9qJogYkcSNm9V7DJ1URfqVXmjo9T
                                        TLSH:2BE37C21F15ED0B3D47718F12736A17EB3EA4D2C1AA56903E6E50F887CA59232F0591F
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!c............................o.............@.................................@.....@...........@....................
                                        Icon Hash:00928e8e8686b000
                                        Entrypoint:0x41946f
                                        Entrypoint Section:.itext
                                        Digitally signed:false
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                        Time Stamp:0x632112B1 [Tue Sep 13 23:30:57 2022 UTC]
                                        TLS Callbacks:
                                        CLR (.Net) Version:
                                        OS Version Major:5
                                        OS Version Minor:1
                                        File Version Major:5
                                        File Version Minor:1
                                        Subsystem Version Major:5
                                        Subsystem Version Minor:1
                                        Import Hash:914685b69f2ac2ff61b6b0f1883a054d
                                        Instruction
                                        nop
                                        nop word ptr [eax+eax+00000000h]
                                        call 00007F6680EC3985h
                                        nop word ptr [eax+eax+00000000h]
                                        call 00007F6680EB0D12h
                                        nop word ptr [eax+eax+00h]
                                        call 00007F6680EB42CBh
                                        nop word ptr [eax+eax+00000000h]
                                        call 00007F6680EC1D10h
                                        nop word ptr [eax+eax+00000000h]
                                        push 00000000h
                                        call dword ptr [004255C8h]
                                        nop dword ptr [eax+eax+00h]
                                        call 00007F6680EC3669h
                                        call 00007F6680EC366Ah
                                        call 00007F6680EC364Dh
                                        call 00007F6680EC364Eh
                                        call 00007F6680EC3667h
                                        call 00007F6680EC365Ch
                                        call 00007F6680EC3645h
                                        call 00007F6680EC365Eh
                                        call 00007F6680EC3647h
                                        call 00007F6680EC3642h
                                        call 00007F6680EC3625h
                                        call 00007F6680EC35F6h
                                        call 00007F6680EC360Fh
                                        call 00007F6680EC35F2h
                                        call 00007F6680EC3605h
                                        call 00007F6680EC3606h
                                        call 00007F6680EC35E9h
                                        call 00007F6680EC35FCh
                                        call 00007F6680EC35EBh
                                        call 00007F6680EC35E0h
                                        call 00007F6680EC35E7h
                                        call 00007F6680EC2138h
                                        call 00007F6680EC2145h
                                        call 00007F6680EC2152h
                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x1a2300x50.rdata
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x270000xfcc.reloc
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x1a1200x1c.rdata
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0x1a0000x70.rdata
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x10000x17d460x17e0057ad8095d0d1b2e0663fbd3ef4405410False0.48270819698952877data6.613530972543989IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .itext0x190000x5690x6000adcc204eb91a7bbe4f95e6c65202fe1False0.255859375data3.0389614741823974IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .rdata0x1a0000x4b20x6009264ea7f335858b063b39397d3c51d14False0.3821614583333333data3.6588662154359954IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .data0x1b0000xadc80xa0007f2a8604b0fbd012701c6deb613cef72False0.9827880859375SysEx File -7.988268783679153IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .pdata0x260000xcb70xe008affc7e653e1832a185aeef87a020185False0.9246651785714286data7.6410768062707675IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .reloc0x270000xfcc0x100068a4352eca889669f544bd64baa3f961False0.8427734375GLS_BINARY_LSB_FIRST6.728533295109IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                        DLLImport
                                        gdi32.dllSetPixel, GetPixel, SelectPalette, SelectObject, GetTextColor, BitBlt, GetDeviceCaps, CreateSolidBrush, CreateFontW, CreateDIBitmap
                                        USER32.dllLoadMenuW, LoadImageW, CreateDialogParamW, CreateWindowExW, DefWindowProcW, GetDlgItem, IsDlgButtonChecked
                                        KERNEL32.dllGetLastError, GetProcAddress, GetModuleHandleA, GetLocaleInfoW, FreeLibrary, GetFileAttributesW, GetCommandLineW, GetCommandLineA
                                        No network behavior found

                                        Click to jump to process

                                        Click to jump to process

                                        Click to dive into process behavior distribution

                                        Click to jump to process

                                        Target ID:0
                                        Start time:13:30:56
                                        Start date:30/07/2024
                                        Path:C:\Users\user\Desktop\LB3.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\LB3.exe"
                                        Imagebase:0x330000
                                        File size:150'528 bytes
                                        MD5 hash:11C051782C327C662507801124F0B95B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2059958593.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2046379671.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2124654203.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2076378467.000000000112A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2046545307.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2047950020.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.2519220594.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2126925110.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.2520012677.0000000001210000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2077273451.000000000112A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2076696808.000000000112A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2134232080.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2135881398.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2124531922.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2131744862.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2123819055.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2126388021.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2049589005.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2136330514.0000000001213000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.2519846251.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2047950020.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2131851074.0000000001213000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2134155794.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2502279754.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2134917238.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2077365585.000000000112A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000000.2036214305.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                        • Rule: Windows_Ransomware_Lockbit_369e1e94, Description: unknown, Source: 00000000.00000000.2036214305.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Author: unknown
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2128505179.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2077557162.000000000112A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2052572656.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2051284799.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2122293689.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2132955386.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2123057214.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2121612974.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2123606251.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2133500746.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2135502951.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2132819771.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                        • Rule: Windows_Ransomware_Lockbit_369e1e94, Description: unknown, Source: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Author: unknown
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2135126379.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2133362008.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2051284799.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2135711982.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2076225685.000000000112A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2134445994.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2135629721.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2134402493.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2077653905.000000000112A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2124340239.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2135022255.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2049589005.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2134492300.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2108854474.0000000001116000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2144130407.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2124104518.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2123910235.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2120680181.0000000001215000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2075730284.000000000112A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2125747303.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2076922515.000000000112A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2125217864.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2127233262.000000000120F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                        Reputation:low
                                        Has exited:true

                                        Target ID:4
                                        Start time:13:31:25
                                        Start date:30/07/2024
                                        Path:C:\Windows\splwow64.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\splwow64.exe 12288
                                        Imagebase:0x7ff6201f0000
                                        File size:163'840 bytes
                                        MD5 hash:77DE7761B037061C7C112FD3C5B91E73
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        Target ID:9
                                        Start time:13:31:43
                                        Start date:30/07/2024
                                        Path:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                        Wow64 process (32bit):true
                                        Commandline:/insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{B1C7A99F-124B-4D04-A522-91304C44F3D0}.xps" 133668342863650000
                                        Imagebase:0xf30000
                                        File size:2'191'768 bytes
                                        MD5 hash:0061760D72416BCF5F2D9FA6564F0BEA
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:false

                                        Target ID:10
                                        Start time:13:31:44
                                        Start date:30/07/2024
                                        Path:C:\ProgramData\D9D5.tmp
                                        Wow64 process (32bit):true
                                        Commandline:"C:\ProgramData\D9D5.tmp"
                                        Imagebase:0x400000
                                        File size:14'336 bytes
                                        MD5 hash:294E9F64CB1642DD89229FFF0592856B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Antivirus matches:
                                        • Detection: 100%, Avira
                                        • Detection: 100%, Joe Sandbox ML
                                        • Detection: 92%, ReversingLabs
                                        Reputation:moderate
                                        Has exited:true

                                        Target ID:11
                                        Start time:13:31:45
                                        Start date:30/07/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D9D5.tmp >> NUL
                                        Imagebase:0x790000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        Target ID:12
                                        Start time:13:31:45
                                        Start date:30/07/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        Reset < >

                                          Execution Graph

                                          Execution Coverage:21.8%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:17.3%
                                          Total number of Nodes:1978
                                          Total number of Limit Nodes:13
                                          execution_graph 11417 33a9f0 11419 33aa13 11417->11419 11418 33aaff 11419->11418 11420 336830 RtlAllocateHeap 11419->11420 11421 33aad3 11420->11421 11421->11418 11422 33684c RtlFreeHeap 11421->11422 11422->11418 11423 33def0 11430 33ddeb 11423->11430 11424 33de3e 11425 33de4d ReadFile 11425->11430 11426 33e006 WriteFile 11426->11430 11427 33e0ac NtClose 11427->11430 11428 33684c RtlFreeHeap 11428->11430 11429 33df8d WriteFile 11429->11430 11430->11424 11430->11425 11430->11426 11430->11427 11430->11428 11430->11429 11121 33fe37 11134 33fcae 11121->11134 11122 3369a8 RtlAllocateHeap 11122->11134 11123 33f4f8 NtSetInformationThread NtClose 11123->11134 11124 33f634 NtSetInformationThread NtClose 11124->11134 11125 33ff37 11128 33ff45 11125->11128 11130 33684c RtlFreeHeap 11125->11130 11126 33fecd 11126->11125 11127 33684c RtlFreeHeap 11126->11127 11127->11125 11129 33ff53 11128->11129 11131 33684c RtlFreeHeap 11128->11131 11130->11128 11131->11129 11132 33b390 2 API calls 11132->11134 11133 33684c RtlFreeHeap 11133->11134 11134->11122 11134->11123 11134->11124 11134->11126 11134->11132 11134->11133 11135 338f36 11136 338f38 RtlAdjustPrivilege 11135->11136 11137 3397a8 4 API calls 11136->11137 11138 338f70 11137->11138 11139 338fe0 11138->11139 11140 339850 NtClose 11138->11140 11142 339005 11139->11142 11144 338e9c 4 API calls 11139->11144 11141 338f7e 11140->11141 11141->11139 11143 338f87 NtSetInformationThread 11141->11143 11143->11139 11145 338f9b 11143->11145 11144->11142 11146 338d78 5 API calls 11145->11146 11147 338fb0 11146->11147 11147->11139 11148 339850 NtClose 11147->11148 11149 338fbe 11148->11149 11149->11139 11150 338bb0 2 API calls 11149->11150 11150->11139 11318 3474b2 11344 347487 11318->11344 11319 347580 11323 341fb8 15 API calls 11319->11323 11320 34758d 11321 3475a2 11320->11321 11322 347593 11320->11322 11324 3475b2 11321->11324 11325 3475a8 11321->11325 11326 339b80 14 API calls 11322->11326 11327 347588 11323->11327 11329 3475d1 11324->11329 11330 3475b8 11324->11330 11328 347308 27 API calls 11325->11328 11331 347598 11326->11331 11328->11327 11333 3475d7 11329->11333 11334 3475e1 11329->11334 11332 346efc 5 API calls 11330->11332 11335 341e50 135 API calls 11331->11335 11336 3475bd 11332->11336 11337 343868 5 API calls 11333->11337 11338 347634 11334->11338 11339 3475e7 11334->11339 11335->11327 11341 346b18 2 API calls 11336->11341 11337->11327 11342 347643 11338->11342 11343 34763a 11338->11343 11340 347616 11339->11340 11347 346d04 2 API calls 11339->11347 11340->11327 11348 340410 13 API calls 11340->11348 11341->11327 11346 33a308 2 API calls 11342->11346 11345 346b18 2 API calls 11343->11345 11344->11319 11344->11320 11345->11327 11349 347654 11346->11349 11347->11340 11348->11327 11350 347678 11349->11350 11352 33a308 2 API calls 11349->11352 11350->11327 11351 342384 11 API calls 11350->11351 11351->11327 11353 347667 11352->11353 11353->11350 11354 34766c 11353->11354 11355 339b80 14 API calls 11354->11355 11356 347671 11355->11356 11357 346f90 135 API calls 11356->11357 11357->11327 11266 34017c 11268 340079 11266->11268 11267 3401e9 11269 33684c RtlFreeHeap 11267->11269 11271 3401f7 11267->11271 11268->11267 11270 3369a8 RtlAllocateHeap 11268->11270 11273 33f634 NtSetInformationThread NtClose 11268->11273 11279 33b390 2 API calls 11268->11279 11280 33684c RtlFreeHeap 11268->11280 11269->11271 11270->11268 11272 34026f 11271->11272 11274 33684c RtlFreeHeap 11271->11274 11275 34027d 11272->11275 11276 33684c RtlFreeHeap 11272->11276 11273->11268 11274->11272 11277 34028b 11275->11277 11278 33684c RtlFreeHeap 11275->11278 11276->11275 11278->11277 11279->11268 11280->11268 11448 3377fa 11449 3377fc CoInitialize 11448->11449 11450 337831 11449->11450 11151 33ac38 11153 33ac20 11151->11153 11152 33ac36 11157 33684c RtlFreeHeap 11152->11157 11153->11152 11154 33ac53 11153->11154 11155 336868 RtlReAllocateHeap 11153->11155 11156 33684c RtlFreeHeap 11154->11156 11155->11153 11156->11152 11158 33ad80 11157->11158 11469 3397e1 11471 3397e3 11469->11471 11470 3397c9 NtQuerySystemInformation 11470->11471 11475 3397df 11470->11475 11471->11470 11472 3397fc 11471->11472 11473 336868 RtlReAllocateHeap 11471->11473 11471->11475 11474 33684c RtlFreeHeap 11472->11474 11473->11471 11476 339804 11474->11476 11477 33684c RtlFreeHeap 11475->11477 11478 339842 11477->11478 11159 33dd26 11165 33dcdd 11159->11165 11160 33dd4c 11162 33dd99 11160->11162 11164 33684c RtlFreeHeap 11160->11164 11161 33dcf9 11161->11160 11166 33daec NtTerminateProcess 11161->11166 11167 33dbbc NtTerminateProcess 11161->11167 11163 336868 RtlReAllocateHeap 11163->11165 11164->11162 11165->11161 11165->11163 11166->11161 11167->11161 11479 33d7e6 11480 33d7e8 11479->11480 11499 33cc60 11480->11499 11483 33ce38 RtlAllocateHeap 11491 33d827 11483->11491 11484 33d928 11486 33d936 11484->11486 11488 33684c RtlFreeHeap 11484->11488 11485 33684c RtlFreeHeap 11485->11484 11487 33d944 11486->11487 11489 33684c RtlFreeHeap 11486->11489 11490 33d952 11487->11490 11492 33684c RtlFreeHeap 11487->11492 11488->11486 11489->11487 11493 336db0 RtlAllocateHeap 11491->11493 11494 33d81d 11491->11494 11492->11490 11495 33d87d 11493->11495 11494->11484 11494->11485 11495->11494 11496 336830 RtlAllocateHeap 11495->11496 11497 33d8d0 11496->11497 11497->11494 11498 33cf28 2 API calls 11497->11498 11498->11494 11500 336db0 RtlAllocateHeap 11499->11500 11501 33ccb2 11500->11501 11533 33ccbb 11501->11533 11534 33c5b4 11501->11534 11504 33cdcc 11507 33cdda 11504->11507 11509 33684c RtlFreeHeap 11504->11509 11506 33684c RtlFreeHeap 11506->11504 11510 33cde8 11507->11510 11512 33684c RtlFreeHeap 11507->11512 11509->11507 11513 33684c RtlFreeHeap 11510->11513 11515 33cdf6 11510->11515 11511 33c820 2 API calls 11516 33ccd5 11511->11516 11512->11510 11513->11515 11514 33ce04 11519 33ce12 11514->11519 11521 33684c RtlFreeHeap 11514->11521 11515->11514 11517 33684c RtlFreeHeap 11515->11517 11569 33c884 11516->11569 11517->11514 11522 33ce20 11519->11522 11523 33684c RtlFreeHeap 11519->11523 11520 33ccdd 11574 33ca7c 11520->11574 11521->11519 11524 33ce2e 11522->11524 11525 33684c RtlFreeHeap 11522->11525 11523->11522 11524->11483 11524->11494 11525->11524 11529 33ccf5 11530 336830 RtlAllocateHeap 11529->11530 11531 33cd75 11530->11531 11532 336868 RtlReAllocateHeap 11531->11532 11531->11533 11532->11533 11533->11504 11533->11506 11535 33a458 6 API calls 11534->11535 11536 33c5e8 11535->11536 11537 33c5ee 11536->11537 11538 336830 RtlAllocateHeap 11536->11538 11539 33c78e 11537->11539 11541 33684c RtlFreeHeap 11537->11541 11540 33c600 11538->11540 11542 33c79c 11539->11542 11543 33684c RtlFreeHeap 11539->11543 11540->11537 11545 33a458 6 API calls 11540->11545 11541->11539 11544 33c7aa 11542->11544 11546 33684c RtlFreeHeap 11542->11546 11543->11542 11560 33c7b4 11544->11560 11547 33c61d 11545->11547 11546->11544 11547->11537 11548 336db0 RtlAllocateHeap 11547->11548 11549 33c632 11548->11549 11549->11537 11550 336db0 RtlAllocateHeap 11549->11550 11551 33c64a 11550->11551 11551->11537 11552 336830 RtlAllocateHeap 11551->11552 11553 33c67b 11552->11553 11553->11537 11554 336830 RtlAllocateHeap 11553->11554 11558 33c6a4 11554->11558 11555 33a190 6 API calls 11555->11558 11557 33c75b 11559 336868 RtlReAllocateHeap 11557->11559 11558->11537 11558->11555 11558->11557 11581 33a51c 11558->11581 11559->11537 11585 33a0d8 11560->11585 11563 336830 RtlAllocateHeap 11564 33c7e9 11563->11564 11565 33a0d8 2 API calls 11564->11565 11568 33c810 11564->11568 11566 33c804 11565->11566 11567 33684c RtlFreeHeap 11566->11567 11566->11568 11567->11568 11568->11511 11570 336c60 2 API calls 11569->11570 11573 33c8ad 11570->11573 11571 336830 RtlAllocateHeap 11572 33c8b1 11571->11572 11572->11520 11573->11571 11573->11572 11575 33cb37 11574->11575 11576 33cbe4 11575->11576 11577 336830 RtlAllocateHeap 11575->11577 11578 33cc10 11576->11578 11577->11576 11579 336830 RtlAllocateHeap 11578->11579 11580 33cc22 11579->11580 11580->11529 11582 33a55f 11581->11582 11583 33a579 11582->11583 11584 33b390 2 API calls 11582->11584 11583->11558 11584->11583 11586 33a10f 11585->11586 11587 33b390 2 API calls 11586->11587 11588 33a129 11586->11588 11587->11588 11588->11563 11168 33b624 11169 33b671 11168->11169 11170 33b676 11169->11170 11171 33b678 RtlAdjustPrivilege 11169->11171 11171->11169 11171->11170 9259 34946f 9260 349480 9259->9260 9267 33639c 9260->9267 9262 34948f 9314 339960 9262->9314 9264 34949a 9353 3473b4 9264->9353 9398 335afc 9267->9398 9270 33653c 9270->9262 9271 3363b6 RtlCreateHeap 9271->9270 9272 3363d1 9271->9272 9273 335afc 3 API calls 9272->9273 9274 3363e1 9273->9274 9274->9270 9406 335db0 9274->9406 9277 335db0 8 API calls 9278 33640d 9277->9278 9279 335db0 8 API calls 9278->9279 9280 33641e 9279->9280 9281 335db0 8 API calls 9280->9281 9282 33642f 9281->9282 9283 335db0 8 API calls 9282->9283 9284 336440 9283->9284 9285 335db0 8 API calls 9284->9285 9286 336451 9285->9286 9287 335db0 8 API calls 9286->9287 9288 336462 9287->9288 9289 335db0 8 API calls 9288->9289 9290 336473 9289->9290 9291 335db0 8 API calls 9290->9291 9292 336484 9291->9292 9293 335db0 8 API calls 9292->9293 9294 336495 9293->9294 9295 335db0 8 API calls 9294->9295 9296 3364a6 9295->9296 9297 335db0 8 API calls 9296->9297 9298 3364b7 9297->9298 9299 335db0 8 API calls 9298->9299 9300 3364c8 9299->9300 9301 335db0 8 API calls 9300->9301 9302 3364d9 9301->9302 9303 335db0 8 API calls 9302->9303 9304 3364ea 9303->9304 9305 335db0 8 API calls 9304->9305 9306 3364fb 9305->9306 9307 335db0 8 API calls 9306->9307 9308 33650c 9307->9308 9309 335db0 8 API calls 9308->9309 9310 33651d 9309->9310 9311 335db0 8 API calls 9310->9311 9312 33652e 9311->9312 9412 347694 9312->9412 9315 339965 9314->9315 9455 336f10 9315->9455 9317 3399a7 9488 336d08 9317->9488 9319 3399b6 9320 3399c4 9319->9320 9491 33bacc 9319->9491 9320->9264 9321 33996a 9321->9317 9549 33b458 9321->9549 9324 3399d0 9494 33b664 9324->9494 9332 3399e3 9333 339a6f 9332->9333 9507 33b17c 9332->9507 9334 339aae 9333->9334 9339 33b5d0 NtQueryInformationToken 9333->9339 9521 33c354 9334->9521 9337 3399f9 9337->9332 9561 33ae44 9337->9561 9345 339a9c 9339->9345 9345->9334 9584 343144 9345->9584 9346 339a41 9346->9333 9348 33684c RtlFreeHeap 9346->9348 9349 339a59 9348->9349 9350 33684c RtlFreeHeap 9349->9350 9351 339a64 9350->9351 9352 33684c RtlFreeHeap 9351->9352 9352->9333 9355 3473de 9353->9355 9354 3473f4 35 API calls 9355->9354 9356 3473ff 9355->9356 9367 34740e 9355->9367 9649 339b80 9356->9649 9360 347580 9718 341fb8 9360->9718 9361 34758d 9362 3475a2 9361->9362 9363 347593 9361->9363 9365 3475b2 9362->9365 9366 3475a8 9362->9366 9368 339b80 14 API calls 9363->9368 9370 3475d1 9365->9370 9371 3475b8 9365->9371 9800 347308 9366->9800 9367->9360 9367->9361 9372 347598 9368->9372 9374 3475d7 9370->9374 9375 3475e1 9370->9375 9811 346efc 9371->9811 9769 341e50 9372->9769 9838 343868 9374->9838 9379 347634 9375->9379 9380 3475e7 9375->9380 9383 347643 9379->9383 9384 34763a 9379->9384 9381 347616 9380->9381 9845 346d04 9380->9845 9381->9354 9859 340410 9381->9859 9890 33a308 9383->9890 9385 346b18 2 API calls 9384->9385 9385->9354 9390 347678 9390->9354 9894 342384 9390->9894 9392 33a308 2 API calls 9393 347667 9392->9393 9393->9390 9394 34766c 9393->9394 9395 339b80 14 API calls 9394->9395 9396 347671 9395->9396 9397 346f90 135 API calls 9396->9397 9397->9354 9399 335b0e 9398->9399 9400 335b28 9398->9400 9401 335afc 3 API calls 9399->9401 9402 335afc 3 API calls 9400->9402 9404 335b50 9400->9404 9401->9400 9402->9404 9403 335c1a 9403->9270 9403->9271 9404->9403 9417 335a94 9404->9417 9432 335c34 9406->9432 9408 335ddb 9408->9277 9409 335afc 3 API calls 9410 335deb RtlAllocateHeap 9409->9410 9411 335dc5 9410->9411 9411->9408 9411->9409 9447 336830 9412->9447 9414 347745 9414->9270 9415 3476b5 9415->9414 9450 33684c 9415->9450 9418 335af2 9417->9418 9419 335ac0 9417->9419 9418->9404 9419->9418 9424 335a30 9419->9424 9421 335ad4 9421->9418 9422 335ae8 9421->9422 9427 3359e4 9422->9427 9425 335a47 9424->9425 9426 335a75 LdrLoadDll 9425->9426 9426->9421 9428 3359f3 9427->9428 9429 335a14 LdrGetProcedureAddress 9427->9429 9431 3359ff LdrGetProcedureAddress 9428->9431 9430 335a26 9429->9430 9430->9418 9431->9430 9433 335c47 9432->9433 9434 335c61 9432->9434 9436 335afc 3 API calls 9433->9436 9435 335c89 9434->9435 9437 335afc 3 API calls 9434->9437 9438 335afc 3 API calls 9435->9438 9441 335cb1 9435->9441 9436->9434 9437->9435 9438->9441 9439 335cf9 FindFirstFileW 9439->9441 9440 335d6a 9440->9411 9441->9439 9441->9440 9442 335d47 FindNextFileW 9441->9442 9443 335d29 FindClose 9441->9443 9442->9441 9445 335d5b FindClose 9442->9445 9444 335a30 LdrLoadDll 9443->9444 9446 335d40 9444->9446 9445->9441 9446->9411 9453 3310ac 9447->9453 9449 336838 RtlAllocateHeap 9449->9415 9454 3310ac 9450->9454 9452 336854 RtlFreeHeap 9452->9414 9453->9449 9454->9452 9588 336db0 9455->9588 9457 336f28 9458 3371ff 9457->9458 9459 336830 RtlAllocateHeap 9457->9459 9458->9321 9463 336f45 9459->9463 9460 3371f7 9461 33684c RtlFreeHeap 9460->9461 9461->9458 9462 33684c RtlFreeHeap 9462->9460 9463->9460 9465 336830 RtlAllocateHeap 9463->9465 9466 336fc8 9463->9466 9487 3371e9 9463->9487 9464 336ffb 9467 33702e 9464->9467 9470 336830 RtlAllocateHeap 9464->9470 9465->9466 9466->9464 9468 336830 RtlAllocateHeap 9466->9468 9469 337061 9467->9469 9471 336830 RtlAllocateHeap 9467->9471 9468->9464 9472 336830 RtlAllocateHeap 9469->9472 9473 337094 9469->9473 9470->9467 9471->9469 9472->9473 9474 336830 RtlAllocateHeap 9473->9474 9476 3370c7 9473->9476 9474->9476 9475 336830 RtlAllocateHeap 9480 3370fa 9475->9480 9476->9475 9476->9480 9477 337131 9479 336830 RtlAllocateHeap 9477->9479 9477->9487 9478 336830 RtlAllocateHeap 9478->9477 9481 33716c 9479->9481 9480->9477 9480->9478 9481->9487 9591 336eac 9481->9591 9483 337194 9484 336830 RtlAllocateHeap 9483->9484 9485 3371b3 9484->9485 9486 33684c RtlFreeHeap 9485->9486 9485->9487 9486->9487 9487->9462 9489 336830 RtlAllocateHeap 9488->9489 9490 336d1d 9489->9490 9490->9319 9492 336830 RtlAllocateHeap 9491->9492 9493 33badd 9492->9493 9493->9324 9495 33b671 9494->9495 9496 33b678 RtlAdjustPrivilege 9495->9496 9497 3399da 9495->9497 9496->9495 9496->9497 9498 33b5d0 9497->9498 9499 33b5e7 9498->9499 9500 33b5eb NtQueryInformationToken 9499->9500 9501 3399df 9499->9501 9500->9501 9501->9332 9502 33b358 9501->9502 9600 3397a8 9502->9600 9504 33b375 9505 33b383 9504->9505 9611 339850 9504->9611 9505->9337 9508 33b19a 9507->9508 9509 336830 RtlAllocateHeap 9508->9509 9511 33b1a5 9509->9511 9510 339a28 9510->9333 9578 33b514 9510->9578 9511->9510 9512 33684c RtlFreeHeap 9511->9512 9515 33b1c6 9512->9515 9513 33b320 9514 33684c RtlFreeHeap 9513->9514 9514->9510 9515->9513 9619 336de0 9515->9619 9517 33b2d6 9518 336de0 RtlAllocateHeap 9517->9518 9519 33b2fb 9518->9519 9520 336de0 RtlAllocateHeap 9519->9520 9520->9513 9522 339ac3 9521->9522 9523 33c374 9521->9523 9543 33e214 9522->9543 9524 336db0 RtlAllocateHeap 9523->9524 9525 33c385 9524->9525 9525->9522 9526 336830 RtlAllocateHeap 9525->9526 9531 33c3a1 9526->9531 9527 33c5a1 9528 33684c RtlFreeHeap 9527->9528 9528->9522 9529 33c592 9530 33684c RtlFreeHeap 9529->9530 9530->9527 9531->9527 9531->9529 9532 33c3f5 CreateFileW 9531->9532 9532->9529 9533 33c449 WriteFile 9532->9533 9533->9529 9534 33c464 RegCreateKeyExW 9533->9534 9534->9529 9535 33c48d RegSetValueExW 9534->9535 9537 33c589 NtClose 9535->9537 9538 33c4bf RegCreateKeyExW 9535->9538 9537->9529 9538->9537 9540 33c53a RegSetValueExW 9538->9540 9540->9537 9542 33c56e SHChangeNotify 9540->9542 9542->9537 9544 33e230 9543->9544 9622 33e2ac 9544->9622 9546 33e286 9547 339ac8 9546->9547 9548 33684c RtlFreeHeap 9546->9548 9547->9264 9548->9547 9550 33b46d 9549->9550 9551 336830 RtlAllocateHeap 9550->9551 9552 33999e 9550->9552 9554 33b4a6 9551->9554 9552->9317 9555 33ba18 9552->9555 9553 33684c RtlFreeHeap 9553->9552 9554->9552 9554->9553 9557 33ba2d 9555->9557 9556 33bac2 9556->9317 9557->9556 9626 339710 9557->9626 9560 33684c RtlFreeHeap 9560->9556 9562 33ae8f 9561->9562 9573 33b044 9562->9573 9630 33abf8 9562->9630 9564 33ae9d 9565 33af8b 9564->9565 9566 33b09f 9564->9566 9564->9573 9568 336db0 RtlAllocateHeap 9565->9568 9565->9573 9567 336db0 RtlAllocateHeap 9566->9567 9566->9573 9569 33b0ce 9567->9569 9570 33afbe 9568->9570 9571 33684c RtlFreeHeap 9569->9571 9569->9573 9572 33684c RtlFreeHeap 9570->9572 9570->9573 9571->9573 9574 33afe0 9572->9574 9573->9332 9574->9573 9575 336db0 RtlAllocateHeap 9574->9575 9576 33b026 9575->9576 9576->9573 9577 33684c RtlFreeHeap 9576->9577 9577->9573 9580 33b529 9578->9580 9579 33b5b3 9579->9346 9580->9579 9581 336830 RtlAllocateHeap 9580->9581 9583 33b562 9581->9583 9582 33684c RtlFreeHeap 9582->9579 9583->9579 9583->9582 9585 343154 9584->9585 9587 3431b2 9585->9587 9639 342eb4 9585->9639 9587->9334 9589 336830 RtlAllocateHeap 9588->9589 9590 336dc1 9589->9590 9590->9457 9592 336ed3 9591->9592 9597 336e54 9592->9597 9594 336ef3 9595 33684c RtlFreeHeap 9594->9595 9596 336f07 9595->9596 9596->9483 9598 336830 RtlAllocateHeap 9597->9598 9599 336e77 9598->9599 9599->9594 9601 336830 RtlAllocateHeap 9600->9601 9606 3397c6 9601->9606 9602 3397c9 NtQuerySystemInformation 9602->9606 9609 3397df 9602->9609 9603 3397fc 9605 33684c RtlFreeHeap 9603->9605 9607 339804 9605->9607 9606->9602 9606->9603 9615 336868 9606->9615 9607->9504 9608 33684c RtlFreeHeap 9610 339842 9608->9610 9609->9608 9610->9504 9614 339875 9611->9614 9612 339947 9612->9505 9613 33993e NtClose 9613->9612 9614->9612 9614->9613 9618 3310ac 9615->9618 9617 336870 RtlReAllocateHeap 9617->9606 9618->9617 9620 336830 RtlAllocateHeap 9619->9620 9621 336df2 9620->9621 9621->9517 9623 33e2b8 9622->9623 9625 33e2c5 9622->9625 9624 336830 RtlAllocateHeap 9623->9624 9623->9625 9624->9625 9625->9546 9627 339722 9626->9627 9629 33974a 9626->9629 9628 336830 RtlAllocateHeap 9627->9628 9628->9629 9629->9560 9631 336830 RtlAllocateHeap 9630->9631 9632 33ac1d 9631->9632 9633 33ac53 9632->9633 9634 336868 RtlReAllocateHeap 9632->9634 9638 33ac36 9632->9638 9635 33684c RtlFreeHeap 9633->9635 9634->9632 9635->9638 9636 33684c RtlFreeHeap 9637 33ad80 9636->9637 9637->9564 9638->9564 9638->9636 9640 342ec5 9639->9640 9642 343053 9640->9642 9643 33b390 9640->9643 9642->9587 9644 33b3a2 9643->9644 9645 33b39f 9643->9645 9644->9645 9646 33b3e9 NtSetInformationThread 9644->9646 9645->9642 9647 33b3ff NtClose 9646->9647 9648 33b3fe 9646->9648 9647->9645 9648->9647 9650 339b93 9649->9650 9651 339c2e 9649->9651 9931 337f8c 9650->9931 9658 346f90 9651->9658 9654 339be1 9656 339c01 CreateMutexW 9654->9656 9655 340410 13 API calls 9655->9654 9935 3368b4 9656->9935 9670 346fad 9658->9670 9659 347076 CreateThread 9660 3470a1 CreateThread CreateThread 9659->9660 9662 347091 9659->9662 10419 338f38 RtlAdjustPrivilege 9659->10419 9663 3470df 9660->9663 9664 3470da 9660->9664 10412 337438 GetLogicalDriveStringsW 9660->10412 10417 3377fc CoInitialize 9660->10417 9661 347018 9669 339c34 3 API calls 9661->9669 9673 34705b 9661->9673 9662->9660 9666 347100 9663->9666 9667 3470e8 CreateThread 9663->9667 9941 337c74 OpenSCManagerW 9664->9941 9672 34717d 9666->9672 9949 33b690 9666->9949 9667->9666 10463 337e28 9667->10463 9669->9673 9670->9661 9670->9673 10075 339c34 9670->10075 9675 3471c7 NtTerminateThread 9672->9675 9676 3471db 9672->9676 9673->9659 9673->9660 9675->9676 9678 3471e4 CreateThread 9676->9678 9679 3471ff 9676->9679 9678->9679 10407 3395f8 9678->10407 9681 3472ee 9679->9681 9682 34721f 9679->9682 10100 341890 9681->10100 9685 347228 CreateThread 9682->9685 9701 347243 9682->9701 9683 34715d 9684 347170 9683->9684 9688 33e214 2 API calls 9683->9688 9699 33e214 2 API calls 9684->9699 9685->9701 10434 33bfc0 9685->10434 9692 34716b 9688->9692 9690 347295 9693 33b5d0 NtQueryInformationToken 9690->9693 9999 33fbe4 9692->9999 9697 34729a 9693->9697 9695 33e214 2 API calls 9700 34714e 9695->9700 9702 3472a5 9697->9702 9703 34729e 9697->9703 9699->9672 9971 340994 9700->9971 9701->9690 10021 33d95c 9701->10021 10036 338200 9702->10036 10096 338930 9703->10096 9708 3472ec 9708->9354 9710 33e214 2 API calls 9711 347158 9710->9711 9975 340b40 9711->9975 9713 3472a3 9713->9708 10069 339610 9713->10069 9717 340410 13 API calls 9717->9708 9719 3368fc RtlAllocateHeap 9718->9719 9720 341fd0 9719->9720 9721 342001 9720->9721 9722 341ff2 9720->9722 9736 342069 9720->9736 10633 3373f8 9721->10633 10607 33ff5c 9722->10607 9726 342061 9727 33684c RtlFreeHeap 9726->9727 9727->9736 9728 336830 RtlAllocateHeap 9761 342046 9728->9761 9729 34207e 9730 33684c RtlFreeHeap 9729->9730 9730->9736 9731 3420f2 9733 33684c RtlFreeHeap 9731->9733 9732 33a308 2 API calls 9732->9761 9733->9736 9734 3422cb 9735 33684c RtlFreeHeap 9734->9735 9735->9736 9736->9354 9737 3421ea 9738 33684c RtlFreeHeap 9737->9738 9738->9736 9739 3421fd 10645 33a3ac 9739->10645 9740 33a250 NtSetInformationThread NtClose 9740->9761 9741 3421cd 9743 33684c RtlFreeHeap 9741->9743 9742 3422fd 9746 33694c RtlAllocateHeap 9742->9746 9743->9736 9744 342221 9748 34227f 9744->9748 9749 342289 9744->9749 9745 3422de 9745->9742 9750 3422f3 9745->9750 9751 342356 9746->9751 9754 33694c RtlAllocateHeap 9748->9754 10649 336a3c 9749->10649 9756 33684c RtlFreeHeap 9750->9756 9757 33684c RtlFreeHeap 9751->9757 9759 342287 9754->9759 9756->9736 9762 34235f 9757->9762 9758 342214 9763 33684c RtlFreeHeap 9758->9763 9764 33684c RtlFreeHeap 9759->9764 9760 33ab38 NtSetInformationThread NtClose 9760->9761 9761->9726 9761->9728 9761->9729 9761->9731 9761->9732 9761->9734 9761->9736 9761->9737 9761->9739 9761->9740 9761->9741 9761->9742 9761->9744 9761->9745 9761->9760 9766 33684c RtlFreeHeap 9761->9766 10639 33a928 9761->10639 9762->9736 9765 3408c8 10 API calls 9762->9765 9763->9736 9767 34229a 9764->9767 9765->9736 9766->9761 9767->9736 10653 3408c8 9767->10653 9770 341c84 2 API calls 9769->9770 9771 341e5e 9770->9771 9772 341e83 9771->9772 9774 341e62 9771->9774 9775 339610 2 API calls 9772->9775 9773 341e7e 9773->9354 9774->9773 9776 340410 13 API calls 9774->9776 9777 341e88 9775->9777 9776->9773 9778 341e8c 9777->9778 9784 341e96 9777->9784 9779 346f90 135 API calls 9778->9779 9780 341e91 9779->9780 9780->9354 9781 341fb2 9781->9354 9782 341f11 9783 341f5a 9782->9783 9787 339c34 3 API calls 9782->9787 10662 340d8c 9783->10662 9784->9781 9784->9782 9786 339c34 3 API calls 9784->9786 9786->9782 9787->9783 9793 340df4 3 API calls 9794 341f9f 9793->9794 10710 3410cc 9794->10710 9797 338200 14 API calls 9798 341fab 9797->9798 9799 341608 2 API calls 9798->9799 9799->9781 10749 341b44 9800->10749 9803 338200 14 API calls 9804 34731b 9803->9804 9805 33b5d0 NtQueryInformationToken 9804->9805 9808 347334 9805->9808 9806 3473ac 9806->9354 9807 339610 2 API calls 9809 34738c 9807->9809 9808->9806 9808->9807 9810 340410 13 API calls 9809->9810 9810->9806 9812 3438b0 RtlAllocateHeap 9811->9812 9816 346f0e 9812->9816 9813 346f7d 9814 346f8b 9813->9814 9815 33684c RtlFreeHeap 9813->9815 9826 346b18 9814->9826 9815->9814 9816->9813 9817 346f52 9816->9817 10763 3463ec 9816->10763 10781 343dfc 9817->10781 9823 346f73 9825 343dfc 2 API calls 9823->9825 9825->9813 9827 346b2c 9826->9827 9828 346cfb 9826->9828 9829 3438b0 RtlAllocateHeap 9827->9829 9828->9354 9834 346b3c 9829->9834 9830 346ced 9830->9828 9832 33684c RtlFreeHeap 9830->9832 9831 33684c RtlFreeHeap 9831->9830 9832->9828 9833 346be2 9833->9830 9833->9831 9834->9833 9835 336830 RtlAllocateHeap 9834->9835 9836 346c04 9835->9836 9836->9833 11089 3465e4 9836->11089 9839 3438b0 RtlAllocateHeap 9838->9839 9840 34387a 9839->9840 9841 34389e 9840->9841 11099 3436e0 9840->11099 9842 3438ac 9841->9842 9843 33684c RtlFreeHeap 9841->9843 9842->9354 9843->9842 9846 346d20 9845->9846 9847 336db0 RtlAllocateHeap 9846->9847 9848 346e31 9847->9848 9849 336db0 RtlAllocateHeap 9848->9849 9858 346e3a 9848->9858 9850 346e4b 9849->9850 9856 336db0 RtlAllocateHeap 9850->9856 9850->9858 9851 346ed7 9852 346ee5 9851->9852 9854 33684c RtlFreeHeap 9851->9854 9855 346ef3 9852->9855 9857 33684c RtlFreeHeap 9852->9857 9853 33684c RtlFreeHeap 9853->9851 9854->9852 9855->9381 9856->9858 9857->9855 9858->9851 9858->9853 9860 340445 9859->9860 9861 336db0 RtlAllocateHeap 9860->9861 9862 3404be 9861->9862 9863 336830 RtlAllocateHeap 9862->9863 9865 3404c7 9862->9865 9864 3404de 9863->9864 9864->9865 11117 340294 9864->11117 9866 34088c 9865->9866 9868 33684c RtlFreeHeap 9865->9868 9867 34089a 9866->9867 9869 33684c RtlFreeHeap 9866->9869 9870 3408a8 9867->9870 9872 33684c RtlFreeHeap 9867->9872 9868->9866 9869->9867 9873 3408b6 9870->9873 9875 33684c RtlFreeHeap 9870->9875 9872->9870 9873->9354 9874 34050f 9874->9865 9876 340530 GetTempFileNameW CreateFileW 9874->9876 9875->9873 9876->9865 9877 340575 WriteFile 9876->9877 9877->9865 9878 340591 CreateProcessW 9877->9878 9878->9865 9880 3405fb NtQueryInformationProcess 9878->9880 9880->9865 9881 34061f NtReadVirtualMemory 9880->9881 9881->9865 9882 340646 9881->9882 9883 336db0 RtlAllocateHeap 9882->9883 9884 340650 9883->9884 9884->9865 9885 3406b4 NtProtectVirtualMemory 9884->9885 9885->9865 9886 3406e0 NtWriteVirtualMemory 9885->9886 9886->9865 9887 3406fa 9886->9887 9887->9865 9888 340785 CreateNamedPipeW 9887->9888 9888->9865 9889 3407f1 ResumeThread ConnectNamedPipe 9888->9889 9889->9865 9891 33a32b 9890->9891 9892 33a345 9891->9892 9893 33b390 2 API calls 9891->9893 9892->9390 9892->9392 9893->9892 9895 3368fc RtlAllocateHeap 9894->9895 9909 34239c 9895->9909 9896 33a250 NtSetInformationThread NtClose 9896->9909 9897 33a308 2 API calls 9897->9909 9898 342518 9899 33684c RtlFreeHeap 9898->9899 9921 342422 9899->9921 9900 342437 9902 33684c RtlFreeHeap 9900->9902 9901 34244a 9907 33a3ac 2 API calls 9901->9907 9902->9921 9903 34241a 9908 33684c RtlFreeHeap 9903->9908 9904 34254a 9906 33694c RtlAllocateHeap 9904->9906 9905 34252b 9905->9904 9910 342540 9905->9910 9911 3425a3 9906->9911 9912 34245d 9907->9912 9908->9921 9909->9896 9909->9897 9909->9898 9909->9900 9909->9901 9909->9903 9909->9904 9909->9905 9918 34246e 9909->9918 9909->9921 9925 33ab38 NtSetInformationThread NtClose 9909->9925 9929 33684c RtlFreeHeap 9909->9929 9915 33684c RtlFreeHeap 9910->9915 9916 33684c RtlFreeHeap 9911->9916 9917 342461 9912->9917 9912->9918 9913 3424d6 9920 336a3c RtlAllocateHeap 9913->9920 9914 3424cc 9919 33694c RtlAllocateHeap 9914->9919 9915->9921 9922 3425ac 9916->9922 9923 33684c RtlFreeHeap 9917->9923 9918->9913 9918->9914 9924 3424d4 9919->9924 9920->9924 9921->9354 9922->9921 9928 3408c8 10 API calls 9922->9928 9923->9921 9926 33684c RtlFreeHeap 9924->9926 9925->9909 9927 3424e7 9926->9927 9927->9921 9930 3408c8 10 API calls 9927->9930 9928->9921 9929->9909 9930->9921 9932 337fa5 9931->9932 9934 33805e 9932->9934 9938 336888 9932->9938 9934->9654 9934->9655 9936 33684c RtlFreeHeap 9935->9936 9937 3368c3 9936->9937 9937->9651 9939 336830 RtlAllocateHeap 9938->9939 9940 33689e 9939->9940 9940->9934 9942 337ca2 9941->9942 9943 337daa 9941->9943 9945 336830 RtlAllocateHeap 9942->9945 9944 337dc7 9943->9944 9946 33684c RtlFreeHeap 9943->9946 9944->9663 9947 337cd1 9945->9947 9946->9944 9947->9943 10129 33dbbc 9947->10129 9950 336888 RtlAllocateHeap 9949->9950 9951 33b698 9950->9951 9952 33b6e0 9951->9952 9953 33b69e NtSetInformationProcess NtSetInformationProcess NtSetInformationProcess 9951->9953 9955 33e144 9952->9955 9954 3368b4 RtlFreeHeap 9953->9954 9954->9952 9956 33e151 9955->9956 9957 33e1b6 9956->9957 9958 33e186 CreateThread 9956->9958 9959 33e1a7 NtClose 9956->9959 9957->9672 9957->9683 9960 33a65c 9957->9960 9958->9956 10133 33ddd4 SetThreadPriority 9958->10133 9959->9956 9961 33a683 GetVolumeNameForVolumeMountPointW 9960->9961 9963 33a6c6 FindFirstVolumeW 9961->9963 9964 33a917 9963->9964 9969 33a6e2 9963->9969 9964->9695 9965 33a6fb GetVolumePathNamesForVolumeNameW 9965->9969 9966 33a72c GetDriveTypeW 9966->9969 9967 33a7cd CreateFileW 9968 33a7f3 DeviceIoControl 9967->9968 9967->9969 9968->9969 9969->9964 9969->9965 9969->9966 9969->9967 9970 33a5d0 6 API calls 9969->9970 9970->9969 9972 3409ee 9971->9972 9974 340a68 9972->9974 10141 33694c 9972->10141 9974->9710 9976 340b55 9975->9976 10145 33a458 CreateThread 9976->10145 9978 340b67 9979 336830 RtlAllocateHeap 9978->9979 9998 340b6d 9978->9998 9981 340b7f 9979->9981 9980 340d66 9983 340d74 9980->9983 9986 33684c RtlFreeHeap 9980->9986 9985 33a458 6 API calls 9981->9985 9981->9998 9982 33684c RtlFreeHeap 9982->9980 9984 340d82 9983->9984 9987 33684c RtlFreeHeap 9983->9987 9984->9683 9988 340b9c 9985->9988 9986->9983 9987->9984 9989 336830 RtlAllocateHeap 9988->9989 9988->9998 9990 340bb7 9989->9990 9991 336830 RtlAllocateHeap 9990->9991 9990->9998 9997 340bd2 9991->9997 9993 33694c RtlAllocateHeap 9994 340c2e CreateThread 9993->9994 9994->9997 10163 33f264 GetFileAttributesW 9994->10163 9995 33694c RtlAllocateHeap 9995->9997 9996 33b390 2 API calls 9996->9997 9997->9993 9997->9995 9997->9996 9997->9998 10153 33a190 CreateThread 9997->10153 9998->9980 9998->9982 10000 33fc10 9999->10000 10001 336830 RtlAllocateHeap 10000->10001 10002 33fc1d 10001->10002 10017 33fc26 10002->10017 10326 33f788 CoInitialize 10002->10326 10005 33ff37 10007 33ff45 10005->10007 10010 33684c RtlFreeHeap 10005->10010 10006 33684c RtlFreeHeap 10006->10005 10008 33ff53 10007->10008 10011 33684c RtlFreeHeap 10007->10011 10008->9684 10009 336830 RtlAllocateHeap 10012 33fc53 10009->10012 10010->10007 10011->10008 10013 336830 RtlAllocateHeap 10012->10013 10012->10017 10020 33fc6e 10013->10020 10014 33f4f8 NtSetInformationThread NtClose 10014->10020 10016 33f634 NtSetInformationThread NtClose 10016->10020 10017->10005 10017->10006 10018 33684c RtlFreeHeap 10018->10020 10019 33b390 2 API calls 10019->10020 10020->10014 10020->10016 10020->10017 10020->10018 10020->10019 10332 3369a8 10020->10332 10336 33ce38 10021->10336 10023 33d99e 10024 33dac6 10023->10024 10026 33684c RtlFreeHeap 10023->10026 10027 33dad4 10024->10027 10028 33684c RtlFreeHeap 10024->10028 10025 33d995 10025->10023 10030 336db0 RtlAllocateHeap 10025->10030 10026->10024 10029 33dae2 10027->10029 10031 33684c RtlFreeHeap 10027->10031 10028->10027 10029->9690 10032 33d9eb 10030->10032 10031->10029 10032->10023 10033 336830 RtlAllocateHeap 10032->10033 10034 33da21 10033->10034 10034->10023 10340 33cf28 10034->10340 10037 33825b 10036->10037 10041 338260 10036->10041 10038 3388d9 10037->10038 10039 33684c RtlFreeHeap 10037->10039 10040 33684c RtlFreeHeap 10038->10040 10043 3388e7 10038->10043 10039->10038 10040->10043 10041->10037 10379 340df4 10041->10379 10043->9713 10044 3382bd 10044->10037 10045 336830 RtlAllocateHeap 10044->10045 10046 33839f 10045->10046 10046->10037 10047 3383d1 10046->10047 10048 3383b7 10046->10048 10049 336db0 RtlAllocateHeap 10047->10049 10050 336db0 RtlAllocateHeap 10048->10050 10051 3383c1 10049->10051 10050->10051 10051->10037 10052 338404 10051->10052 10054 338418 10051->10054 10053 33684c RtlFreeHeap 10052->10053 10053->10037 10054->10037 10055 3384cb DrawTextW 10054->10055 10055->10037 10056 3384f3 10055->10056 10056->10037 10057 33862d CreateFileW 10056->10057 10057->10037 10058 338656 WriteFile 10057->10058 10058->10037 10059 338677 WriteFile 10058->10059 10059->10037 10060 338695 WriteFile 10059->10060 10060->10037 10061 3386b3 10060->10061 10386 336c60 10061->10386 10063 3386d5 10063->10037 10064 338758 RegCreateKeyExW 10063->10064 10064->10037 10065 338789 10064->10065 10066 3387c2 RegSetValueExW 10065->10066 10066->10037 10067 3387ef 10066->10067 10068 33884e RegSetValueExW 10067->10068 10068->10037 10072 339639 10069->10072 10070 339705 10070->9717 10071 33684c RtlFreeHeap 10071->10070 10074 339668 10072->10074 10392 33c820 10072->10392 10074->10070 10074->10071 10077 339c66 10075->10077 10076 339c6a 10076->9661 10077->10076 10398 3438b0 10077->10398 10079 33a01a 10081 33a02e 10079->10081 10082 33684c RtlFreeHeap 10079->10082 10080 33684c RtlFreeHeap 10080->10079 10083 33a042 10081->10083 10084 33684c RtlFreeHeap 10081->10084 10082->10081 10085 33a056 10083->10085 10086 33684c RtlFreeHeap 10083->10086 10084->10083 10085->9661 10086->10085 10087 339de1 10088 33b5d0 NtQueryInformationToken 10087->10088 10093 339df0 10087->10093 10089 339eb2 10088->10089 10090 336db0 RtlAllocateHeap 10089->10090 10089->10093 10091 339ef5 10090->10091 10092 336db0 RtlAllocateHeap 10091->10092 10091->10093 10094 339f15 10092->10094 10093->10079 10093->10080 10094->10093 10095 336db0 RtlAllocateHeap 10094->10095 10095->10093 10097 338941 10096->10097 10098 33b390 2 API calls 10097->10098 10099 338b3c 10097->10099 10098->10099 10099->9713 10101 336db0 RtlAllocateHeap 10100->10101 10102 3418c3 10101->10102 10114 3418cc 10102->10114 10401 341814 10102->10401 10103 33684c RtlFreeHeap 10104 341a04 10103->10104 10106 341a12 10104->10106 10108 33684c RtlFreeHeap 10104->10108 10105 341a20 10117 341c84 10105->10117 10106->10105 10109 33684c RtlFreeHeap 10106->10109 10108->10106 10109->10105 10110 341900 10111 3368fc RtlAllocateHeap 10110->10111 10110->10114 10112 34191b 10111->10112 10113 336db0 RtlAllocateHeap 10112->10113 10112->10114 10115 341981 10113->10115 10114->10103 10114->10104 10116 33684c RtlFreeHeap 10115->10116 10116->10114 10118 341d88 10117->10118 10121 341db6 10118->10121 10404 341b90 10118->10404 10120 341e47 10123 341608 10120->10123 10121->10120 10122 33684c RtlFreeHeap 10121->10122 10122->10120 10124 341620 10123->10124 10125 336db0 RtlAllocateHeap 10124->10125 10126 34165a 10125->10126 10127 341663 10126->10127 10128 33684c RtlFreeHeap 10126->10128 10127->9708 10128->10127 10130 33dc16 10129->10130 10131 33dc2e 10130->10131 10132 33dc1a NtTerminateProcess 10130->10132 10131->9947 10132->10131 10138 33ddeb 10133->10138 10134 33de3e 10135 33de4d ReadFile 10135->10138 10136 33e006 WriteFile 10136->10138 10137 33e0ac NtClose 10137->10138 10138->10134 10138->10135 10138->10136 10138->10137 10139 33684c RtlFreeHeap 10138->10139 10140 33df8d WriteFile 10138->10140 10139->10138 10140->10138 10142 336964 10141->10142 10143 33697a 10142->10143 10144 336830 RtlAllocateHeap 10142->10144 10143->9974 10144->10143 10146 33a4f4 10145->10146 10147 33a498 10145->10147 10161 33a440 GetLogicalDriveStringsW 10145->10161 10146->9978 10148 33a4ca ResumeThread 10147->10148 10149 33b390 2 API calls 10147->10149 10150 33a4de GetExitCodeThread 10148->10150 10151 33a4a9 10149->10151 10150->10146 10151->10148 10152 33a4ad 10151->10152 10152->9978 10154 33a21f 10153->10154 10156 33a1c3 10153->10156 10162 33a180 GetDriveTypeW 10153->10162 10154->9997 10155 33a1f5 ResumeThread 10158 33a209 GetExitCodeThread 10155->10158 10156->10155 10157 33b390 2 API calls 10156->10157 10159 33a1d4 10157->10159 10158->10154 10159->10155 10160 33a1d8 10159->10160 10160->9997 10164 33f2db SetThreadPriority 10163->10164 10165 33f27d 10163->10165 10169 33f2ea 10164->10169 10166 33f2cd 10165->10166 10245 33a064 FindFirstFileExW 10165->10245 10167 33684c RtlFreeHeap 10166->10167 10171 33f2d5 10167->10171 10170 336830 RtlAllocateHeap 10169->10170 10189 33f309 10170->10189 10173 33f2a7 10174 33c0f8 11 API calls 10173->10174 10176 33f2b1 10174->10176 10178 33eec8 15 API calls 10176->10178 10180 33f2c7 10178->10180 10179 33684c RtlFreeHeap 10181 33f339 FindFirstFileExW 10179->10181 10181->10189 10182 33684c RtlFreeHeap 10182->10189 10183 33f4a8 10184 33684c RtlFreeHeap 10183->10184 10187 33f4cb 10184->10187 10185 33f470 FindNextFileW 10186 33f488 FindClose 10185->10186 10185->10189 10186->10189 10188 33f124 RtlAllocateHeap 10188->10189 10189->10179 10189->10182 10189->10183 10189->10185 10189->10188 10191 33c0f8 10189->10191 10210 33f0c0 10189->10210 10214 33eec8 10189->10214 10192 33c114 10191->10192 10193 33c10f 10191->10193 10248 3368fc 10192->10248 10193->10189 10196 33c12c GetFileAttributesW 10197 33c13c 10196->10197 10198 33c181 10197->10198 10199 33c19a 10197->10199 10200 33c1e8 6 API calls 10198->10200 10201 33c1a2 10199->10201 10202 33c1b1 GetFileAttributesW 10199->10202 10205 33c189 10200->10205 10252 33c1e8 CreateFileW 10201->10252 10203 33c1ca CopyFileW 10202->10203 10204 33c1be 10202->10204 10208 33684c RtlFreeHeap 10203->10208 10207 33684c RtlFreeHeap 10204->10207 10209 33684c RtlFreeHeap 10205->10209 10207->10201 10208->10193 10209->10193 10211 33f0d8 10210->10211 10212 33f0ee 10211->10212 10213 336830 RtlAllocateHeap 10211->10213 10212->10189 10213->10212 10215 33f0b1 10214->10215 10216 33eee9 10214->10216 10215->10189 10263 33e308 10216->10263 10219 33f0a9 10221 33684c RtlFreeHeap 10219->10221 10221->10215 10222 33ef01 10222->10219 10223 33ef15 10222->10223 10224 33ef28 10222->10224 10297 33eb5c 10223->10297 10301 33ec40 10224->10301 10227 33ef43 MoveFileExW 10228 33ef55 10227->10228 10233 33ef23 10227->10233 10232 33efad CreateFileW 10228->10232 10242 33efd1 10228->10242 10229 33ef90 10231 33684c RtlFreeHeap 10229->10231 10230 33684c RtlFreeHeap 10230->10233 10231->10228 10234 33efd6 10232->10234 10232->10242 10233->10219 10233->10227 10233->10228 10233->10229 10233->10230 10235 33ec40 RtlAllocateHeap 10233->10235 10277 33ec8c 10234->10277 10235->10233 10236 33684c RtlFreeHeap 10236->10219 10239 33efff CreateIoCompletionPort 10240 33f016 10239->10240 10243 33f038 10239->10243 10241 33684c RtlFreeHeap 10240->10241 10241->10242 10242->10219 10242->10236 10243->10242 10244 33684c RtlFreeHeap 10243->10244 10244->10242 10246 33a0b5 10245->10246 10247 33a095 FindClose 10245->10247 10246->10166 10246->10173 10247->10246 10249 336912 10248->10249 10250 336929 10249->10250 10251 336830 RtlAllocateHeap 10249->10251 10250->10193 10250->10196 10251->10250 10253 33c349 10252->10253 10254 33c219 10252->10254 10253->10193 10255 33c251 WriteFile 10254->10255 10256 33c288 WriteFile 10255->10256 10259 33c276 10255->10259 10257 33c2c1 WriteFile 10256->10257 10258 33c2af 10256->10258 10260 33c2e6 10257->10260 10261 33c2f8 WriteFile 10257->10261 10258->10193 10259->10193 10260->10193 10261->10254 10262 33c31f NtClose 10261->10262 10262->10193 10264 33e321 SetFileAttributesW CreateFileW 10263->10264 10265 33e367 10264->10265 10267 33e34f 10264->10267 10265->10219 10268 33e3b8 SetFileAttributesW CreateFileW 10265->10268 10267->10264 10267->10265 10305 33dda4 10267->10305 10269 33e3f8 SetFilePointerEx 10268->10269 10270 33e46d 10268->10270 10271 33e417 ReadFile 10269->10271 10272 33e464 NtClose 10269->10272 10270->10222 10271->10272 10273 33e436 10271->10273 10272->10270 10274 33e2ac RtlAllocateHeap 10273->10274 10275 33e447 10274->10275 10275->10272 10276 33684c RtlFreeHeap 10275->10276 10276->10272 10278 33ecbc 10277->10278 10279 33eced 10278->10279 10280 33e214 2 API calls 10278->10280 10281 336830 RtlAllocateHeap 10279->10281 10280->10279 10288 33ecf9 10281->10288 10282 33ee95 10284 33eea3 10282->10284 10285 33684c RtlFreeHeap 10282->10285 10283 33684c RtlFreeHeap 10283->10282 10286 33eeb1 10284->10286 10287 33684c RtlFreeHeap 10284->10287 10285->10284 10286->10239 10286->10242 10287->10286 10289 336830 RtlAllocateHeap 10288->10289 10296 33ee40 10288->10296 10290 33ed56 10289->10290 10291 336830 RtlAllocateHeap 10290->10291 10290->10296 10292 33ed85 10291->10292 10293 336830 RtlAllocateHeap 10292->10293 10292->10296 10294 33ee37 10293->10294 10295 33684c RtlFreeHeap 10294->10295 10294->10296 10295->10296 10296->10282 10296->10283 10298 33eb69 10297->10298 10299 3368fc RtlAllocateHeap 10298->10299 10300 33eb75 10299->10300 10300->10233 10302 33ec4e 10301->10302 10303 3368fc RtlAllocateHeap 10302->10303 10304 33ec5d 10303->10304 10304->10233 10306 33ddaf 10305->10306 10307 33ddbc 10306->10307 10311 33dc40 10306->10311 10309 33ddc2 Sleep 10307->10309 10310 33ddcd 10307->10310 10309->10310 10310->10267 10314 33dc77 10311->10314 10312 33dd4c 10313 33dd99 10312->10313 10315 33684c RtlFreeHeap 10312->10315 10313->10307 10314->10312 10316 336830 RtlAllocateHeap 10314->10316 10315->10313 10318 33dcd0 10316->10318 10317 33dcf9 10317->10312 10321 33dbbc NtTerminateProcess 10317->10321 10322 33daec 10317->10322 10318->10312 10318->10317 10319 336868 RtlReAllocateHeap 10318->10319 10319->10318 10321->10317 10324 33db0c 10322->10324 10323 33db89 10323->10317 10324->10323 10325 33dbbc NtTerminateProcess 10324->10325 10325->10323 10327 33f96e 10326->10327 10329 33f7c5 10326->10329 10327->10009 10327->10017 10328 33f84a 10328->10327 10331 336830 RtlAllocateHeap 10328->10331 10329->10328 10330 336830 RtlAllocateHeap 10329->10330 10330->10329 10331->10328 10333 3369c1 10332->10333 10334 336830 RtlAllocateHeap 10333->10334 10335 3369e1 10334->10335 10335->10020 10338 33ce54 10336->10338 10337 33ced9 10337->10025 10338->10337 10339 336830 RtlAllocateHeap 10338->10339 10339->10337 10341 33cf80 10340->10341 10343 33cf7b 10340->10343 10342 336830 RtlAllocateHeap 10341->10342 10341->10343 10353 33cfc1 10342->10353 10344 33d3ba 10343->10344 10345 33684c RtlFreeHeap 10343->10345 10346 33d3c8 10344->10346 10348 33684c RtlFreeHeap 10344->10348 10345->10344 10347 33d3d6 10346->10347 10349 33684c RtlFreeHeap 10346->10349 10350 33d3e4 10347->10350 10351 33684c RtlFreeHeap 10347->10351 10348->10346 10349->10347 10352 33d3f2 10350->10352 10354 33684c RtlFreeHeap 10350->10354 10351->10350 10355 33d400 10352->10355 10357 33684c RtlFreeHeap 10352->10357 10353->10343 10367 33d5d8 10353->10367 10354->10352 10355->10023 10357->10355 10358 33cfea 10358->10343 10371 33d40c 10358->10371 10360 33cffd 10360->10343 10375 33d594 10360->10375 10363 336db0 RtlAllocateHeap 10366 33d028 10363->10366 10364 336830 RtlAllocateHeap 10364->10366 10365 33684c RtlFreeHeap 10365->10366 10366->10343 10366->10364 10366->10365 10368 33d603 10367->10368 10369 336830 RtlAllocateHeap 10368->10369 10370 33d700 10369->10370 10370->10358 10372 33d49c 10371->10372 10373 336830 RtlAllocateHeap 10372->10373 10374 33d4da 10373->10374 10374->10360 10376 33d5b3 10375->10376 10377 336db0 RtlAllocateHeap 10376->10377 10378 33d010 10377->10378 10378->10343 10378->10363 10380 340e3b 10379->10380 10381 340f4a RegCreateKeyExW 10380->10381 10385 340e88 10380->10385 10382 340f77 RegQueryValueExW 10381->10382 10381->10385 10383 340fa6 10382->10383 10384 340ff2 RegDeleteKeyExW 10383->10384 10383->10385 10384->10385 10385->10044 10387 336c9a NtQueryInformationToken 10386->10387 10389 336c83 10386->10389 10390 336c95 10387->10390 10388 336cec 10388->10063 10389->10387 10389->10390 10390->10388 10391 33684c RtlFreeHeap 10390->10391 10391->10388 10393 33c841 10392->10393 10394 336830 RtlAllocateHeap 10393->10394 10396 33c851 10394->10396 10395 33c873 10395->10074 10396->10395 10397 33684c RtlFreeHeap 10396->10397 10397->10395 10399 336830 RtlAllocateHeap 10398->10399 10400 3438c7 10399->10400 10400->10087 10402 336830 RtlAllocateHeap 10401->10402 10403 34182a 10402->10403 10403->10110 10405 336830 RtlAllocateHeap 10404->10405 10406 341baa 10405->10406 10406->10121 10473 339198 10407->10473 10409 3395fd 10410 33960c 10409->10410 10490 33908c 10409->10490 10413 337483 10412->10413 10414 33745b 10412->10414 10414->10413 10415 337464 GetDriveTypeW 10414->10415 10502 33748c 10414->10502 10415->10414 10418 337831 10417->10418 10420 3397a8 4 API calls 10419->10420 10421 338f70 10420->10421 10422 339850 NtClose 10421->10422 10423 338fe0 10421->10423 10424 338f7e 10422->10424 10425 339005 10423->10425 10573 338e9c 10423->10573 10424->10423 10426 338f87 NtSetInformationThread 10424->10426 10426->10423 10428 338f9b 10426->10428 10562 338d78 10428->10562 10431 339850 NtClose 10432 338fbe 10431->10432 10432->10423 10567 338bb0 10432->10567 10435 336db0 RtlAllocateHeap 10434->10435 10436 33bfdc 10435->10436 10437 33c0c7 10436->10437 10439 336830 RtlAllocateHeap 10436->10439 10438 33c0d5 10437->10438 10440 33684c RtlFreeHeap 10437->10440 10441 33c0e3 10438->10441 10442 33684c RtlFreeHeap 10438->10442 10445 33bff3 10439->10445 10440->10438 10443 33c0f1 10441->10443 10444 33684c RtlFreeHeap 10441->10444 10442->10441 10444->10443 10445->10437 10446 33684c RtlFreeHeap 10445->10446 10447 33c021 10446->10447 10448 336830 RtlAllocateHeap 10447->10448 10449 33c031 10448->10449 10449->10437 10450 336eac 2 API calls 10449->10450 10451 33c047 10450->10451 10452 33684c RtlFreeHeap 10451->10452 10453 33c064 10452->10453 10576 33bef0 10453->10576 10456 33c0a6 10458 33bef0 8 API calls 10456->10458 10457 33b390 2 API calls 10457->10456 10459 33c0b1 10458->10459 10460 33bef0 8 API calls 10459->10460 10461 33c0bc 10460->10461 10462 33bef0 8 API calls 10461->10462 10462->10437 10466 337e30 10463->10466 10464 336830 RtlAllocateHeap 10464->10466 10465 337e42 NtQuerySystemInformation 10465->10466 10466->10464 10466->10465 10467 337e75 10466->10467 10469 336868 RtlReAllocateHeap 10466->10469 10471 33684c RtlFreeHeap 10466->10471 10468 33684c RtlFreeHeap 10467->10468 10470 337e7d 10468->10470 10469->10466 10472 337f10 Sleep 10471->10472 10472->10466 10474 339279 10473->10474 10475 33943d RegCreateKeyExW 10474->10475 10476 339471 RegEnumKeyW 10475->10476 10477 339497 RegCreateKeyExW 10475->10477 10476->10477 10481 33949c RegCreateKeyExW 10476->10481 10480 3395b2 10477->10480 10486 33958c RegEnumKeyW 10477->10486 10480->10409 10481->10476 10483 3394ca RegSetValueExW 10481->10483 10483->10476 10485 3394ec RegSetValueExW 10483->10485 10484 3395b4 OpenEventLogW 10484->10486 10487 3395cc ClearEventLogW 10484->10487 10485->10476 10488 33950a OpenEventLogW 10485->10488 10486->10480 10486->10484 10487->10486 10488->10476 10489 339522 ClearEventLogW 10488->10489 10489->10476 10497 33900c RtlAdjustPrivilege 10490->10497 10492 339164 10493 339185 10492->10493 10494 33917c CloseServiceHandle 10492->10494 10493->10410 10494->10493 10495 3390a5 10495->10492 10496 33dbbc NtTerminateProcess 10495->10496 10496->10492 10498 3397a8 4 API calls 10497->10498 10499 339044 10498->10499 10500 339850 NtClose 10499->10500 10501 339052 10499->10501 10500->10501 10501->10495 10510 337560 10502->10510 10504 337550 10504->10414 10505 3374a4 10505->10504 10506 3374d6 FindFirstFileExW 10505->10506 10506->10504 10508 3374fe 10506->10508 10507 33753c FindNextFileW 10507->10504 10507->10508 10508->10507 10516 33763c 10508->10516 10511 337580 FindFirstFileExW 10510->10511 10513 337632 10511->10513 10515 3375de FindClose 10511->10515 10513->10505 10515->10513 10517 33765e 10516->10517 10518 3377f2 10517->10518 10519 336830 RtlAllocateHeap 10517->10519 10518->10507 10524 337676 10519->10524 10520 3377cd 10521 3377e4 10520->10521 10522 33684c RtlFreeHeap 10520->10522 10521->10518 10523 33684c RtlFreeHeap 10521->10523 10522->10521 10523->10518 10524->10520 10525 3376ae FindFirstFileExW 10524->10525 10525->10520 10527 3376d6 10525->10527 10526 3377b5 FindNextFileW 10526->10520 10526->10527 10527->10526 10528 336830 RtlAllocateHeap 10527->10528 10529 337750 GetFileAttributesW 10527->10529 10531 33684c RtlFreeHeap 10527->10531 10532 33763c 12 API calls 10527->10532 10533 336654 10527->10533 10528->10527 10529->10527 10531->10527 10532->10527 10534 33666a 10533->10534 10534->10534 10535 33a064 2 API calls 10534->10535 10536 336681 10535->10536 10537 336691 CreateFileW 10536->10537 10541 336791 10536->10541 10538 3366b9 10537->10538 10537->10541 10539 3366be NtAllocateVirtualMemory 10538->10539 10551 3366ef 10538->10551 10539->10538 10539->10551 10540 3367c0 NtFreeVirtualMemory 10540->10541 10541->10540 10542 3367e5 10541->10542 10543 3367f4 10542->10543 10544 3367eb NtClose 10542->10544 10553 336544 10543->10553 10544->10543 10547 33674f WriteFile 10549 336769 SetFilePointerEx 10547->10549 10547->10551 10548 33680d 10550 336822 10548->10550 10552 33684c RtlFreeHeap 10548->10552 10549->10547 10549->10551 10550->10527 10551->10541 10551->10547 10552->10550 10554 3368fc RtlAllocateHeap 10553->10554 10555 33655e 10554->10555 10556 3368fc RtlAllocateHeap 10555->10556 10559 336567 10555->10559 10561 336576 10556->10561 10557 33660c DeleteFileW 10557->10548 10558 33684c RtlFreeHeap 10558->10557 10559->10557 10559->10558 10560 3365cd MoveFileExW 10560->10559 10560->10561 10561->10559 10561->10560 10563 3397a8 4 API calls 10562->10563 10564 338da3 10563->10564 10565 338db0 OpenSCManagerW 10564->10565 10566 338dc9 10564->10566 10565->10566 10566->10423 10566->10431 10568 338be1 10567->10568 10571 336830 RtlAllocateHeap 10568->10571 10572 338c1d 10568->10572 10569 338d6c 10569->10423 10570 33684c RtlFreeHeap 10570->10569 10571->10572 10572->10569 10572->10570 10574 3397a8 4 API calls 10573->10574 10575 338eb5 10574->10575 10575->10425 10578 33bf15 10576->10578 10577 33bfab 10580 33bfb9 10577->10580 10581 33684c RtlFreeHeap 10577->10581 10578->10577 10579 336830 RtlAllocateHeap 10578->10579 10582 33bf27 10579->10582 10580->10456 10580->10457 10581->10580 10582->10577 10585 33be2c 10582->10585 10590 33bb94 10582->10590 10586 3368fc RtlAllocateHeap 10585->10586 10589 33be48 10586->10589 10587 33bee6 10587->10582 10588 33684c RtlFreeHeap 10588->10587 10589->10587 10589->10588 10592 33bbbc 10590->10592 10591 33bbc0 10593 33be06 10591->10593 10594 33bdfd DeleteDC 10591->10594 10592->10591 10595 336830 RtlAllocateHeap 10592->10595 10596 33be14 10593->10596 10597 33684c RtlFreeHeap 10593->10597 10594->10593 10598 33bbe9 10595->10598 10596->10582 10597->10596 10598->10591 10599 33bc3c CreateDCW 10598->10599 10599->10591 10600 33bc59 10599->10600 10601 33bcfa StartDocW 10600->10601 10601->10591 10604 33bd2a 10601->10604 10602 33bd48 10603 33bdc8 EndDoc 10602->10603 10603->10591 10604->10602 10605 33bd74 DrawTextA 10604->10605 10606 33bdb6 EndPage 10605->10606 10606->10603 10606->10604 10658 33f4f8 10607->10658 10610 33f4f8 2 API calls 10611 33ffdc 10610->10611 10613 340004 10611->10613 10616 33f4f8 2 API calls 10611->10616 10612 34026f 10615 34027d 10612->10615 10618 33684c RtlFreeHeap 10612->10618 10617 336830 RtlAllocateHeap 10613->10617 10629 34002d 10613->10629 10614 33684c RtlFreeHeap 10614->10612 10619 34028b 10615->10619 10621 33684c RtlFreeHeap 10615->10621 10616->10613 10620 340024 10617->10620 10618->10615 10619->9354 10622 336830 RtlAllocateHeap 10620->10622 10620->10629 10621->10619 10623 34003f 10622->10623 10624 33e144 8 API calls 10623->10624 10623->10629 10628 340052 10624->10628 10625 3369a8 RtlAllocateHeap 10625->10628 10626 3401e9 10627 33684c RtlFreeHeap 10626->10627 10626->10629 10627->10629 10628->10625 10628->10626 10630 33f634 NtSetInformationThread NtClose 10628->10630 10631 33684c RtlFreeHeap 10628->10631 10632 33b390 2 API calls 10628->10632 10629->10612 10629->10614 10630->10628 10631->10628 10632->10628 10634 337403 10633->10634 10635 3368fc RtlAllocateHeap 10634->10635 10637 337411 10635->10637 10636 337434 10636->9761 10637->10636 10638 33684c RtlFreeHeap 10637->10638 10638->10636 10640 33a953 10639->10640 10641 33a458 6 API calls 10640->10641 10643 33a96a 10641->10643 10642 33a999 10642->9761 10643->10642 10644 336830 RtlAllocateHeap 10643->10644 10644->10642 10646 33a3cf 10645->10646 10647 33b390 2 API calls 10646->10647 10648 33a3e9 10646->10648 10647->10648 10648->9744 10648->9758 10650 336a55 10649->10650 10651 336830 RtlAllocateHeap 10650->10651 10652 336a6b 10650->10652 10651->10652 10652->9759 10654 33e144 8 API calls 10653->10654 10655 3408d3 10654->10655 10656 33b390 2 API calls 10655->10656 10657 340924 10655->10657 10656->10657 10657->9736 10659 33f552 10658->10659 10660 33b390 2 API calls 10659->10660 10661 33f56c 10659->10661 10660->10661 10661->10610 10661->10613 10663 340da4 10662->10663 10664 340de9 10662->10664 10665 33c820 2 API calls 10663->10665 10664->9781 10668 34135c 10664->10668 10666 340da9 10665->10666 10666->10664 10667 33684c RtlFreeHeap 10666->10667 10667->10664 10720 34119c 10668->10720 10670 34139d 10671 336db0 RtlAllocateHeap 10670->10671 10696 3413a1 10670->10696 10672 3413b0 10671->10672 10672->10696 10742 34156d 10672->10742 10673 34153c 10675 34154a 10673->10675 10676 33684c RtlFreeHeap 10673->10676 10674 33684c RtlFreeHeap 10674->10673 10677 33684c RtlFreeHeap 10675->10677 10679 341558 10675->10679 10676->10675 10677->10679 10678 341566 10678->9781 10697 3416bc 10678->10697 10679->10678 10680 33684c RtlFreeHeap 10679->10680 10680->10678 10683 336db0 RtlAllocateHeap 10684 3413f7 10683->10684 10685 34156d RtlFreeHeap 10684->10685 10684->10696 10686 341430 10685->10686 10687 336db0 RtlAllocateHeap 10686->10687 10688 34143a 10687->10688 10689 34156d RtlFreeHeap 10688->10689 10688->10696 10690 34147d 10689->10690 10691 336db0 RtlAllocateHeap 10690->10691 10692 341487 10691->10692 10693 34156d RtlFreeHeap 10692->10693 10692->10696 10694 3414c7 10693->10694 10695 336db0 RtlAllocateHeap 10694->10695 10695->10696 10696->10673 10696->10674 10698 336db0 RtlAllocateHeap 10697->10698 10702 3416ed 10698->10702 10699 3417ec 10701 3417fa 10699->10701 10703 33684c RtlFreeHeap 10699->10703 10700 33684c RtlFreeHeap 10700->10699 10701->9781 10701->9793 10704 341814 RtlAllocateHeap 10702->10704 10706 3416f6 10702->10706 10703->10701 10705 34172a 10704->10705 10705->10706 10707 336db0 RtlAllocateHeap 10705->10707 10706->10699 10706->10700 10708 341765 10707->10708 10709 33684c RtlFreeHeap 10708->10709 10709->10706 10711 3410ec 10710->10711 10712 336db0 RtlAllocateHeap 10711->10712 10719 3410f1 10711->10719 10717 3410fd 10712->10717 10713 341175 10715 341183 10713->10715 10716 33684c RtlFreeHeap 10713->10716 10714 33684c RtlFreeHeap 10714->10713 10715->9797 10716->10715 10718 336db0 RtlAllocateHeap 10717->10718 10717->10719 10718->10719 10719->10713 10719->10714 10721 3411cb 10720->10721 10724 3411de 10720->10724 10723 336db0 RtlAllocateHeap 10721->10723 10721->10724 10722 34126b 10722->10670 10725 3411e9 10723->10725 10724->10722 10746 341028 10724->10746 10725->10724 10726 336db0 RtlAllocateHeap 10725->10726 10727 341201 10726->10727 10727->10724 10730 341210 10727->10730 10729 341292 10731 3368fc RtlAllocateHeap 10729->10731 10732 336db0 RtlAllocateHeap 10730->10732 10733 3412a1 10731->10733 10734 341219 10732->10734 10733->10722 10735 3368fc RtlAllocateHeap 10733->10735 10734->10670 10736 3412d3 10735->10736 10736->10722 10737 341319 10736->10737 10738 33684c RtlFreeHeap 10736->10738 10739 33684c RtlFreeHeap 10737->10739 10740 341327 10737->10740 10738->10737 10739->10740 10740->10722 10741 33684c RtlFreeHeap 10740->10741 10741->10722 10743 3413ed 10742->10743 10744 341573 10742->10744 10743->10683 10745 33684c RtlFreeHeap 10744->10745 10745->10743 10747 336830 RtlAllocateHeap 10746->10747 10748 34103e 10747->10748 10748->10729 10750 341b4b 10749->10750 10753 341aac 10750->10753 10752 341b63 10752->9803 10754 336830 RtlAllocateHeap 10753->10754 10755 341ac3 10754->10755 10756 341adc 10755->10756 10757 341af9 10755->10757 10758 336868 RtlReAllocateHeap 10755->10758 10761 33684c RtlFreeHeap 10756->10761 10759 33684c RtlFreeHeap 10757->10759 10758->10755 10760 341b01 10759->10760 10760->10752 10762 341b3c 10761->10762 10762->10752 10767 346412 10763->10767 10764 34642a 10765 34654c 10764->10765 10766 33684c RtlFreeHeap 10764->10766 10765->9817 10766->10765 10767->10764 10815 346080 10767->10815 10782 343f00 10781->10782 10785 343f31 10782->10785 11076 343cf4 10782->11076 10784 343fc2 10784->9813 10787 344464 10784->10787 10785->10784 10786 33684c RtlFreeHeap 10785->10786 10786->10784 10788 34448a 10787->10788 10806 34448e 10788->10806 11079 342a54 10788->11079 10790 3445e0 10793 3445ee 10790->10793 10797 33684c RtlFreeHeap 10790->10797 10792 33684c RtlFreeHeap 10792->10790 10795 3445fc 10793->10795 10798 33684c RtlFreeHeap 10793->10798 10794 336830 RtlAllocateHeap 10796 3444af 10794->10796 10795->9823 10807 344604 10795->10807 10799 339610 2 API calls 10796->10799 10796->10806 10797->10793 10798->10795 10800 3444c2 10799->10800 10801 33f788 2 API calls 10800->10801 10802 3444db 10801->10802 10803 336830 RtlAllocateHeap 10802->10803 10802->10806 10804 3444f9 10803->10804 10805 336830 RtlAllocateHeap 10804->10805 10804->10806 10805->10806 10806->10790 10806->10792 10808 344615 10807->10808 10809 344816 10808->10809 10810 339610 2 API calls 10808->10810 10809->9823 10811 344623 10810->10811 10811->10809 10812 336db0 RtlAllocateHeap 10811->10812 10814 34463d 10812->10814 10813 33684c RtlFreeHeap 10813->10809 10814->10809 10814->10813 11047 346004 10815->11047 10817 3460c8 10819 3463ac 10817->10819 10820 33684c RtlFreeHeap 10817->10820 10821 3463ba 10819->10821 10823 33684c RtlFreeHeap 10819->10823 10820->10819 10822 3463c8 10821->10822 10824 33684c RtlFreeHeap 10821->10824 10825 3463d6 10822->10825 10826 33684c RtlFreeHeap 10822->10826 10823->10821 10824->10822 10827 3463e4 10825->10827 10829 33684c RtlFreeHeap 10825->10829 10826->10825 10827->10764 10838 345c84 10827->10838 10828 336830 RtlAllocateHeap 10830 346104 10828->10830 10829->10827 10830->10817 10831 336830 RtlAllocateHeap 10830->10831 10832 3461a5 10831->10832 10832->10817 10833 336830 RtlAllocateHeap 10832->10833 10834 3461f5 10833->10834 10834->10817 10835 336830 RtlAllocateHeap 10834->10835 10836 3462a0 10835->10836 10836->10817 10837 33684c RtlFreeHeap 10836->10837 10837->10817 10839 345ceb 10838->10839 10840 336db0 RtlAllocateHeap 10839->10840 10847 345d00 10839->10847 10845 345d77 10840->10845 10841 345feb 10843 345ff9 10841->10843 10844 33684c RtlFreeHeap 10841->10844 10842 33684c RtlFreeHeap 10842->10841 10843->10764 10848 344bbc 10843->10848 10844->10843 10846 336db0 RtlAllocateHeap 10845->10846 10845->10847 10846->10847 10847->10841 10847->10842 10849 336830 RtlAllocateHeap 10848->10849 10851 344bef 10849->10851 10850 344d77 10853 344d85 10850->10853 10854 33684c RtlFreeHeap 10850->10854 10856 336830 RtlAllocateHeap 10851->10856 10860 344bf8 10851->10860 10852 33684c RtlFreeHeap 10852->10850 10855 344d93 10853->10855 10857 33684c RtlFreeHeap 10853->10857 10854->10853 10855->10764 10861 3459e0 10855->10861 10858 344c22 10856->10858 10857->10855 10859 336830 RtlAllocateHeap 10858->10859 10858->10860 10859->10860 10860->10850 10860->10852 10862 336830 RtlAllocateHeap 10861->10862 10864 345a39 10862->10864 10863 345c06 10866 345c14 10863->10866 10868 33684c RtlFreeHeap 10863->10868 10897 345a42 10864->10897 11053 3448d8 10864->11053 10865 33684c RtlFreeHeap 10865->10863 10869 345c22 10866->10869 10870 33684c RtlFreeHeap 10866->10870 10868->10866 10871 345c30 10869->10871 10873 33684c RtlFreeHeap 10869->10873 10870->10869 10872 345c3e 10871->10872 10874 33684c RtlFreeHeap 10871->10874 10875 345c4c 10872->10875 10876 33684c RtlFreeHeap 10872->10876 10873->10871 10874->10872 10877 345c5a 10875->10877 10878 33684c RtlFreeHeap 10875->10878 10876->10875 10879 345c68 10877->10879 10881 33684c RtlFreeHeap 10877->10881 10878->10877 10879->10764 10900 345710 10879->10900 10880 345a6a 10880->10897 11056 34498c 10880->11056 10881->10879 10883 345a96 10884 33684c RtlFreeHeap 10883->10884 10883->10897 10885 345ab8 10884->10885 10886 34498c RtlAllocateHeap 10885->10886 10887 345ad1 10886->10887 10887->10897 11059 344a04 10887->11059 10889 345b19 10889->10897 11062 344b64 10889->11062 10892 336830 RtlAllocateHeap 10893 345b4e 10892->10893 10894 336db0 RtlAllocateHeap 10893->10894 10893->10897 10895 345b66 10894->10895 10896 336830 RtlAllocateHeap 10895->10896 10895->10897 10898 345b8f 10896->10898 10897->10863 10897->10865 10898->10897 10899 33684c RtlFreeHeap 10898->10899 10899->10898 10901 336830 RtlAllocateHeap 10900->10901 10902 345758 10901->10902 10903 336830 RtlAllocateHeap 10902->10903 10924 345761 10902->10924 10914 345770 10903->10914 10904 34597e 10906 34598c 10904->10906 10907 33684c RtlFreeHeap 10904->10907 10905 33684c RtlFreeHeap 10905->10904 10908 34599a 10906->10908 10909 33684c RtlFreeHeap 10906->10909 10907->10906 10910 3459a8 10908->10910 10911 33684c RtlFreeHeap 10908->10911 10909->10908 10912 3459b6 10910->10912 10913 33684c RtlFreeHeap 10910->10913 10911->10910 10912->10764 10925 344dac 10912->10925 10913->10912 10915 336830 RtlAllocateHeap 10914->10915 10914->10924 10916 34589f 10915->10916 10917 336db0 RtlAllocateHeap 10916->10917 10916->10924 10918 3458b7 10917->10918 10919 33684c RtlFreeHeap 10918->10919 10918->10924 10920 345900 10919->10920 10921 336830 RtlAllocateHeap 10920->10921 10922 345919 10921->10922 10923 336db0 RtlAllocateHeap 10922->10923 10922->10924 10923->10924 10924->10904 10924->10905 10926 336830 RtlAllocateHeap 10925->10926 10927 344df4 10926->10927 10931 3448d8 RtlAllocateHeap 10927->10931 10962 344dfd 10927->10962 10928 33684c RtlFreeHeap 10929 344fc1 10928->10929 10930 344fcf 10929->10930 10932 33684c RtlFreeHeap 10929->10932 10933 344fdd 10930->10933 10934 33684c RtlFreeHeap 10930->10934 10944 344e25 10931->10944 10932->10930 10935 344feb 10933->10935 10936 33684c RtlFreeHeap 10933->10936 10934->10933 10937 344ff9 10935->10937 10938 33684c RtlFreeHeap 10935->10938 10936->10935 10939 345007 10937->10939 10940 33684c RtlFreeHeap 10937->10940 10938->10937 10941 345015 10939->10941 10942 33684c RtlFreeHeap 10939->10942 10940->10939 10943 345023 10941->10943 10945 33684c RtlFreeHeap 10941->10945 10942->10941 10943->10764 10964 34503c 10943->10964 10944->10962 11067 34487c 10944->11067 10945->10943 10947 344e51 10948 33684c RtlFreeHeap 10947->10948 10947->10962 10949 344e73 10948->10949 10950 34487c RtlAllocateHeap 10949->10950 10951 344e8c 10950->10951 10952 344a04 RtlAllocateHeap 10951->10952 10951->10962 10953 344ed4 10952->10953 10954 344b64 RtlAllocateHeap 10953->10954 10953->10962 10955 344ee9 10954->10955 10956 336830 RtlAllocateHeap 10955->10956 10955->10962 10957 344f09 10956->10957 10958 336db0 RtlAllocateHeap 10957->10958 10957->10962 10959 344f21 10958->10959 10960 336830 RtlAllocateHeap 10959->10960 10959->10962 10961 344f4a 10960->10961 10961->10962 10963 33684c RtlFreeHeap 10961->10963 10962->10928 10962->10929 10963->10961 10965 336830 RtlAllocateHeap 10964->10965 10975 34509f 10965->10975 10966 345677 10968 345685 10966->10968 10970 33684c RtlFreeHeap 10966->10970 10967 33684c RtlFreeHeap 10967->10966 10969 345693 10968->10969 10971 33684c RtlFreeHeap 10968->10971 10972 3456a1 10969->10972 10973 33684c RtlFreeHeap 10969->10973 10970->10968 10971->10969 10974 3456af 10972->10974 10976 33684c RtlFreeHeap 10972->10976 10973->10972 10977 3456bd 10974->10977 10978 33684c RtlFreeHeap 10974->10978 10987 336830 RtlAllocateHeap 10975->10987 11007 3450a8 10975->11007 10976->10974 10979 3456cb 10977->10979 10981 33684c RtlFreeHeap 10977->10981 10978->10977 10980 3456d9 10979->10980 10982 33684c RtlFreeHeap 10979->10982 10983 3456e7 10980->10983 10984 33684c RtlFreeHeap 10980->10984 10981->10979 10982->10980 10985 3456f5 10983->10985 10986 33684c RtlFreeHeap 10983->10986 10984->10983 10985->10764 10986->10985 10988 34515b 10987->10988 10989 3448d8 RtlAllocateHeap 10988->10989 10988->11007 10990 34518c 10989->10990 10990->11007 11070 344820 10990->11070 10992 3451b8 10993 33684c RtlFreeHeap 10992->10993 10992->11007 10994 3451da 10993->10994 10995 344820 RtlAllocateHeap 10994->10995 10996 3451f3 10995->10996 10997 344a04 RtlAllocateHeap 10996->10997 10996->11007 10998 34523b 10997->10998 10999 344b64 RtlAllocateHeap 10998->10999 10998->11007 11000 345250 10999->11000 11001 336830 RtlAllocateHeap 11000->11001 11000->11007 11002 345299 11001->11002 11003 336db0 RtlAllocateHeap 11002->11003 11002->11007 11004 3452b1 11003->11004 11005 336830 RtlAllocateHeap 11004->11005 11004->11007 11006 3452dd 11005->11006 11006->11007 11008 33684c RtlFreeHeap 11006->11008 11007->10966 11007->10967 11009 345383 11008->11009 11010 345391 11009->11010 11011 33684c RtlFreeHeap 11009->11011 11012 3453a6 11010->11012 11014 33684c RtlFreeHeap 11010->11014 11011->11010 11013 3453bb 11012->11013 11015 33684c RtlFreeHeap 11012->11015 11016 3453d0 11013->11016 11017 33684c RtlFreeHeap 11013->11017 11014->11012 11015->11013 11018 3453e5 11016->11018 11019 33684c RtlFreeHeap 11016->11019 11017->11016 11020 3453fa 11018->11020 11022 33684c RtlFreeHeap 11018->11022 11019->11018 11021 34540f 11020->11021 11023 33684c RtlFreeHeap 11020->11023 11024 345424 11021->11024 11025 33684c RtlFreeHeap 11021->11025 11022->11020 11023->11021 11026 336830 RtlAllocateHeap 11024->11026 11025->11024 11027 34544b 11026->11027 11027->11007 11028 3448d8 RtlAllocateHeap 11027->11028 11029 34547c 11028->11029 11029->11007 11073 34491c 11029->11073 11031 3454a8 11031->11007 11032 33684c RtlFreeHeap 11031->11032 11033 3454d5 11032->11033 11034 34491c RtlAllocateHeap 11033->11034 11035 3454e3 11034->11035 11035->11007 11036 344a04 RtlAllocateHeap 11035->11036 11037 34552b 11036->11037 11037->11007 11038 344b64 RtlAllocateHeap 11037->11038 11039 345540 11038->11039 11039->11007 11040 336830 RtlAllocateHeap 11039->11040 11041 3455b7 11040->11041 11041->11007 11042 336db0 RtlAllocateHeap 11041->11042 11043 3455cf 11042->11043 11043->11007 11044 336830 RtlAllocateHeap 11043->11044 11045 3455f8 11044->11045 11045->11007 11046 33684c RtlFreeHeap 11045->11046 11046->11007 11048 346024 11047->11048 11049 3368fc RtlAllocateHeap 11048->11049 11052 346064 11048->11052 11050 34604d 11049->11050 11051 3368fc RtlAllocateHeap 11050->11051 11050->11052 11051->11052 11052->10817 11052->10828 11054 336830 RtlAllocateHeap 11053->11054 11055 3448e1 11054->11055 11055->10880 11057 336830 RtlAllocateHeap 11056->11057 11058 344998 11057->11058 11058->10883 11060 336830 RtlAllocateHeap 11059->11060 11061 344a14 11060->11061 11061->10889 11063 336830 RtlAllocateHeap 11062->11063 11065 344b83 11063->11065 11064 336830 RtlAllocateHeap 11064->11065 11065->11064 11066 344bb0 11065->11066 11066->10892 11066->10897 11068 336830 RtlAllocateHeap 11067->11068 11069 344888 11068->11069 11069->10947 11071 336830 RtlAllocateHeap 11070->11071 11072 34482c 11071->11072 11072->10992 11074 336830 RtlAllocateHeap 11073->11074 11075 344928 11074->11075 11075->11031 11077 336830 RtlAllocateHeap 11076->11077 11078 343d0e 11077->11078 11078->10785 11082 342a7d 11079->11082 11080 342a81 11080->10794 11082->11080 11083 3428b0 11082->11083 11084 3428d7 11083->11084 11085 3397a8 4 API calls 11084->11085 11086 3428e7 11085->11086 11087 3397a8 4 API calls 11086->11087 11088 3428fb 11086->11088 11087->11088 11088->11080 11094 346612 11089->11094 11090 346b00 11091 346b0e 11090->11091 11093 33684c RtlFreeHeap 11090->11093 11091->9833 11092 33684c RtlFreeHeap 11092->11090 11093->11091 11095 336db0 RtlAllocateHeap 11094->11095 11098 346670 11094->11098 11096 346748 11095->11096 11097 336830 RtlAllocateHeap 11096->11097 11096->11098 11097->11098 11098->11090 11098->11092 11100 343703 11099->11100 11101 342a54 4 API calls 11100->11101 11116 343707 11100->11116 11103 34371e 11101->11103 11102 343845 11105 343853 11102->11105 11107 33684c RtlFreeHeap 11102->11107 11106 336830 RtlAllocateHeap 11103->11106 11104 33684c RtlFreeHeap 11104->11102 11108 343861 11105->11108 11110 33684c RtlFreeHeap 11105->11110 11109 343728 11106->11109 11107->11105 11108->9841 11111 33f788 2 API calls 11109->11111 11109->11116 11110->11108 11112 343740 11111->11112 11113 336830 RtlAllocateHeap 11112->11113 11112->11116 11114 34375e 11113->11114 11115 336830 RtlAllocateHeap 11114->11115 11114->11116 11115->11116 11116->11102 11116->11104 11118 3402ac 11117->11118 11119 336830 RtlAllocateHeap 11118->11119 11120 3402cd 11119->11120 11120->9874 11589 335ee8 11593 335dd3 11589->11593 11590 335ddb 11591 335afc 3 API calls 11592 335deb RtlAllocateHeap 11591->11592 11592->11593 11593->11589 11593->11590 11593->11591 11594 33d7e8 11595 33cc60 14 API calls 11594->11595 11596 33d814 11595->11596 11597 33ce38 RtlAllocateHeap 11596->11597 11608 33d81d 11596->11608 11598 33d827 11597->11598 11607 336db0 RtlAllocateHeap 11598->11607 11598->11608 11599 33d928 11601 33d936 11599->11601 11603 33684c RtlFreeHeap 11599->11603 11600 33684c RtlFreeHeap 11600->11599 11602 33d944 11601->11602 11604 33684c RtlFreeHeap 11601->11604 11605 33d952 11602->11605 11606 33684c RtlFreeHeap 11602->11606 11603->11601 11604->11602 11606->11605 11609 33d87d 11607->11609 11608->11599 11608->11600 11609->11608 11610 336830 RtlAllocateHeap 11609->11610 11611 33d8d0 11610->11611 11611->11608 11612 33cf28 2 API calls 11611->11612 11612->11608 11295 337e5a 11303 337e30 11295->11303 11296 337e42 NtQuerySystemInformation 11296->11303 11297 337e75 11298 33684c RtlFreeHeap 11297->11298 11301 337e7d 11298->11301 11299 336868 RtlReAllocateHeap 11299->11303 11300 33684c RtlFreeHeap 11302 337f10 Sleep 11300->11302 11302->11303 11303->11296 11303->11297 11303->11299 11303->11300 11304 336830 RtlAllocateHeap 11303->11304 11304->11303 11613 341ade 11615 341ac6 11613->11615 11614 341adc 11616 33684c RtlFreeHeap 11614->11616 11615->11614 11617 341af9 11615->11617 11619 336868 RtlReAllocateHeap 11615->11619 11618 341b3c 11616->11618 11620 33684c RtlFreeHeap 11617->11620 11619->11615 11621 341b01 11620->11621 11362 33969d 11363 33967f 11362->11363 11364 339705 11363->11364 11365 33684c RtlFreeHeap 11363->11365 11365->11364 11622 3430c4 11623 3430db 11622->11623 11624 342a54 4 API calls 11623->11624 11625 34312a 11623->11625 11624->11625 11626 343fcc 11632 344010 11626->11632 11627 34402e 11628 34443e 11627->11628 11629 33684c RtlFreeHeap 11627->11629 11630 34444c 11628->11630 11631 33684c RtlFreeHeap 11628->11631 11629->11628 11633 34445a 11630->11633 11634 33684c RtlFreeHeap 11630->11634 11631->11630 11632->11627 11635 336db0 RtlAllocateHeap 11632->11635 11634->11633 11636 3440e2 11635->11636 11636->11627 11637 336830 RtlAllocateHeap 11636->11637 11637->11627 11305 33dd4e 11308 33dd3a 11305->11308 11306 33dd4c 11307 33dd99 11306->11307 11309 33684c RtlFreeHeap 11306->11309 11308->11306 11310 33daec NtTerminateProcess 11308->11310 11311 33dbbc NtTerminateProcess 11308->11311 11309->11307 11310->11308 11311->11308 11382 33ef8e 11389 33ef57 11382->11389 11383 33ef43 MoveFileExW 11384 33ef55 11383->11384 11383->11389 11385 33efad CreateFileW 11384->11385 11401 33efd1 11384->11401 11386 33efd6 11385->11386 11385->11401 11396 33ec8c 2 API calls 11386->11396 11387 33f0a9 11393 33684c RtlFreeHeap 11387->11393 11388 33ef90 11391 33684c RtlFreeHeap 11388->11391 11389->11383 11389->11384 11389->11388 11390 33684c RtlFreeHeap 11389->11390 11395 33ec40 RtlAllocateHeap 11389->11395 11390->11389 11391->11384 11392 33684c RtlFreeHeap 11392->11387 11394 33f0b1 11393->11394 11395->11389 11397 33efeb 11396->11397 11398 33efff CreateIoCompletionPort 11397->11398 11397->11401 11399 33f016 11398->11399 11402 33f038 11398->11402 11400 33684c RtlFreeHeap 11399->11400 11400->11401 11401->11387 11401->11392 11402->11401 11403 33684c RtlFreeHeap 11402->11403 11403->11401 11312 33f84c 11314 33f82e 11312->11314 11313 336830 RtlAllocateHeap 11313->11314 11314->11313 11316 33f84a 11314->11316 11315 33f96e 11316->11315 11317 336830 RtlAllocateHeap 11316->11317 11317->11316 11404 33e38c 11407 33e34f 11404->11407 11405 33e321 SetFileAttributesW CreateFileW 11405->11407 11408 33e367 11405->11408 11406 33dda4 5 API calls 11406->11407 11407->11405 11407->11406 11407->11408

                                          Control-flow Graph

                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Create$Load$ErrorImageLast$CapsColorCommandDeviceFontFreeLibraryLineMenuPixelProcSelectTextWindow$AddressAttributesBitmapBrushButtonCheckedDialogExitFileHandleHeapInfoItemLocaleModuleObjectPaletteParamProcessSolid
                                          • String ID:
                                          • API String ID: 901569772-0
                                          • Opcode ID: 319009f4121feb1712dae78e6e19bb6793af2b3c52d7e7686e0cf20f8a6b9f59
                                          • Instruction ID: 417c5e9fca570c97b4209ac795db5e5649cdcf7640dce85aaabbbb8156a15d16
                                          • Opcode Fuzzy Hash: 319009f4121feb1712dae78e6e19bb6793af2b3c52d7e7686e0cf20f8a6b9f59
                                          • Instruction Fuzzy Hash: 36019228D5B158A9C6233BF1C84FB6CB6E4BF63358F1614A9B1491E0E39F207844C23B

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 9 340410-3404c5 call 33165c call 336db0 18 3404c7 9->18 19 3404cc-3404e5 call 336830 9->19 20 340845-34084c 18->20 27 3404e7 19->27 28 3404ec-3404ff call 348ba4 19->28 22 34084e 20->22 23 34085a-340861 20->23 22->23 25 340863 23->25 26 34086f-340873 23->26 25->26 30 340875 26->30 31 34087e-340882 26->31 27->20 37 340506-340516 call 340294 28->37 38 340501 28->38 30->31 33 340884-340887 call 33684c 31->33 34 34088c-340890 31->34 33->34 35 340892-340895 call 33684c 34->35 36 34089a-34089e 34->36 35->36 41 3408a0-3408a3 call 33684c 36->41 42 3408a8-3408ac 36->42 49 34051d-34056e GetTempFileNameW CreateFileW 37->49 50 340518 37->50 38->20 41->42 45 3408b6-3408bc 42->45 46 3408ae-3408b1 call 33684c 42->46 46->45 52 340575-34058a WriteFile 49->52 53 340570 49->53 50->20 54 340591-3405aa 52->54 55 34058c 52->55 53->20 57 3405ac-3405b1 54->57 55->20 58 3405b5-3405b7 57->58 59 3405b3-3405f4 CreateProcessW 57->59 58->57 61 3405f6 59->61 62 3405fb-340618 NtQueryInformationProcess 59->62 61->20 63 34061f-34063f NtReadVirtualMemory 62->63 64 34061a 62->64 65 340646-340657 call 336db0 63->65 66 340641 63->66 64->20 69 34065e-3406d9 call 3492f4 call 349348 call 34941c NtProtectVirtualMemory 65->69 70 340659 65->70 66->20 77 3406e0-3406f3 NtWriteVirtualMemory 69->77 78 3406db 69->78 70->20 79 3406f5 77->79 80 3406fa-340756 77->80 78->20 79->20 82 34075d-34077e 80->82 83 340758 80->83 85 340785-3407ed CreateNamedPipeW 82->85 86 340780 82->86 83->20 87 3407f1-34080a ResumeThread ConnectNamedPipe 85->87 88 3407ef 85->88 86->20 89 34080c-340817 87->89 90 34081b-340838 87->90 88->20 89->90 91 340819 89->91 93 34083c 90->93 94 34083a 90->94 91->20 93->20 94->20
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID: D
                                          • API String ID: 0-2746444292
                                          • Opcode ID: d0b3e9ed7ada3c7f815b296f7f2de11505c52888f9acd08938053a94db354497
                                          • Instruction ID: 12362e798c24aa4c16ce8a9a5053c874ebea69666c8f04b688585fd1ad837e4b
                                          • Opcode Fuzzy Hash: d0b3e9ed7ada3c7f815b296f7f2de11505c52888f9acd08938053a94db354497
                                          • Instruction Fuzzy Hash: F6E12E71A00218EFDF529F90DC49BEEBBBDFB04305F1040A5E609BA1A1E7756A84DF91

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 233 339198-33946b call 331250 * 5 RegCreateKeyExW 244 339471 233->244 245 33954d-339551 233->245 248 339478-339495 RegEnumKeyW 244->248 246 339553 245->246 247 33955c-33958a RegCreateKeyExW 245->247 246->247 249 3395e5-3395e9 247->249 250 33958c 247->250 251 339497 248->251 252 33949c-3394c8 RegCreateKeyExW 248->252 256 3395f4-3395f7 249->256 257 3395eb 249->257 253 339593-3395b0 RegEnumKeyW 250->253 251->245 254 339545-339548 252->254 255 3394ca-3394ea RegSetValueExW 252->255 258 3395b2 253->258 259 3395b4-3395ca OpenEventLogW 253->259 254->248 260 339536-33953a 255->260 261 3394ec-339508 RegSetValueExW 255->261 257->256 258->249 262 3395e0-3395e3 259->262 263 3395cc-3395d7 ClearEventLogW 259->263 260->254 265 33953c 260->265 261->260 264 33950a-339520 OpenEventLogW 261->264 262->253 263->262 264->260 266 339522-33952d ClearEventLogW 264->266 265->254 266->260
                                          APIs
                                          • RegCreateKeyExW.KERNELBASE(80000002,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000,?,00000007,?,00000004,?,00000019,?), ref: 00339463
                                          • RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000104), ref: 0033948A
                                          • RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000), ref: 003394C0
                                          • RegSetValueExW.KERNELBASE(00000000,?,00000000,00000004,00000000,00000004), ref: 003394E2
                                          • RegSetValueExW.KERNELBASE(00000000,?,00000000,00000001,?,00000064), ref: 00339500
                                          • OpenEventLogW.ADVAPI32(00000000,?), ref: 00339513
                                          • ClearEventLogW.ADVAPI32(00000000,00000000), ref: 00339527
                                          • RegCreateKeyExW.KERNELBASE(80000002,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000), ref: 00339582
                                          • RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000104), ref: 003395A5
                                          • OpenEventLogW.ADVAPI32(00000000,?), ref: 003395BD
                                          • ClearEventLogW.ADVAPI32(00000000,00000000), ref: 003395D1
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Event$Create$ClearEnumOpenValue
                                          • String ID:
                                          • API String ID: 1260815474-0
                                          • Opcode ID: d1efd13aea4aa1e6eb768b7ae92cf0c3804512d4f4414028af1a2b80a615d077
                                          • Instruction ID: 040ec1389896995f6dd90d5023284484b8e0f72d4a9306e8f20a112134bbd9d1
                                          • Opcode Fuzzy Hash: d1efd13aea4aa1e6eb768b7ae92cf0c3804512d4f4414028af1a2b80a615d077
                                          • Instruction Fuzzy Hash: 41C13CB0440304EFE755EF51E885B997F78FB22305F528899E1286F272D3B69A84CF50

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 267 346f90-346faf 269 346fb5-346fbc 267->269 270 34706d-347074 267->270 273 346fe7-346fee 269->273 274 346fbe-346fe4 call 336ab0 269->274 271 347076-34708f CreateThread 270->271 272 3470a1-3470d8 CreateThread * 2 270->272 271->272 277 347091-34709a 271->277 278 3470df-3470e6 272->278 279 3470da call 337c74 272->279 275 346ff0-346ff7 273->275 276 34702a-347031 273->276 274->273 275->276 281 346ff9-347023 call 339c34 275->281 276->270 283 347033-34703a 276->283 277->272 284 347100-347107 278->284 285 3470e8-3470fd CreateThread 278->285 279->278 281->276 283->270 290 34703c-347066 call 339c34 283->290 286 347112-347139 call 33b690 call 33e144 284->286 287 347109-347110 284->287 285->284 317 34717d-347181 286->317 318 34713b-347142 286->318 287->286 293 34718a-34718e 287->293 290->270 295 3471a4-3471a8 293->295 296 347190-34719b 293->296 301 3471be-3471c5 295->301 302 3471aa-3471b5 295->302 296->295 308 3471c7-3471d2 NtTerminateThread 301->308 309 3471db-3471e2 301->309 302->301 308->309 312 3471e4-3471fd CreateThread 309->312 313 34720f-347219 309->313 312->313 315 3471ff-347208 312->315 320 3472ee-3472fc call 341890 call 341c84 call 341608 313->320 321 34721f-347226 313->321 315->313 317->293 322 347144-347158 call 33a65c call 33e214 call 340994 call 33e214 call 340b40 318->322 323 34715d-347164 318->323 359 347301-347305 320->359 326 347253-34725a 321->326 327 347228-347241 CreateThread 321->327 322->323 324 347166-34716b call 33e214 call 33fbe4 323->324 325 347170-347178 call 33e1cc call 33e214 323->325 324->325 325->317 334 347295-34729c call 33b5d0 326->334 335 34725c-347260 326->335 327->326 331 347243-34724c 327->331 331->326 351 3472a5-3472a7 call 338200 334->351 352 34729e-3472a3 call 338930 334->352 341 347276-347290 call 336ab0 call 33d95c 335->341 342 347262-34726d 335->342 341->334 342->341 364 3472ac-3472b3 351->364 352->364 365 3472b5-3472bc 364->365 366 3472c7-3472e7 call 339610 call 340410 364->366 365->366 369 3472be-3472c5 365->369 372 3472ec 366->372 369->366 369->372 372->359
                                          APIs
                                          • CreateThread.KERNELBASE(00000000,00000000,00338F38,00000000,00000000,00000000), ref: 00347085
                                          • CreateThread.KERNELBASE(00000000,00000000,00337438,00000000,00000000,00000000), ref: 003470B0
                                          • CreateThread.KERNELBASE(00000000,00000000,003377FC,00000000,00000000,00000000), ref: 003470C8
                                          • CreateThread.KERNELBASE(00000000,00000000,00337E28,00000000,00000000,00000000), ref: 003470F7
                                          • NtTerminateThread.NTDLL(?,00000000), ref: 003471CC
                                          • CreateThread.KERNELBASE(00000000,00000000,003395F8,00000000,00000000,00000000), ref: 003471F3
                                          • CreateThread.KERNELBASE(00000000,00000000,0033BFC0,00000000,00000000,00000000), ref: 00347237
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Thread$Create$Terminate
                                          • String ID: vv4
                                          • API String ID: 1922322686-4159498037
                                          • Opcode ID: 1c0d479a00d50238e353ae434911b5fbf53ef8b24fdb1f50870af39733103887
                                          • Instruction ID: 4bca04dbc2cdc12c0ab57c7c9c9bf7d208f49ad9586b328b5cc386b8501a20ec
                                          • Opcode Fuzzy Hash: 1c0d479a00d50238e353ae434911b5fbf53ef8b24fdb1f50870af39733103887
                                          • Instruction Fuzzy Hash: 569171B0548B44BEEF236BB1DCAAB6D3EA9AB05707F150514F251AC1F1DBB43A80CB15

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 375 336654-336667 376 33666a-33666f 375->376 376->376 377 336671-336685 call 33a064 376->377 380 336691-3366b3 CreateFileW 377->380 381 336687-33668b 377->381 382 3367b6-3367b8 380->382 383 3366b9-3366bb 380->383 381->380 381->382 385 3367bb-3367be 382->385 384 3366be-3366e7 NtAllocateVirtualMemory 383->384 386 3366e9-3366f4 384->386 387 3366ef 384->387 388 3367c0-3367d9 NtFreeVirtualMemory 385->388 389 3367df-3367e3 385->389 396 336707-33670a 386->396 397 3366f6-336705 386->397 392 33671f-336724 387->392 388->389 389->385 390 3367e5-3367e9 389->390 394 3367f4-33680b call 336544 DeleteFileW 390->394 395 3367eb-3367ee NtClose 390->395 393 336727-336732 392->393 398 336740 393->398 399 336734-33673e 393->399 407 336814-336818 394->407 408 33680d 394->408 395->394 401 336719-33671d 396->401 402 33670c-336714 call 336614 396->402 397->401 403 336745-33674c 398->403 399->403 401->384 401->392 402->401 406 33674f-336765 WriteFile 403->406 409 336767 406->409 410 336769-336786 SetFilePointerEx 406->410 411 336822-33682b 407->411 412 33681a-33681d call 33684c 407->412 408->407 413 336788-33678f 409->413 410->406 410->413 412->411 415 336793-3367b1 413->415 416 336791 413->416 415->393 416->382
                                          APIs
                                          • CreateFileW.KERNELBASE(003377A6,40000000,00000003,00000000,00000003,80000000,00000000,003377A6,?,?,00000000,?), ref: 003366A6
                                          • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00010000,00001000,00000004,?,00000000,?), ref: 003366DF
                                          • WriteFile.KERNELBASE(000000FF,00000000,00010000,00010000,00000000,?,00000000,?), ref: 0033675D
                                          • SetFilePointerEx.KERNELBASE(000000FF,00010000,?,00000000,00000001,?,00000000,?), ref: 00336779
                                          • NtFreeVirtualMemory.NTDLL(000000FF,?,00010000,00008000,?,00000000,?), ref: 003367D9
                                          • NtClose.NTDLL(000000FF,?,00000000,?), ref: 003367EE
                                          • DeleteFileW.KERNELBASE(?,000000FF,?,?,00000000,?), ref: 00336803
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: File$MemoryVirtual$AllocateCloseCreateDeleteFreePointerWrite
                                          • String ID: <u3
                                          • API String ID: 3569053182-1067985219
                                          • Opcode ID: e98edec7b3a82156c2f822f9083feace6706933cfe3e96cc5d4d13484fcc1308
                                          • Instruction ID: 5311184711ff07b42144d2230c0a9250107cb53e06171aad39371f01d49dc74a
                                          • Opcode Fuzzy Hash: e98edec7b3a82156c2f822f9083feace6706933cfe3e96cc5d4d13484fcc1308
                                          • Instruction Fuzzy Hash: 53514E71900209BFDF12CFA4CC86BEEBBB9EB04369F604225F511B60A0D7755E95CB61

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 418 33a65c-33a6dc GetVolumeNameForVolumeMountPointW FindFirstVolumeW 422 33a6e2-33a6e8 418->422 423 33a920-33a925 418->423 424 33a8ef-33a911 422->424 425 33a6ee-33a6f5 422->425 424->422 432 33a917 424->432 425->424 426 33a6fb-33a712 GetVolumePathNamesForVolumeNameW 425->426 426->424 428 33a718-33a71c 426->428 428->424 429 33a722-33a726 428->429 429->424 431 33a72c-33a736 GetDriveTypeW 429->431 433 33a741-33a749 call 331574 431->433 434 33a738-33a73b 431->434 432->423 437 33a7c7-33a7ed call 331700 CreateFileW 433->437 438 33a74b-33a793 433->438 434->424 434->433 442 33a7f3-33a819 DeviceIoControl 437->442 443 33a8e6 437->443 448 33a7b3-33a7b7 438->448 449 33a795-33a7ae call 33a5d0 438->449 442->443 444 33a81f-33a826 442->444 443->424 446 33a828-33a834 444->446 447 33a88c-33a893 444->447 451 33a853-33a859 446->451 452 33a836-33a83d 446->452 447->443 450 33a895-33a89c 447->450 453 33a7c2 448->453 454 33a7b9 448->454 449->448 450->443 455 33a89e-33a8a5 450->455 458 33a85b-33a862 451->458 459 33a878-33a885 call 3316d0 call 33a5d0 451->459 452->451 456 33a83f-33a846 452->456 453->424 454->453 455->443 461 33a8a7-33a8c1 call 3316d0 455->461 456->451 462 33a848-33a84f 456->462 458->459 464 33a864-33a86b 458->464 471 33a88a 459->471 474 33a8c3-33a8ca 461->474 475 33a8da-33a8e1 call 33a5d0 461->475 462->451 467 33a851 462->467 464->459 468 33a86d-33a874 464->468 467->471 468->459 472 33a876 468->472 471->443 472->471 477 33a8d8 474->477 478 33a8cc-33a8d3 call 33a5d0 474->478 475->443 477->443 478->477
                                          APIs
                                          • GetVolumeNameForVolumeMountPointW.KERNELBASE(?,?,00000104), ref: 0033A6A6
                                          • FindFirstVolumeW.KERNELBASE(?,00000104), ref: 0033A6CF
                                          • GetVolumePathNamesForVolumeNameW.KERNELBASE(?,?,00000040,00000000), ref: 0033A70A
                                          • GetDriveTypeW.KERNELBASE(?), ref: 0033A72D
                                          • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?), ref: 0033A7E0
                                          • DeviceIoControl.KERNELBASE(000000FF,00070048,00000000,00000000,?,00000090,00000001,00000000), ref: 0033A811
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Volume$Name$ControlCreateDeviceDriveFileFindFirstMountNamesPathPointType
                                          • String ID: '
                                          • API String ID: 754975672-1997036262
                                          • Opcode ID: 81b74a458e04ddce09a1923edeea3c9e859356fbf153e5a3f42d585fcf632668
                                          • Instruction ID: 58d113a59cf764318a1995a559dcb1875259115e2b4d115005725680f257a648
                                          • Opcode Fuzzy Hash: 81b74a458e04ddce09a1923edeea3c9e859356fbf153e5a3f42d585fcf632668
                                          • Instruction Fuzzy Hash: 8F719C70800B14EFEB329B50DC89F9A7F7CAF02316F1580A5E185AA0B1E7746A85DF57

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 480 33c354-33c36e 481 33c5a7-33c5b0 480->481 482 33c374-33c389 call 336db0 480->482 482->481 485 33c38f-33c3a5 call 336830 482->485 488 33c5a1-33c5a2 call 33684c 485->488 489 33c3ab-33c3bc call 348ba4 485->489 488->481 493 33c3c2-33c443 call 3316d0 CreateFileW 489->493 494 33c59b-33c59c call 33684c 489->494 493->494 500 33c449-33c45e WriteFile 493->500 494->488 501 33c592 500->501 502 33c464-33c487 RegCreateKeyExW 500->502 501->494 502->501 503 33c48d-33c4b9 RegSetValueExW 502->503 505 33c589-33c58c NtClose 503->505 506 33c4bf-33c538 RegCreateKeyExW 503->506 505->501 506->505 509 33c53a-33c56c RegSetValueExW 506->509 509->505 511 33c56e-33c582 SHChangeNotify 509->511 511->505
                                          APIs
                                            • Part of subcall function 00336830: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,003476B5,?,00000000,00000000), ref: 00336841
                                          • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0033C436
                                          • WriteFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0033C456
                                          • RegCreateKeyExW.KERNELBASE(80000000,?,00000000,00000000,00000000,00020106,00000000,?,00000000), ref: 0033C47F
                                          • RegSetValueExW.KERNELBASE(?,00000000,00000000,00000001,?,00000000), ref: 0033C4B1
                                          • RegCreateKeyExW.KERNELBASE(80000000,?,00000000,00000000,00000000,00020106,00000000,?,00000000), ref: 0033C530
                                          • RegSetValueExW.KERNELBASE(?,00000000,00000000,00000001,?,00000000), ref: 0033C564
                                          • SHChangeNotify.SHELL32(08000000,00001000,00000000,00000000), ref: 0033C57C
                                          • NtClose.NTDLL(?), ref: 0033C58C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Create$FileValue$AllocateChangeCloseHeapNotifyWrite
                                          • String ID:
                                          • API String ID: 1108940941-0
                                          • Opcode ID: 1d4edd97c4b8c0288f330b940a8e7a49d42d4945775e126746ac9f70a70644de
                                          • Instruction ID: 597c3f2f124e539604c2e83bb44d8c9513de9767b153a08518b257d4ebf3f8f2
                                          • Opcode Fuzzy Hash: 1d4edd97c4b8c0288f330b940a8e7a49d42d4945775e126746ac9f70a70644de
                                          • Instruction Fuzzy Hash: E9517171A00309BBEB119FA1DC8AFAEBB7CFB04706F504114F605AA1A0D7B1BA54CB94

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 563 33c1e8-33c213 CreateFileW 564 33c349-33c34f 563->564 565 33c219-33c232 563->565 566 33c238-33c24a call 3317bc 565->566 569 33c251-33c274 WriteFile 566->569 570 33c276-33c285 569->570 571 33c288-33c2ad WriteFile 569->571 572 33c2c1-33c2e4 WriteFile 571->572 573 33c2af-33c2be 571->573 575 33c2e6-33c2f5 572->575 576 33c2f8-33c31d WriteFile 572->576 577 33c331-33c33e 576->577 578 33c31f-33c32e NtClose 576->578 577->569 580 33c344 577->580 580->566
                                          APIs
                                          • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000), ref: 0033C206
                                          • WriteFile.KERNELBASE(000000FF,?,00000001,00000000,00000000,Function_00026000,?,?,?,00000000), ref: 0033C267
                                          • WriteFile.KERNELBASE(000000FF,?,00000001,00000000,00000000,?,?,00000000), ref: 0033C2A0
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: File$Write$Create
                                          • String ID:
                                          • API String ID: 1602526932-0
                                          • Opcode ID: a7af094fe3118bfb0c693ea07d9e54160e88926b7d7c034b63add2b601c45cd8
                                          • Instruction ID: 5bc8dd77764ee8a572bbb61680aa85feeef8e52fc1f00571af73bc4d18af2ede
                                          • Opcode Fuzzy Hash: a7af094fe3118bfb0c693ea07d9e54160e88926b7d7c034b63add2b601c45cd8
                                          • Instruction Fuzzy Hash: 34413C32A0020CEFDB01DBD4EC45BEEFB7AEB54322F5081A6E604F21A1E7715A54DB91

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 582 33ddd4-33dde5 SetThreadPriority 583 33ddeb-33de0a 582->583 585 33de3a-33de3c 583->585 586 33de0c-33de14 583->586 588 33de42-33de47 585->588 589 33de3e-33de41 585->589 586->585 587 33de16 586->587 592 33de1d-33de32 587->592 590 33de4d-33de7f ReadFile 588->590 591 33defc-33deff 588->591 593 33def2 590->593 594 33de81-33de8c 590->594 595 33df05-33df4a call 3320bc 591->595 596 33dffd-33e000 591->596 606 33de36 592->606 607 33de34-33de38 592->607 597 33e0dc-33e0fb 593->597 594->593 598 33de8e-33de96 594->598 636 33df63-33df6b 595->636 637 33df4c-33df61 595->637 600 33e006-33e045 WriteFile 596->600 601 33e08d-33e090 596->601 618 33e0ff-33e107 597->618 619 33e0fd 597->619 602 33deb4-33dedb 598->602 603 33de98-33deb2 598->603 608 33e047-33e052 600->608 609 33e089 600->609 601->597 605 33e092-33e096 601->605 638 33deee 602->638 639 33dedd-33dee8 602->639 603->593 612 33e098-33e09e 605->612 613 33e0ac-33e0ca NtClose call 331094 call 33684c 605->613 606->592 607->583 608->609 615 33e054-33e072 608->615 609->597 620 33e0a2-33e0aa 612->620 621 33e0a0 612->621 641 33e0cf-33e0da 613->641 648 33e085 615->648 649 33e074-33e07f 615->649 624 33e109 618->624 625 33e12d 618->625 626 33e12f-33e131 619->626 620->612 621->613 629 33e110-33e125 624->629 625->597 625->626 631 33e133-33e136 626->631 632 33e137 626->632 653 33e127-33e12b 629->653 654 33e129 629->654 632->588 644 33df7a-33df86 636->644 645 33df6d-33df6f 636->645 643 33df8d-33dfa9 WriteFile 637->643 638->593 646 33deea 639->646 647 33deec 639->647 641->597 658 33e13c 641->658 656 33dff3 643->656 657 33dfab-33dfb6 643->657 644->643 645->644 655 33df71-33df78 645->655 646->593 647->602 648->609 650 33e083 649->650 651 33e081 649->651 650->615 651->609 653->597 654->629 655->643 656->597 657->656 660 33dfb8-33dfdc 657->660 658->583 663 33dfef 660->663 664 33dfde-33dfe9 660->664 663->656 665 33dfeb 664->665 666 33dfed 664->666 665->656 666->660
                                          APIs
                                          • SetThreadPriority.KERNELBASE(000000FE,00000002), ref: 0033DDE5
                                          • ReadFile.KERNELBASE(?,?,?,?,?), ref: 0033DE77
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: FilePriorityReadThread
                                          • String ID:
                                          • API String ID: 3643687941-0
                                          • Opcode ID: 3bd03fb96ef8d06c60dc20794adc932d310f9a6ae5783d7a6bc6820dd042c370
                                          • Instruction ID: c11f6ea904d364e6e7b847ade4b9f2745061427ff897d107e206f608a26de442
                                          • Opcode Fuzzy Hash: 3bd03fb96ef8d06c60dc20794adc932d310f9a6ae5783d7a6bc6820dd042c370
                                          • Instruction Fuzzy Hash: 66A16971500604EFDF238F50DCC4BAA7BBCFB14705F2142A2E9068E5A6E770AA44DB51

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 667 33f264-33f27b GetFileAttributesW 668 33f2db-33f2ed SetThreadPriority call 331574 667->668 669 33f27d-33f289 call 33bb50 667->669 676 33f2f8 668->676 677 33f2ef-33f2f6 668->677 674 33f28b-33f299 call 33a064 669->674 675 33f2cd-33f2d8 call 33684c 669->675 674->675 685 33f29b-33f29f 674->685 680 33f2ff-33f312 call 336830 676->680 677->680 686 33f319-33f359 call 33c0f8 call 33f0c0 call 33684c FindFirstFileExW 680->686 687 33f2a1-33f2a5 685->687 688 33f2a7-33f2ca call 33c0f8 call 337260 call 33eec8 685->688 701 33f491-33f4a6 call 33684c 686->701 702 33f35f-33f36d 686->702 687->675 687->688 706 33f4aa-33f4be 701->706 707 33f4a8-33f4c6 call 33684c 701->707 708 33f372-33f37b 702->708 706->686 718 33f4cb-33f4ce 707->718 710 33f385 708->710 711 33f37d-33f383 708->711 714 33f470-33f482 FindNextFileW 710->714 711->710 713 33f38a-33f394 711->713 715 33f396 713->715 716 33f39b-33f3a2 713->716 714->708 717 33f488-33f48b FindClose 714->717 715->714 719 33f3a4-33f3a8 716->719 720 33f3af-33f3b3 716->720 717->701 719->720 721 33f3aa 719->721 722 33f3b5-33f3bd call 33f210 720->722 723 33f3dd-33f3e5 call 33f178 720->723 721->714 728 33f3d8 722->728 729 33f3bf-33f3c3 call 33f124 722->729 730 33f3e7 723->730 731 33f3ec-33f3f3 723->731 728->714 737 33f3c8-33f3d6 729->737 730->714 732 33f400-33f40a call 33bb50 731->732 733 33f3f5-33f3fc 731->733 739 33f40e-33f42c call 33f124 call 337260 call 33eec8 732->739 740 33f40c 732->740 733->732 735 33f3fe 733->735 735->714 737->728 746 33f431-33f438 739->746 740->714 746->714 747 33f43a-33f43c 746->747 748 33f465 747->748 749 33f43e-33f463 747->749 748->714 749->714
                                          APIs
                                          • GetFileAttributesW.KERNELBASE(?), ref: 0033F270
                                          • SetThreadPriority.KERNELBASE(000000FE,00000002), ref: 0033F2DF
                                          • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000,?,?,?,00355180,003D0900), ref: 0033F34C
                                          • FindNextFileW.KERNELBASE(000000FF,?), ref: 0033F47A
                                          • FindClose.KERNELBASE(000000FF), ref: 0033F48B
                                            • Part of subcall function 0033A064: FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 0033A086
                                            • Part of subcall function 0033A064: FindClose.KERNELBASE(000000FF), ref: 0033A0AC
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Find$File$CloseFirst$AttributesNextPriorityThread
                                          • String ID:
                                          • API String ID: 3755735135-0
                                          • Opcode ID: 984d3855362aad54e6d5a76491a2ab47e43e5baaf082362fa699d24bc2f76154
                                          • Instruction ID: 825b2434d3546b816e18e12d2d7ff702ca7853977d31e0cbe46eb1c51aad91cc
                                          • Opcode Fuzzy Hash: 984d3855362aad54e6d5a76491a2ab47e43e5baaf082362fa699d24bc2f76154
                                          • Instruction Fuzzy Hash: B7619A34C00609EFDF23AF60CC86BAEBB79AF05316F904171F811AA1B1DB759A95DB41

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 751 33e3b8-33e3f6 SetFileAttributesW CreateFileW 752 33e3f8-33e415 SetFilePointerEx 751->752 753 33e46d-33e474 751->753 754 33e417-33e434 ReadFile 752->754 755 33e464-33e467 NtClose 752->755 754->755 756 33e436-33e44b call 33e2ac 754->756 755->753 756->755 759 33e44d-33e455 756->759 760 33e457 759->760 761 33e45e-33e45f call 33684c 759->761 760->761 761->755
                                          APIs
                                          • SetFileAttributesW.KERNELBASE(00000000,00000080,?), ref: 0033E3D1
                                          • CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0033E3E9
                                          • SetFilePointerEx.KERNELBASE(000000FF,-00000084,00000000,00000000,00000002), ref: 0033E40D
                                          • ReadFile.KERNELBASE(000000FF,?,00000084,?,00000000), ref: 0033E42C
                                          • NtClose.NTDLL(000000FF), ref: 0033E467
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: File$AttributesCloseCreatePointerRead
                                          • String ID:
                                          • API String ID: 462290678-0
                                          • Opcode ID: 2ff863d639b63f97c0017dea626297711da6737120d436f6e1b05624823c160a
                                          • Instruction ID: 211f15edce7188dff5b4076611928f5c06f59835c1e4420a9519e18a3bd860de
                                          • Opcode Fuzzy Hash: 2ff863d639b63f97c0017dea626297711da6737120d436f6e1b05624823c160a
                                          • Instruction Fuzzy Hash: EE111F71640309FBEF229FA5DC85F997BBDBB08701F508164B605EA0E1EB71AA548B14

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 763 33763c-337663 765 3377f2-3377f7 763->765 766 337669-33767d call 336830 763->766 769 337683-3376d0 call 3316d0 FindFirstFileExW 766->769 770 3377d6-3377da 766->770 769->770 780 3376d6-3376df 769->780 771 3377e4-3377e8 770->771 772 3377dc-3377df call 33684c 770->772 771->765 774 3377ea-3377ed call 33684c 771->774 772->771 774->765 781 3377b5-3377c7 FindNextFileW 780->781 782 3376e5-3376eb 780->782 781->780 784 3377cd 781->784 782->781 783 3376f1-33771f call 336830 782->783 783->781 789 337725-337761 GetFileAttributesW 783->789 784->770 793 337763-33776e 789->793 794 33779e-3377a1 call 336654 789->794 799 337772-33777d 793->799 800 337770 793->800 796 3377a6-3377ae call 33684c 794->796 796->781 803 337789 799->803 804 33777f-33778b call 33763c 799->804 802 33778d-33779c call 33684c 800->802 802->781 803->802 804->793
                                          APIs
                                            • Part of subcall function 00336830: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,003476B5,?,00000000,00000000), ref: 00336841
                                          • FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 003376C3
                                          • GetFileAttributesW.KERNELBASE(00000000), ref: 00337756
                                          • FindNextFileW.KERNELBASE(000000FF,?), ref: 003377BF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: File$Find$AllocateAttributesFirstHeapNext
                                          • String ID: <u3
                                          • API String ID: 2400493143-1067985219
                                          • Opcode ID: 78368f8442820333570fe6c7339d392f806c03b0e032fc29349b1611ee260502
                                          • Instruction ID: bb29028ef2e45417da242a195df89e87df346d7538d64cccdfdb490d9aadc60c
                                          • Opcode Fuzzy Hash: 78368f8442820333570fe6c7339d392f806c03b0e032fc29349b1611ee260502
                                          • Instruction Fuzzy Hash: 8C413CB0C04218EFDF236FA4DC8ABAEBB79BF04346F504560E411A50B1E7766AA4DF51

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 810 335c34-335c45 811 335c47-335c61 call 335afc 810->811 812 335c66-335c6d 810->812 811->812 813 335c6f-335c89 call 335afc 812->813 814 335c8e-335c95 812->814 813->814 817 335c97-335cb1 call 335afc 814->817 818 335cb6-335cbd call 331668 814->818 817->818 824 335cc2-335cc6 818->824 825 335cc8-335cf2 call 331250 824->825 826 335ced-335cf0 824->826 830 335cf9-335d14 FindFirstFileW 825->830 826->824 831 335d16-335d27 call 3311d4 830->831 832 335d64-335d68 830->832 840 335d47-335d59 FindNextFileW 831->840 841 335d29-335d3b FindClose call 335a30 831->841 834 335d6a-335dac 832->834 835 335d6c-335d76 832->835 838 335d9b-335d9e 835->838 839 335d78-335d7d 835->839 838->830 842 335d96-335d99 839->842 843 335d7f-335d94 call 331250 839->843 840->831 845 335d5b-335d5e FindClose 840->845 847 335d40-335d44 841->847 842->839 843->838 845->832
                                          APIs
                                          • FindFirstFileW.KERNELBASE(?,?,?,00000004,?), ref: 00335D07
                                          • FindClose.KERNELBASE(000000FF,?,00000000), ref: 00335D2C
                                          • FindNextFileW.KERNELBASE(000000FF,?,?,00000000), ref: 00335D51
                                          • FindClose.KERNELBASE(000000FF), ref: 00335D5E
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Find$CloseFile$FirstNext
                                          • String ID:
                                          • API String ID: 1164774033-0
                                          • Opcode ID: d1ae322e80cf1f3e6887e3abaf51d73c6bd23eca31f10fc2605e283a98dc5478
                                          • Instruction ID: 303f99bf74862fc6df7ca2d00f9761dbfa7c194e31c5012d1220e2de6fe8e565
                                          • Opcode Fuzzy Hash: d1ae322e80cf1f3e6887e3abaf51d73c6bd23eca31f10fc2605e283a98dc5478
                                          • Instruction Fuzzy Hash: 91417CB1840B08EFCB23AF61DCD9BA9BB7CEB10306F6085A5E4049E171E7745AC5DB50
                                          APIs
                                          • NtSetInformationProcess.NTDLL(000000FF,00000021,00000000,00000004,00000004,00000000,0034712D), ref: 0033B6AD
                                          • NtSetInformationProcess.NTDLL(000000FF,00000012,00000000,00000002), ref: 0033B6BF
                                          • NtSetInformationProcess.NTDLL(000000FF,0000000C,00000000,00000004), ref: 0033B6D4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: InformationProcess
                                          • String ID:
                                          • API String ID: 1801817001-0
                                          • Opcode ID: daf39a1c01167a465b81cfd2c0598117b1a2628f551df7c6226aa42c0ae53f52
                                          • Instruction ID: b9635c0e5287db6607486c33a65538818a345093c3b2d0c37701ed37c3f273d7
                                          • Opcode Fuzzy Hash: daf39a1c01167a465b81cfd2c0598117b1a2628f551df7c6226aa42c0ae53f52
                                          • Instruction Fuzzy Hash: 7AF01CB1240714BFFB22AB94CCC6F15379C9B0A722F100360B731DE1E6D7B094448762
                                          APIs
                                            • Part of subcall function 00336830: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,003476B5,?,00000000,00000000), ref: 00336841
                                          • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00337E4E
                                          • Sleep.KERNELBASE(000007D0,?), ref: 00337F15
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateHeapInformationQuerySleepSystem
                                          • String ID:
                                          • API String ID: 3184523392-0
                                          • Opcode ID: 9e919bcc88e65e1e90afc2cba440672059829bc611563fbe81c5f570fd4ce55e
                                          • Instruction ID: 6b825b68c6b536d12201e9237294445207b79014698ea9d1bac907aaad01a469
                                          • Opcode Fuzzy Hash: 9e919bcc88e65e1e90afc2cba440672059829bc611563fbe81c5f570fd4ce55e
                                          • Instruction Fuzzy Hash: 7D213BB1904208FFDF129FA0DC85BDEBBB9FF04305F608095E914AA161D7769A45DF90
                                          APIs
                                          • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00338F5A
                                            • Part of subcall function 003397A8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 003397D5
                                            • Part of subcall function 00339850: NtClose.NTDLL(00000000), ref: 00339941
                                          • NtSetInformationThread.NTDLL(000000FE,00000005,00000000,00000004,00000000,00000002,00000002,89F9D59D), ref: 00338F91
                                            • Part of subcall function 00338D78: OpenSCManagerW.SECHOST(00000000,00000000,00000001,25DD2DA4), ref: 00338DB6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Information$AdjustCloseManagerOpenPrivilegeQuerySystemThread
                                          • String ID:
                                          • API String ID: 1903255304-0
                                          • Opcode ID: 553f3b676fb70f7406267359b80d49af2cb7d561fbfd5cd5e7e6b2dbc14fe84b
                                          • Instruction ID: af136a08df0e60c1a66a2ece56e62d2ea9b1d2f41119c25b89f9fea0da8be68c
                                          • Opcode Fuzzy Hash: 553f3b676fb70f7406267359b80d49af2cb7d561fbfd5cd5e7e6b2dbc14fe84b
                                          • Instruction Fuzzy Hash: 19219670904308FBEB12ABA4DC8EF9E7BB99F00706F514154B614BA1E0EBB49A84C751
                                          APIs
                                          • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00338F5A
                                            • Part of subcall function 003397A8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 003397D5
                                            • Part of subcall function 00339850: NtClose.NTDLL(00000000), ref: 00339941
                                          • NtSetInformationThread.NTDLL(000000FE,00000005,00000000,00000004,00000000,00000002,00000002,89F9D59D), ref: 00338F91
                                            • Part of subcall function 00338D78: OpenSCManagerW.SECHOST(00000000,00000000,00000001,25DD2DA4), ref: 00338DB6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Information$AdjustCloseManagerOpenPrivilegeQuerySystemThread
                                          • String ID:
                                          • API String ID: 1903255304-0
                                          • Opcode ID: d21853298a11e96ab98fb4db4e41a7c4d568043c144a119a10ce2169957f3bf2
                                          • Instruction ID: 7fd635766af7dd7ea11d23f68df1e2ff8a00ed35a3aa7b1f5076b1d1dff6acc7
                                          • Opcode Fuzzy Hash: d21853298a11e96ab98fb4db4e41a7c4d568043c144a119a10ce2169957f3bf2
                                          • Instruction Fuzzy Hash: A8219670904308FBEB12ABA4DC8EF9E7BB99F00706F514154B614BA1E0EBB49A84C751
                                          APIs
                                            • Part of subcall function 00337560: FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 003375CF
                                            • Part of subcall function 00337560: FindClose.KERNELBASE(000000FF), ref: 0033762C
                                          • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 003374EF
                                          • FindNextFileW.KERNELBASE(000000FF,?), ref: 00337546
                                            • Part of subcall function 0033763C: FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 003376C3
                                            • Part of subcall function 0033763C: GetFileAttributesW.KERNELBASE(00000000), ref: 00337756
                                            • Part of subcall function 0033763C: FindNextFileW.KERNELBASE(000000FF,?), ref: 003377BF
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: FileFind$First$Next$AttributesClose
                                          • String ID:
                                          • API String ID: 95010735-0
                                          • Opcode ID: d4284eeca469db7b74d5ca6e26566859223401d7fbfe032b072ab94f125c634c
                                          • Instruction ID: 0d9191b3ecfab78340bb7ebbfa51af3ab4834cb54d8c2dd50762b9d0416aa497
                                          • Opcode Fuzzy Hash: d4284eeca469db7b74d5ca6e26566859223401d7fbfe032b072ab94f125c634c
                                          • Instruction Fuzzy Hash: 94212EB194020DABDB21EFA0DD49FD9B77CAB15302F4004A1BA09E61A1E735AB54CF62
                                          APIs
                                          • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 003375CF
                                          • FindClose.KERNELBASE(000000FF), ref: 0033762C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Find$CloseFileFirst
                                          • String ID:
                                          • API String ID: 2295610775-0
                                          • Opcode ID: e964e0c5082a2bebf29b723043504ac2dd9f23a5422373f980ae21855b5c996a
                                          • Instruction ID: 1258d3bb3044bd2d98d3fd8c164849f93cbe6c64f77314e8be724a84d10af898
                                          • Opcode Fuzzy Hash: e964e0c5082a2bebf29b723043504ac2dd9f23a5422373f980ae21855b5c996a
                                          • Instruction Fuzzy Hash: DF213BB0800208EFDB219F94DD5DB9CBBBDFB04306F1041A1E909AA1B1E775AA98CF55
                                          APIs
                                          • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00337E4E
                                          • Sleep.KERNELBASE(000007D0,?), ref: 00337F15
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: InformationQuerySleepSystem
                                          • String ID:
                                          • API String ID: 3518162127-0
                                          • Opcode ID: e0058acfdc5f519e84f0f4c91f14f3125c888be9b3c2c7e4d555cc9b3fecedcf
                                          • Instruction ID: 1236efb1a2b4243d3381df6160906b0f2529700148aeff4eb1d0de5279d00523
                                          • Opcode Fuzzy Hash: e0058acfdc5f519e84f0f4c91f14f3125c888be9b3c2c7e4d555cc9b3fecedcf
                                          • Instruction Fuzzy Hash: C9213DB1904208EFDF12DF90CC84BDEBBB9FF04305F208099E905AA161D7769A45DF90
                                          APIs
                                          • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00337E4E
                                          • Sleep.KERNELBASE(000007D0,?), ref: 00337F15
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: InformationQuerySleepSystem
                                          • String ID:
                                          • API String ID: 3518162127-0
                                          • Opcode ID: 8839bcd00704c7193c19482057b89924df64e029c06e7a7e3a92129581e1fc5a
                                          • Instruction ID: 1236efb1a2b4243d3381df6160906b0f2529700148aeff4eb1d0de5279d00523
                                          • Opcode Fuzzy Hash: 8839bcd00704c7193c19482057b89924df64e029c06e7a7e3a92129581e1fc5a
                                          • Instruction Fuzzy Hash: C9213DB1904208EFDF12DF90CC84BDEBBB9FF04305F208099E905AA161D7769A45DF90
                                          APIs
                                          • CreateThread.KERNELBASE(00000000,00000000,0033DDD4,00000000,00000000,00000000,?,00000000), ref: 0033E195
                                          • NtClose.NTDLL(00000000,00000000,?,00000000), ref: 0033E1A8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: CloseCreateThread
                                          • String ID:
                                          • API String ID: 562768112-0
                                          • Opcode ID: def95b474c607dff6af1dfc004ef51d5617bde48c2092c00a060cf5a44705594
                                          • Instruction ID: 779c33c9fd7a507996ac0eba96593b6141ecbf0ee1720a6400ac5db22ec2f2f0
                                          • Opcode Fuzzy Hash: def95b474c607dff6af1dfc004ef51d5617bde48c2092c00a060cf5a44705594
                                          • Instruction Fuzzy Hash: 7601D630B40B15EBE723AB54ECD6B8D7268EB04B16F600210FE01A62F1EBB079048694
                                          APIs
                                          • NtSetInformationThread.NTDLL(000000FE,00000005,00000008,00000004), ref: 0033B3F4
                                          • NtClose.NTDLL(00000008), ref: 0033B402
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: CloseInformationThread
                                          • String ID:
                                          • API String ID: 3167811113-0
                                          • Opcode ID: 7529c147196487449b5c74b76cc76391f86e381cb92713fcda697d4d7e5b52f0
                                          • Instruction ID: 29cde3f27aa021441ce68ca16042da84bd98db09f1d0136aadf345a864d8073a
                                          • Opcode Fuzzy Hash: 7529c147196487449b5c74b76cc76391f86e381cb92713fcda697d4d7e5b52f0
                                          • Instruction Fuzzy Hash: E6018FB4500208EFEB01CF51CC99FAAFBBCFB00315F518164EA049B1A1E3B59A48DBA0
                                          APIs
                                          • GetLogicalDriveStringsW.KERNELBASE(00000104,?), ref: 0033744F
                                          • GetDriveTypeW.KERNELBASE(?), ref: 00337465
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Drive$LogicalStringsType
                                          • String ID:
                                          • API String ID: 1630765265-0
                                          • Opcode ID: 60b52678d00a4ef5681c62e22b8954fa1debe8ef754805031ab0e3067a65dfbc
                                          • Instruction ID: e684cdfd00e3eb302e89322001cebd6ff8671b1fce7df8310ece587ddbe319ae
                                          • Opcode Fuzzy Hash: 60b52678d00a4ef5681c62e22b8954fa1debe8ef754805031ab0e3067a65dfbc
                                          • Instruction Fuzzy Hash: 84E02BB250571D67CB32A6D66CC59EB779CCB05301F000690EE55D2011DB50BD86C6D1
                                          APIs
                                          • FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 0033A086
                                          • FindClose.KERNELBASE(000000FF), ref: 0033A0AC
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Find$CloseFileFirst
                                          • String ID:
                                          • API String ID: 2295610775-0
                                          • Opcode ID: 70696d34cf56ebe9a9940de4eb3cdf243290c838bd64eeb81d17cb514a8a34ba
                                          • Instruction ID: 20f3b9e81005dc243217f59d90ad741c5a229bd88e58fea31a5dc2f09337caed
                                          • Opcode Fuzzy Hash: 70696d34cf56ebe9a9940de4eb3cdf243290c838bd64eeb81d17cb514a8a34ba
                                          • Instruction Fuzzy Hash: D5F03A74901308EFDB20DF94CC49B9CBBB4EB45311F208295A819AB3A0E7716F91CF44
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Close
                                          • String ID:
                                          • API String ID: 3535843008-0
                                          • Opcode ID: 602c7bb2da37470db00005253f3a7916587b9d22e6daa9c55d963094bd41f171
                                          • Instruction ID: 87d3eda2868119e4a487066ee41e1e33d75065305bf67e7ce80ecdc3f230c055
                                          • Opcode Fuzzy Hash: 602c7bb2da37470db00005253f3a7916587b9d22e6daa9c55d963094bd41f171
                                          • Instruction Fuzzy Hash: 22319CB090020CEFEB01CF95D898BDEBBB8FB04319F508159E415BA290D7B69A49DF95
                                          APIs
                                            • Part of subcall function 00336830: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,003476B5,?,00000000,00000000), ref: 00336841
                                          • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 003397D5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateHeapInformationQuerySystem
                                          • String ID:
                                          • API String ID: 3114120137-0
                                          • Opcode ID: 291b5d1092b75e2902def4e9b3d02635f061db0cbbf2281c938bbc9b94b99612
                                          • Instruction ID: 16bc6f6eb7f3f679ed004d80436ce969c10368465fe8ab7a8b38a32e363f9ebd
                                          • Opcode Fuzzy Hash: 291b5d1092b75e2902def4e9b3d02635f061db0cbbf2281c938bbc9b94b99612
                                          • Instruction Fuzzy Hash: C2110675D00108FFDF129F95D8C1BDDBB78EF09314F6081A6EA14AA161D7B25A90EB90
                                          APIs
                                          • NtQueryInformationToken.NTDLL(00000000,00000001,?,00000028,?,00000000), ref: 00336CA7
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: InformationQueryToken
                                          • String ID:
                                          • API String ID: 4239771691-0
                                          • Opcode ID: 40806784c338af0c64dc362a16d226ea9adc03a81e3821afb1b53e1d8e98ab9a
                                          • Instruction ID: 6dada3dd5b634065925a9dd56e2c519b2ef58b0289f6551060d397bba38085f8
                                          • Opcode Fuzzy Hash: 40806784c338af0c64dc362a16d226ea9adc03a81e3821afb1b53e1d8e98ab9a
                                          • Instruction Fuzzy Hash: E5113A70900209FFDF12DF90DC8ABAEBBBCFB04306F508165E954A61A0D771AA98DB51
                                          APIs
                                          • LdrLoadDll.NTDLL(00000000,00000000,00000000,?), ref: 00335A81
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Load
                                          • String ID:
                                          • API String ID: 2234796835-0
                                          • Opcode ID: c57a7e4caae471f1a8fbb6077d1f532fe93389dabfac6411de35b5a6c434f8cb
                                          • Instruction ID: a4e699851567a6bc3ab51a093d876cd0d680352f2d983ac7e809ba408d4d2865
                                          • Opcode Fuzzy Hash: c57a7e4caae471f1a8fbb6077d1f532fe93389dabfac6411de35b5a6c434f8cb
                                          • Instruction Fuzzy Hash: 31F03C3690020DFACF11EEA4D888FDEB7BCEB04315F5041A2E908E7040D634AB489BA0
                                          APIs
                                          • NtQueryInformationToken.NTDLL(?,00000001,?,0000002C,?), ref: 0033B5FA
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: InformationQueryToken
                                          • String ID:
                                          • API String ID: 4239771691-0
                                          • Opcode ID: 5d54bb34828a69ab3c692d0b4d37b7f29f99ebb1baa93a8e52c5446c1ca3cfc9
                                          • Instruction ID: 586db43f42e5433f02b9a5bff8c022aff4776799fe8fa3a0d032f24b11bffdc1
                                          • Opcode Fuzzy Hash: 5d54bb34828a69ab3c692d0b4d37b7f29f99ebb1baa93a8e52c5446c1ca3cfc9
                                          • Instruction Fuzzy Hash: 3FF05E71604208AFEB11CF95ECC6EA9B7BDFB04716FA10265FA14D31A1E761AE44CB10
                                          APIs
                                          • NtTerminateProcess.NTDLL(00337D88,00000000), ref: 0033DC1F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: ProcessTerminate
                                          • String ID:
                                          • API String ID: 560597551-0
                                          • Opcode ID: 5ce77ad73e8f820a324418bfe91a901c5b3aeeac54caa5963d3da83b6256b011
                                          • Instruction ID: 9c043061c6b6c230b2aec3c6ee10643a5de6c4746bf7f7f1dadbcbe68420177d
                                          • Opcode Fuzzy Hash: 5ce77ad73e8f820a324418bfe91a901c5b3aeeac54caa5963d3da83b6256b011
                                          • Instruction Fuzzy Hash: ED01ECB0900308EFDB01CF90D858BDEBBB8FB04319F508198E504AB291D7B69646CF91
                                          APIs
                                          • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 003397D5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: InformationQuerySystem
                                          • String ID:
                                          • API String ID: 3562636166-0
                                          • Opcode ID: dd7c0478c34a2ee7dc7e784a498649d40371418d98bc987ab2fa94058769db12
                                          • Instruction ID: d4571b36473aafb1cfbbdb35dd55c55467f2658cefbc8743c2445d770070ce54
                                          • Opcode Fuzzy Hash: dd7c0478c34a2ee7dc7e784a498649d40371418d98bc987ab2fa94058769db12
                                          • Instruction Fuzzy Hash: E5F03A39D04108FFCF129F80D8C0BACBB78EF19301F608093EA05AE550D3B1AA90EB11
                                          APIs
                                          • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 003397D5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: InformationQuerySystem
                                          • String ID:
                                          • API String ID: 3562636166-0
                                          • Opcode ID: e13a3a7d0b86625bc15fe0fd1a635e55e1f03ba1628347495ba1467abb1db8b3
                                          • Instruction ID: d4571b36473aafb1cfbbdb35dd55c55467f2658cefbc8743c2445d770070ce54
                                          • Opcode Fuzzy Hash: e13a3a7d0b86625bc15fe0fd1a635e55e1f03ba1628347495ba1467abb1db8b3
                                          • Instruction Fuzzy Hash: E5F03A39D04108FFCF129F80D8C0BACBB78EF19301F608093EA05AE550D3B1AA90EB11

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 95 338200-338259 96 338260-33826f 95->96 97 33825b 95->97 104 338271 96->104 105 338276-338286 96->105 98 338889-33888d 97->98 99 338898-33889c 98->99 100 33888f 98->100 102 33889e-3388a2 99->102 103 3388ad-3388b1 99->103 100->99 102->103 106 3388a4 102->106 107 3388b3 103->107 108 3388bc-3388c0 103->108 104->98 112 338288 105->112 113 33828d-33829d 105->113 106->103 107->108 110 3388c2 108->110 111 3388cb-3388cf 108->111 110->111 114 3388d1-3388d4 call 33684c 111->114 115 3388d9-3388dd 111->115 112->98 125 3382a4-3382bf call 340df4 113->125 126 33829f 113->126 114->115 116 3388e7-3388eb 115->116 117 3388df-3388e2 call 33684c 115->117 120 3388f6-3388fa 116->120 121 3388ed 116->121 117->116 123 338905-338909 120->123 124 3388fc 120->124 121->120 128 338914-338918 123->128 129 33890b 123->129 124->123 133 3382c1-3382e6 125->133 134 3382e9-338379 call 331250 125->134 126->98 131 338925-33892b 128->131 132 33891a-33891d 128->132 129->128 132->131 133->134 141 338380-33838e 134->141 142 33837b 134->142 144 338390 141->144 145 338395-3383a6 call 336830 141->145 142->98 144->98 148 3383a8 145->148 149 3383ad-3383b5 call 331574 145->149 148->98 152 3383d1-3383e2 call 336db0 149->152 153 3383b7-3383c8 call 336db0 149->153 158 3383e4 152->158 159 3383e9-338402 152->159 160 3383ca 153->160 161 3383cf 153->161 158->98 163 338404-338413 call 33684c 159->163 164 338418-33842b 159->164 160->98 161->159 163->98 168 338432-338448 164->168 169 33842d 164->169 171 33844a 168->171 172 33844f-33845d 168->172 169->98 171->98 174 338464-3384b7 call 331574 172->174 175 33845f 172->175 181 3384b9-3384c6 174->181 182 3384c8 174->182 175->98 183 3384cb-3384ec DrawTextW 181->183 182->183 184 3384f3-33859b 183->184 185 3384ee 183->185 189 3385a2-3385cf 184->189 190 33859d 184->190 185->98 193 3385d1 189->193 194 3385d6-33864f call 3316d0 call 331250 CreateFileW 189->194 190->98 193->98 202 338651 194->202 203 338656-338670 WriteFile 194->203 202->98 204 338672 203->204 205 338677-33868e WriteFile 203->205 204->98 206 338690 205->206 207 338695-3386ac WriteFile 205->207 206->98 208 3386b3-3386d7 call 336c60 207->208 209 3386ae 207->209 213 3386d9 208->213 214 3386de-338782 call 3316d0 call 331250 RegCreateKeyExW 208->214 209->98 213->98 220 338784 214->220 221 338789-3387e8 call 331250 RegSetValueExW 214->221 220->98 225 3387ea 221->225 226 3387ef-338870 call 331250 RegSetValueExW 221->226 225->98 230 338872 226->230 231 338874-338878 226->231 230->98 231->98 232 33887a-338881 231->232 232->98
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID: ($BM
                                          • API String ID: 0-2980357723
                                          • Opcode ID: bc8007a202246a34a6255e10b6e43981c71df6a3b09fd11dd37e7dc9b5ad22ce
                                          • Instruction ID: 052509a4d8858d1f67a33853900c612592ba71411648f62b443370b8957c2df7
                                          • Opcode Fuzzy Hash: bc8007a202246a34a6255e10b6e43981c71df6a3b09fd11dd37e7dc9b5ad22ce
                                          • Instruction Fuzzy Hash: 83223670940308EFEB129FA0DC89BAEBBB8FF08306F554465F215BA1A0DB719984DF55

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 512 33bb94-33bbbe 514 33bbc0 512->514 515 33bbc5-33bbdc 512->515 516 33bde8-33bdec 514->516 520 33bbe3-33bbf0 call 336830 515->520 521 33bbde 515->521 518 33bdf7-33bdfb 516->518 519 33bdee 516->519 522 33be06-33be0a 518->522 523 33bdfd-33be00 DeleteDC 518->523 519->518 531 33bbf2 520->531 532 33bbf7-33bc52 call 331250 CreateDCW 520->532 521->516 525 33be14-33be18 522->525 526 33be0c-33be0f call 33684c 522->526 523->522 529 33be23-33be28 525->529 530 33be1a 525->530 526->525 530->529 531->516 536 33bc54 532->536 537 33bc59-33bd23 call 331250 StartDocW 532->537 536->516 548 33bd25 537->548 549 33bd2a-33bd35 call 331730 537->549 548->516 552 33bd3a-33bd46 549->552 554 33bd4a-33bdc2 DrawTextA EndPage 552->554 555 33bd48 552->555 554->552 556 33bdc8-33bdd7 EndDoc call 331730 554->556 555->556 559 33bddc-33bddf 556->559 559->516
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Delete
                                          • String ID:
                                          • API String ID: 1035893169-0
                                          • Opcode ID: 29fbe12e4eb4b262ec33541a812c083faa44c3ff5de7d2c9a54ba5211fea2339
                                          • Instruction ID: 0c10aa91452780f24e6ca82a5f214af1e0b2075c4324cfb987d51e671b9cd01b
                                          • Opcode Fuzzy Hash: 29fbe12e4eb4b262ec33541a812c083faa44c3ff5de7d2c9a54ba5211fea2339
                                          • Instruction Fuzzy Hash: 3E81E171940608FFDF129FA0DC8ABADBB79FB18306F604459F605AA1B0D7725A50EF50
                                          APIs
                                          • RegCreateKeyExW.KERNELBASE(80000002,?,00000000,00000000,00000000,00020119,00000000,?,00000000), ref: 00340F69
                                          • RegQueryValueExW.KERNELBASE(?,?,00000000,00000004,00000004,00000004), ref: 00340F9C
                                          • RegDeleteKeyExW.KERNELBASE(80000002,?,00000100,00000000,000000FF,00000000), ref: 00341005
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: CreateDeleteQueryValue
                                          • String ID:
                                          • API String ID: 1796729037-0
                                          • Opcode ID: 95df115268b55644287c4cebe2601df7b30a1576c1938c218a4f8e3612f43f93
                                          • Instruction ID: 734d7935fd5916a5cb41e96cdf668ce506c32fda593a499c6ede076ab1c660a3
                                          • Opcode Fuzzy Hash: 95df115268b55644287c4cebe2601df7b30a1576c1938c218a4f8e3612f43f93
                                          • Instruction Fuzzy Hash: AC513AB0950209AFEB22DF90DC45FFEBBBCFB04701F404065BA15EA0A1D771AA54CB65
                                          APIs
                                            • Part of subcall function 0033E308: SetFileAttributesW.KERNELBASE(00000000,00000080,?,00000000,?,?,?), ref: 0033E329
                                            • Part of subcall function 0033E308: CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 0033E341
                                            • Part of subcall function 0033E3B8: SetFileAttributesW.KERNELBASE(00000000,00000080,?), ref: 0033E3D1
                                            • Part of subcall function 0033E3B8: CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0033E3E9
                                            • Part of subcall function 0033E3B8: SetFilePointerEx.KERNELBASE(000000FF,-00000084,00000000,00000000,00000002), ref: 0033E40D
                                            • Part of subcall function 0033E3B8: ReadFile.KERNELBASE(000000FF,?,00000084,?,00000000), ref: 0033E42C
                                            • Part of subcall function 0033E3B8: NtClose.NTDLL(000000FF), ref: 0033E467
                                          • MoveFileExW.KERNELBASE(00000000,00000000,00000008,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0033EF4B
                                          • CreateIoCompletionPort.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 0033F00C
                                          • CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,40000000,00000000,00000000,?,00000000,?), ref: 0033EFC2
                                            • Part of subcall function 0033684C: RtlFreeHeap.NTDLL(?,00000000,00000000,?,00347745,00000000), ref: 0033685D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: File$Create$Attributes$CloseCompletionFreeHeapMovePointerPortRead
                                          • String ID:
                                          • API String ID: 404628605-0
                                          • Opcode ID: 58609a77b58f41c24e5a6838f13a56f94e351ccc2f0e56f3a8b3cb6b073425d8
                                          • Instruction ID: 40e52beb0f2c629540d3baac41e5379081f3f68f7af0bf3a11a3bb58138b9aa3
                                          • Opcode Fuzzy Hash: 58609a77b58f41c24e5a6838f13a56f94e351ccc2f0e56f3a8b3cb6b073425d8
                                          • Instruction Fuzzy Hash: B1514570900708FFEF236FA4DC89B9D7F79AB04302F118060F516A90B2D7B5AA909F40
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 569ed10737a5376325790662b82d333fbd17b5d014782de601de69ee2277a5fe
                                          • Instruction ID: 44f4f643cad67874fa820e5a9e8200768d0755e2970e17ee7b933bc7866d4240
                                          • Opcode Fuzzy Hash: 569ed10737a5376325790662b82d333fbd17b5d014782de601de69ee2277a5fe
                                          • Instruction Fuzzy Hash: 8C21D431850608FFDF13AFA4DD9AB5C7B7AAB06316F2051A0E40679172C7721F60BB01
                                          APIs
                                          • CreateThread.KERNELBASE(00000000,00000000,0033A440,?,00000004,00000000), ref: 0033A489
                                          • ResumeThread.KERNELBASE(00000000), ref: 0033A4CD
                                          • GetExitCodeThread.KERNELBASE(00000000,00000000), ref: 0033A4E5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Thread$CodeCreateExitResume
                                          • String ID:
                                          • API String ID: 4070214711-0
                                          • Opcode ID: 220c5126985e4a70d6015ef4dbf526dbfb448adccae25a9b38e82919b5d26292
                                          • Instruction ID: ce00bd218990aa4fdde74d4a20110641b24e942116dc53eb81b1deb8804cc717
                                          • Opcode Fuzzy Hash: 220c5126985e4a70d6015ef4dbf526dbfb448adccae25a9b38e82919b5d26292
                                          • Instruction Fuzzy Hash: 7811E370900608FFDB12DF95DD49BADBBB9FB04312F2081A5F915A62B0E7716A50EB41
                                          APIs
                                          • CreateThread.KERNELBASE(00000000,00000000,0033A180,?,00000004,00000000), ref: 0033A1B4
                                          • ResumeThread.KERNELBASE(00000000), ref: 0033A1F8
                                          • GetExitCodeThread.KERNELBASE(00000000,00000000), ref: 0033A210
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Thread$CodeCreateExitResume
                                          • String ID:
                                          • API String ID: 4070214711-0
                                          • Opcode ID: 7ff086a7d47637de2d5856a11b51f57121e481e6fb263718d4d6bc0ec543d222
                                          • Instruction ID: d8d2eab1d4c46b7c4dd2229edbf23bae90502f4db894ae1a2e2a9e9666588bb5
                                          • Opcode Fuzzy Hash: 7ff086a7d47637de2d5856a11b51f57121e481e6fb263718d4d6bc0ec543d222
                                          • Instruction Fuzzy Hash: 1E110931940608FFDF129F90DD4AB9CBB79FB05312F204290FA55A61B0E7726B50EB41
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: CreateThread
                                          • String ID: ]q4
                                          • API String ID: 2422867632-2360727795
                                          • Opcode ID: a526ec764d37adb8635c1f8565b33523098f0138a3a4cedca6f55726bfd69880
                                          • Instruction ID: f30bdd25f94d322947dfed167870bfbbe6b93e8afc1d256ce32d67d93fdf608a
                                          • Opcode Fuzzy Hash: a526ec764d37adb8635c1f8565b33523098f0138a3a4cedca6f55726bfd69880
                                          • Instruction Fuzzy Hash: 8F614970E00609EFDF179FA0DC85BAEBBB8EB05306F204525EA016A1A0D7757A44DB90
                                          APIs
                                          • CoInitialize.OLE32(00000000), ref: 00337823
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Initialize
                                          • String ID: @
                                          • API String ID: 2538663250-2766056989
                                          • Opcode ID: 02b67bcc33f7268c49986adc4e65e8d77cd43364706c466ee3f557238da7c5a8
                                          • Instruction ID: ad427245f9d4e3695cdf7ed43c2c1dccae8a2d1d6a09394c4c13ff0d94ac18db
                                          • Opcode Fuzzy Hash: 02b67bcc33f7268c49986adc4e65e8d77cd43364706c466ee3f557238da7c5a8
                                          • Instruction Fuzzy Hash: 0FD127B0940209EFDB11EF90D889F9ABB78FF15300F158995E519AF2A2D771DA84CF60
                                          APIs
                                          • SetFileAttributesW.KERNELBASE(00000000,00000080,?,00000000,?,?,?), ref: 0033E329
                                          • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 0033E341
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: File$AttributesCreate
                                          • String ID:
                                          • API String ID: 415043291-0
                                          • Opcode ID: 9837811ca487b46c69e457a84fcb9ecf5ef79985e2e2ceb402a59f6a770fc637
                                          • Instruction ID: c638ba66da0d0ab95a4c7742e874725926a59a798814c0a9918521f492a05f99
                                          • Opcode Fuzzy Hash: 9837811ca487b46c69e457a84fcb9ecf5ef79985e2e2ceb402a59f6a770fc637
                                          • Instruction Fuzzy Hash: 38117079904308FAEB335B95DCC5BADBB78EB00732F204226F511A65E0D7716A84EA42
                                          APIs
                                          • MoveFileExW.KERNELBASE(00000000,00000000,00000008,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0033EF4B
                                          • CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,40000000,00000000,00000000,?,00000000,?), ref: 0033EFC2
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: File$CreateMove
                                          • String ID:
                                          • API String ID: 3198096935-0
                                          • Opcode ID: ff3f92b6d3637f638ddda820d06f9b54acf2aa016c2b9eebede067f2ed3f7ce0
                                          • Instruction ID: 0ef9d660898287dd7232e3277a1327eafad2c87296368041eb5974ae3f2a3a8a
                                          • Opcode Fuzzy Hash: ff3f92b6d3637f638ddda820d06f9b54acf2aa016c2b9eebede067f2ed3f7ce0
                                          • Instruction Fuzzy Hash: 86F01D31E44208FEDF335BA4EC85B9DBB75EB04721F228166B511A80E1D7B15A90EF41
                                          APIs
                                          • SetFileAttributesW.KERNELBASE(00000000,00000080,?,00000000,?,?,?), ref: 0033E329
                                          • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 0033E341
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: File$AttributesCreate
                                          • String ID:
                                          • API String ID: 415043291-0
                                          • Opcode ID: e46302a96ec9c2073cc1747b1dec7e610bded5ffe470c2bdd65f180730f870af
                                          • Instruction ID: 541a0115de71054202dd120c2b5b0e9b102db6b597cbcf83e748973810734a76
                                          • Opcode Fuzzy Hash: e46302a96ec9c2073cc1747b1dec7e610bded5ffe470c2bdd65f180730f870af
                                          • Instruction Fuzzy Hash: F7E04F38540704FAEB331B71DDC5B583A29AB04B71F604521F652AA4F0D770F940DA06
                                          APIs
                                          • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000,B00CA72F,?,?,0034948F), ref: 003363C5
                                            • Part of subcall function 00335DB0: RtlAllocateHeap.NTDLL(?,00000000,00000010,00000000,00000000,00000000,00000000,?,?,003363FC,0035540C,00335EE8,00000000,00000000,2663F81C), ref: 00335DF4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Heap$AllocateCreate
                                          • String ID:
                                          • API String ID: 2875408731-0
                                          • Opcode ID: 325dc3cb6eb64b7afd96a5d3fe8806b2069bdde4eefdbcdd01006c47c8403af6
                                          • Instruction ID: 1b5125203e47626180d3e2438a3e40d05ea481c607c7548a6c07d9b82f70728e
                                          • Opcode Fuzzy Hash: 325dc3cb6eb64b7afd96a5d3fe8806b2069bdde4eefdbcdd01006c47c8403af6
                                          • Instruction Fuzzy Hash: 623165747CAFA078403332672CEFEDF2C6D8DD7F62F814514F888A90A28994704485B9
                                          APIs
                                          • OpenSCManagerW.ADVAPI32(00000000,00000000,00000004), ref: 00337C8F
                                            • Part of subcall function 00336830: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,003476B5,?,00000000,00000000), ref: 00336841
                                            • Part of subcall function 0033DBBC: NtTerminateProcess.NTDLL(00337D88,00000000), ref: 0033DC1F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateHeapManagerOpenProcessTerminate
                                          • String ID:
                                          • API String ID: 3645570960-0
                                          • Opcode ID: 78e0a7a726dbf1f58efa16a50cdaf276ad5b5ff56ba9d08f39833646e17647b7
                                          • Instruction ID: 3464a1705f70c73657ae0ee847ca05a204dfeaa508b44966e1dc253ab7e5d350
                                          • Opcode Fuzzy Hash: 78e0a7a726dbf1f58efa16a50cdaf276ad5b5ff56ba9d08f39833646e17647b7
                                          • Instruction Fuzzy Hash: 4F41D671940209FBEF229B90DC9ABEDBB79BF08706F504065F601B90E0D7B56A94DB50
                                          APIs
                                            • Part of subcall function 00335C34: FindFirstFileW.KERNELBASE(?,?,?,00000004,?), ref: 00335D07
                                            • Part of subcall function 00335C34: FindClose.KERNELBASE(000000FF,?,00000000), ref: 00335D2C
                                          • RtlAllocateHeap.NTDLL(?,00000000,00000010,00000000,00000000,00000000,00000000,?,?,003363FC,0035540C,00335EE8,00000000,00000000,2663F81C), ref: 00335DF4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Find$AllocateCloseFileFirstHeap
                                          • String ID:
                                          • API String ID: 1673784098-0
                                          • Opcode ID: 958f2f53570a6db92af42431be29969dc89f504488b743a2a58f792ba3110137
                                          • Instruction ID: fe7d2dead612277ee7bd45ba2f88cd9b1b317b211b374308fd508446d86e8bd7
                                          • Opcode Fuzzy Hash: 958f2f53570a6db92af42431be29969dc89f504488b743a2a58f792ba3110137
                                          • Instruction Fuzzy Hash: 0E31AF316147469EDB22CF2888C1796FAD5BF11310F19D7A9E208CF693E6B1C8C0DB96
                                          APIs
                                            • Part of subcall function 0033900C: RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 0033902E
                                          • CloseServiceHandle.ADVAPI32(00000000), ref: 0033917F
                                            • Part of subcall function 0033DBBC: NtTerminateProcess.NTDLL(00337D88,00000000), ref: 0033DC1F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AdjustCloseHandlePrivilegeProcessServiceTerminate
                                          • String ID:
                                          • API String ID: 3176663195-0
                                          • Opcode ID: 8d5b5454c3987247fc7869a090d220c18d5abd84ed631899c4fcb0051b32bdba
                                          • Instruction ID: 731b9783f9fffcc45b096a8f188417c5989ee44dbf3bc992f53ca6ca7597bfc3
                                          • Opcode Fuzzy Hash: 8d5b5454c3987247fc7869a090d220c18d5abd84ed631899c4fcb0051b32bdba
                                          • Instruction Fuzzy Hash: 7931E570940309FBEB12AFA0DC8DB9DBBB8AF04706F4540A5F605BA1B0D7B59A84DB50
                                          APIs
                                            • Part of subcall function 003397A8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 003397D5
                                          • OpenSCManagerW.SECHOST(00000000,00000000,00000001,25DD2DA4), ref: 00338DB6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: InformationManagerOpenQuerySystem
                                          • String ID:
                                          • API String ID: 1910025873-0
                                          • Opcode ID: acdb82237062a8c512e573f5e7a982ca1de6d94be85a1305e9d9090c7fb2f21f
                                          • Instruction ID: 14d75b79c87dfb868366a688b6d2f5a3108d9104a7e7d891fea08e29ca5b4948
                                          • Opcode Fuzzy Hash: acdb82237062a8c512e573f5e7a982ca1de6d94be85a1305e9d9090c7fb2f21f
                                          • Instruction Fuzzy Hash: B1312CB0915308EFDB12CF94C998B9DBBB8EB04305F618194F141AB2A0D7B49B54CF51
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: df8c245efd757fdbb3d4cfb9a8995725f5b48bc3049c2f0a54898a98115c2dab
                                          • Instruction ID: 3fa0398a431b79b9a1991c307c4550b682342fe647bd024d369aa0a70a28bc21
                                          • Opcode Fuzzy Hash: df8c245efd757fdbb3d4cfb9a8995725f5b48bc3049c2f0a54898a98115c2dab
                                          • Instruction Fuzzy Hash: FD214D70901208FFEB229F54DD86BADBB74FF06305F1080B5E9046A1A1E7314A90DB44
                                          APIs
                                          • CoInitialize.OLE32(00000000,?,?,?,?,00000000), ref: 0033F7B7
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Initialize
                                          • String ID:
                                          • API String ID: 2538663250-0
                                          • Opcode ID: 165a24f8ee8786f62cceb6f111f24ee8da597a5161eb6c739f09cb7c415f6900
                                          • Instruction ID: e6a8d93df044243a760c124a7a15399a882b31f863b27c38006af383c98543fb
                                          • Opcode Fuzzy Hash: 165a24f8ee8786f62cceb6f111f24ee8da597a5161eb6c739f09cb7c415f6900
                                          • Instruction Fuzzy Hash: 6DC16AB0900209EFEB12DFA0E888B9ABB7CFF15305F5184A5E519AF161D775DA44CF90
                                          APIs
                                          • CreateMutexW.KERNELBASE(0000000C,00000001,00000000), ref: 00339C1B
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: e8d1910940c56b0cda35f7b3abd20000502f002425ae016dc49ee9ee33c9a7c4
                                          • Instruction ID: 2e455a33f6c030a461594d0b3eab02dc14403b5b6a4f2cd945d5e1442d75a618
                                          • Opcode Fuzzy Hash: e8d1910940c56b0cda35f7b3abd20000502f002425ae016dc49ee9ee33c9a7c4
                                          • Instruction Fuzzy Hash: F3116174804B04EFEB13DBA0EC9AB69BFBDAB09302F140156F9459A1F0D7F12A40DB44
                                          APIs
                                          • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 0033902E
                                            • Part of subcall function 003397A8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 003397D5
                                            • Part of subcall function 00339850: NtClose.NTDLL(00000000), ref: 00339941
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AdjustCloseInformationPrivilegeQuerySystem
                                          • String ID:
                                          • API String ID: 327775174-0
                                          • Opcode ID: acd8f96b491be07af6918fe800bb849b4b7fcfd3c7683a7b5a48b2506204e3cc
                                          • Instruction ID: fdeaf6c70e6f50eefc6851c91062c8a313a829c9bda2970386cae7e8de3f9a2e
                                          • Opcode Fuzzy Hash: acd8f96b491be07af6918fe800bb849b4b7fcfd3c7683a7b5a48b2506204e3cc
                                          • Instruction Fuzzy Hash: B7016770A40308FFEF219FA5CC8EBDD7BB89B00715F504195B515AA1E0E7F55A84C751
                                          APIs
                                          • RtlAdjustPrivilege.NTDLL(00000000,00000001,00000000,?), ref: 0033B683
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AdjustPrivilege
                                          • String ID:
                                          • API String ID: 3260937286-0
                                          • Opcode ID: 26a7000fb1608e57c88bc91b7886cabfed487809b33892a152c2821c540606d7
                                          • Instruction ID: ca65af0032fc6c8706b3fc2c40e035f87d070f70470ab1b98957314d4601f330
                                          • Opcode Fuzzy Hash: 26a7000fb1608e57c88bc91b7886cabfed487809b33892a152c2821c540606d7
                                          • Instruction Fuzzy Hash: 01D02E72208209A7DA220664ACC3BF2B39CC340322F00031ABF03EA0D2EB62AA4042D5
                                          APIs
                                          • RtlReAllocateHeap.NTDLL(?,00000008,?,00000400,?,003397F5,?,00000400), ref: 0033687C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateHeap
                                          • String ID:
                                          • API String ID: 1279760036-0
                                          • Opcode ID: 1a74fb7e4011b89a85aacecdb72cd58b2c43c94adedf27434dee9fee922cfa5e
                                          • Instruction ID: 38acbff99fb34b1c52f933e6b43188631f7f19c963a8126bd356df95724c31ab
                                          • Opcode Fuzzy Hash: 1a74fb7e4011b89a85aacecdb72cd58b2c43c94adedf27434dee9fee922cfa5e
                                          • Instruction Fuzzy Hash: 80C08C36080608FFCB426FD5DC05E897B2CBB28302F00C000B7084E032CA32E4A8DB90
                                          APIs
                                          • RtlAllocateHeap.NTDLL(?,00000008,00000000,?,003476B5,?,00000000,00000000), ref: 00336841
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateHeap
                                          • String ID:
                                          • API String ID: 1279760036-0
                                          • Opcode ID: 586d8195c1541b52f08231ebca28e260d988b76fee7e3edef18c207b217c08f0
                                          • Instruction ID: 53b81b3052939a16a51910e42a957c2313c61d4c3900d9e92e411987e84513fe
                                          • Opcode Fuzzy Hash: 586d8195c1541b52f08231ebca28e260d988b76fee7e3edef18c207b217c08f0
                                          • Instruction Fuzzy Hash: D9C08C72080608ABC6016B959805E85371CAB24302F008010B3044B021CA31E49087A4
                                          APIs
                                          • RtlFreeHeap.NTDLL(?,00000000,00000000,?,00347745,00000000), ref: 0033685D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: FreeHeap
                                          • String ID:
                                          • API String ID: 3298025750-0
                                          • Opcode ID: 1e13cf7b81c3e6a3906944dd3969bf0a98190373331eb0bda9c455813148a210
                                          • Instruction ID: 659f4c9103c09fc34ea47770c5c9f7eed4ce0d11dccc4d13675b344b3fa3ae47
                                          • Opcode Fuzzy Hash: 1e13cf7b81c3e6a3906944dd3969bf0a98190373331eb0bda9c455813148a210
                                          • Instruction Fuzzy Hash: 22C09B76540708EFC7056FD5DC45F95775CAB58701F414011B7094F171C675F490D798
                                          APIs
                                          • GetLogicalDriveStringsW.KERNELBASE(?,?), ref: 0033A44B
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: DriveLogicalStrings
                                          • String ID:
                                          • API String ID: 2022863570-0
                                          • Opcode ID: 69a8b6523b497f563bc468791d39942f100b3d5394962ed49adacc949b974835
                                          • Instruction ID: 61f59b6fe2b6a876992d37e575171748ea5be867f0b6049d95ed9b69b14465a2
                                          • Opcode Fuzzy Hash: 69a8b6523b497f563bc468791d39942f100b3d5394962ed49adacc949b974835
                                          • Instruction Fuzzy Hash: DBC09236000308EF8B029F88ED48C85BFEEEB19701B048061F60A4B131DB32F820EB95
                                          APIs
                                          • GetDriveTypeW.KERNELBASE(?), ref: 0033A186
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: DriveType
                                          • String ID:
                                          • API String ID: 338552980-0
                                          • Opcode ID: e3363d415887598e658e2ab2c527cfc3b7f83602b18be7490186c1cbf8c3c656
                                          • Instruction ID: 511a40c42ff3befeb24781454d729b3823fdcb055b219f025aa12dd8ff5dd198
                                          • Opcode Fuzzy Hash: e3363d415887598e658e2ab2c527cfc3b7f83602b18be7490186c1cbf8c3c656
                                          • Instruction Fuzzy Hash: 97B0123100020CA786015B41EC048857F5DD711362B004021F50500030D7326461D5D4
                                          APIs
                                          • CoInitialize.OLE32(00000000), ref: 00337823
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Initialize
                                          • String ID:
                                          • API String ID: 2538663250-0
                                          • Opcode ID: 948df219a0355269517373147a51ce91b3f23be3103000cfe8eb13339f141338
                                          • Instruction ID: 57874805ca6e165702902d6d20498e16c02a7307e9e941f2d8afc9704ff7f92d
                                          • Opcode Fuzzy Hash: 948df219a0355269517373147a51ce91b3f23be3103000cfe8eb13339f141338
                                          • Instruction Fuzzy Hash: 9F8103B0440304EFD751EF50E989A5ABFB8EF66354F168998D0286F262C376DA44CF54
                                          APIs
                                          • Sleep.KERNELBASE(000000C8,?,?,0033E361,00000000,?,00000000,?,?,?), ref: 0033DDC7
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Sleep
                                          • String ID:
                                          • API String ID: 3472027048-0
                                          • Opcode ID: 37c38669d0f310fb70799a0a5fa78e7e9c9560dc3391b0b3f3836d092247d260
                                          • Instruction ID: 9317a4fa14d8dcb04d422e0dced0262b663c75baa4375ff8eec6b7341e7f2042
                                          • Opcode Fuzzy Hash: 37c38669d0f310fb70799a0a5fa78e7e9c9560dc3391b0b3f3836d092247d260
                                          • Instruction Fuzzy Hash: 57D022323453082BE7133FE8BCC2C0EF60EAF62300F018233FA028A112CDB1D8244250
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 01b6a1a420ccda43d3a342d3e17eafc135d600e75ef9c70e672367a739905118
                                          • Instruction ID: dbe0ac3e6234139dbb2ba89c46773a71987585db9addbacb94a737ae1fa8aaeb
                                          • Opcode Fuzzy Hash: 01b6a1a420ccda43d3a342d3e17eafc135d600e75ef9c70e672367a739905118
                                          • Instruction Fuzzy Hash: EAE1247AA20E429BD716CF19E8C0635B3A6FB99700F1AC638C61587B55C738F961CB80
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5ae1b344ce7eabeca7d5a0e2004a9b7e15b356c338447e056007cc76e97bc746
                                          • Instruction ID: 97e07c66012196abeb6e219a2365fc9df67904f329f5d1150e5fe873212d469c
                                          • Opcode Fuzzy Hash: 5ae1b344ce7eabeca7d5a0e2004a9b7e15b356c338447e056007cc76e97bc746
                                          • Instruction Fuzzy Hash: 9AD1D2719083818FC790CF29C58065BF7E5FFD8348F159A1EE999D3211E770EA998B82
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a58204f9abd0f98506d6b465fa329f1854bbe5d9c88eb55f8b409c1335fbbd19
                                          • Instruction ID: 353ecd2508d5e2582614c030b270935e875c5223565dc71b6565ababd7345349
                                          • Opcode Fuzzy Hash: a58204f9abd0f98506d6b465fa329f1854bbe5d9c88eb55f8b409c1335fbbd19
                                          • Instruction Fuzzy Hash: 18D1227AE2094B8BDB15CF58ECD1B7AB372FB88700F098638CB0197755C638AA11DB50
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5f499c66af860ae6110d72e94b43e7c185571afebbe52dbe9b08376a283cd27f
                                          • Instruction ID: 8653828022aca2624d9ac805df41d1a700309e07f3cf7bd0f50107c1625c5009
                                          • Opcode Fuzzy Hash: 5f499c66af860ae6110d72e94b43e7c185571afebbe52dbe9b08376a283cd27f
                                          • Instruction Fuzzy Hash: 47314712FCA70656FF77E35086C16F7A218EB107A0FDF0523F88A436664C582E879752
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a6cd5c932f7367315f768bc3e4e0488be9ba0b471234e24e953f20c720067ce3
                                          • Instruction ID: cac2686d7d4bec9b69af7061256db9526f3ae94892a5552f520b462c02bf9816
                                          • Opcode Fuzzy Hash: a6cd5c932f7367315f768bc3e4e0488be9ba0b471234e24e953f20c720067ce3
                                          • Instruction Fuzzy Hash: 543138B6A21E069BC329CF1AD8C4925F7A2FF9D310B15CA28D959C7B52C734F951CB80
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2518562696.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true
                                          • Associated: 00000000.00000002.2518391086.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518625104.000000000034A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518673163.000000000034B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518727247.0000000000354000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518774206.0000000000356000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2518821856.0000000000357000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_330000_LB3.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                                          • Instruction ID: 27aa5c02b7f3faec35b6b39719aee2ba8bcc6e6bf32faccd6b98fb82bf123a99
                                          • Opcode Fuzzy Hash: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                                          • Instruction Fuzzy Hash: E2E04FBB70D3025FF928951274933A78387C780675E26849EF506DF1C4EF1BE8A52045

                                          Execution Graph

                                          Execution Coverage:32.4%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:0%
                                          Total number of Nodes:160
                                          Total number of Limit Nodes:1
                                          execution_graph 890 403983 893 40389c 890->893 902 402a78 893->902 897 403903 932 4022dc 897->932 938 4028ba 902->938 904 402a9e 904->897 907 4026c0 904->907 905 402af0 CreateMutexW 905->904 952 4024f8 907->952 909 402729 909->897 913 402f18 909->913 910 4026e7 CreateFileW 910->909 911 40270b ReadFile 910->911 911->909 914 402f2e 913->914 914->914 956 40227c FindFirstFileExW 914->956 915 402f67 CreateFileW 917 402f57 915->917 920 402faf 915->920 916 402faa 919 4030c5 NtFreeVirtualMemory 916->919 921 4030ed 916->921 917->915 917->916 918 402fb4 NtAllocateVirtualMemory 918->920 927 402fe8 918->927 919->916 920->918 920->927 922 4030f3 NtClose 921->922 923 4030ff 921->923 922->923 958 402e10 923->958 925 40311f 925->897 926 40304b WriteFile 926->927 928 403068 SetFilePointerEx 926->928 927->916 927->926 929 403095 SetFilePointerEx 927->929 928->926 928->927 929->927 933 402303 932->933 934 402335 GetShortPathNameW 933->934 935 402330 27 API calls 933->935 934->935 936 40235e 934->936 936->935 937 40246d ShellExecuteW 936->937 937->935 939 4028dd 938->939 942 402760 CreateFileW 939->942 943 4027da 942->943 944 402797 942->944 945 402802 943->945 946 4027f6 NtClose 943->946 944->943 950 4020bc 944->950 945->904 945->905 946->945 947 4027b7 947->943 948 4027c0 ReadFile 947->948 948->943 951 4020c8 RtlAllocateHeap 950->951 951->947 953 402512 952->953 955 402760 4 API calls 953->955 954 402522 954->909 954->910 955->954 957 4022af 956->957 957->917 960 402e2e 958->960 959 402e37 DeleteFileW 959->925 960->959 960->960 961 402e7c MoveFileExW 960->961 961->959 961->960 962 403956 963 403963 962->963 964 403976 962->964 971 4019d4 963->971 1009 4016b4 971->1009 974 4016b4 9 API calls 975 4019f4 974->975 976 4016b4 9 API calls 975->976 977 401a05 976->977 978 4016b4 9 API calls 977->978 979 401a16 978->979 980 4016b4 9 API calls 979->980 981 401a27 980->981 982 4016b4 9 API calls 981->982 983 401a38 982->983 984 401b70 RtlCreateHeap 983->984 985 401ba6 RtlCreateHeap 984->985 995 401ba1 984->995 986 401bcb 985->986 985->995 986->995 1057 401a40 986->1057 988 401c03 989 401a40 RtlAllocateHeap 988->989 988->995 990 401c59 989->990 991 401a40 RtlAllocateHeap 990->991 990->995 992 401caf 991->992 993 401a40 RtlAllocateHeap 992->993 992->995 994 401d05 993->994 994->995 996 401a40 RtlAllocateHeap 994->996 1001 402812 995->1001 1005 402836 995->1005 997 401d55 996->997 997->995 1062 401d94 997->1062 998 401d7a 1065 401dc2 998->1065 1002 402836 1001->1002 1003 402850 RtlAdjustPrivilege 1002->1003 1004 40284e 1002->1004 1003->1002 1003->1004 1004->964 1006 402849 1005->1006 1007 402850 RtlAdjustPrivilege 1006->1007 1008 40284e 1006->1008 1007->1006 1007->1008 1008->964 1010 40176f 1009->1010 1011 4016cf 1009->1011 1010->974 1012 4016f5 NtAllocateVirtualMemory 1011->1012 1035 401000 1011->1035 1012->1010 1014 40172f NtAllocateVirtualMemory 1012->1014 1014->1010 1016 401752 1014->1016 1020 40152c 1016->1020 1018 40175f 1018->1010 1019 401000 3 API calls 1018->1019 1019->1018 1021 401540 1020->1021 1022 401558 1020->1022 1023 401000 3 API calls 1021->1023 1024 401000 3 API calls 1022->1024 1025 40157e 1022->1025 1023->1022 1024->1025 1026 401000 3 API calls 1025->1026 1029 4015a4 1025->1029 1026->1029 1027 4015ed FindFirstFileExW 1027->1029 1028 40166c 1028->1018 1029->1027 1029->1028 1030 401649 FindNextFileW 1029->1030 1031 40162a FindClose 1029->1031 1030->1029 1033 40165d FindClose 1030->1033 1043 401474 1031->1043 1033->1029 1034 401641 1034->1018 1036 401012 1035->1036 1037 40102a 1035->1037 1038 401000 3 API calls 1036->1038 1039 401000 3 API calls 1037->1039 1040 401050 1037->1040 1038->1037 1039->1040 1041 4010fb 1040->1041 1046 401394 1040->1046 1041->1012 1044 40148a 1043->1044 1045 4014b8 LdrLoadDll 1044->1045 1045->1034 1047 4013ee 1046->1047 1048 4013be 1046->1048 1047->1041 1048->1047 1049 401474 LdrLoadDll 1048->1049 1050 4013d2 1049->1050 1050->1047 1050->1050 1052 4014d8 1050->1052 1053 4014ee 1052->1053 1054 40150f LdrGetProcedureAddress 1052->1054 1056 4014fa LdrGetProcedureAddress 1053->1056 1055 401521 1054->1055 1055->1047 1056->1055 1058 401a5d RtlAllocateHeap 1057->1058 1059 401a79 1058->1059 1060 401a85 1058->1060 1059->988 1060->1058 1061 401b5b 1060->1061 1061->988 1063 401da8 NtSetInformationThread 1062->1063 1063->998 1066 401de9 1065->1066 1067 401e12 1066->1067 1068 401df2 NtProtectVirtualMemory 1066->1068 1067->995 1068->1067 1083 402126 1084 402141 1083->1084 1085 4020bc RtlAllocateHeap 1084->1085 1086 402158 1084->1086 1085->1086 1069 4019b7 1070 4019e0 1069->1070 1071 4016b4 9 API calls 1069->1071 1072 4016b4 9 API calls 1070->1072 1071->1070 1073 4019f4 1072->1073 1074 4016b4 9 API calls 1073->1074 1075 401a05 1074->1075 1076 4016b4 9 API calls 1075->1076 1077 401a16 1076->1077 1078 4016b4 9 API calls 1077->1078 1079 401a27 1078->1079 1080 4016b4 9 API calls 1079->1080 1081 401a38 1080->1081 1082 40286c NtSetInformationProcess NtSetInformationProcess NtSetInformationProcess

                                          Callgraph

                                          • Executed
                                          • Not Executed
                                          • Opacity -> Relevance
                                          • Disassembly available
                                          callgraph 0 Function_004026C0 38 Function_004024F8 0->38 1 Function_00401A40 39 Function_00401E78 1->39 2 Function_00401DC2 3 Function_004024C2 4 Function_00402B44 5 Function_00403144 6 Function_00401FC8 7 Function_00401F4C 8 Function_0040204C 9 Function_00402B50 10 Function_00401350 71 Function_00401130 10->71 11 Function_00402ED0 12 Function_004024D4 13 Function_004019D4 76 Function_004016B4 13->76 14 Function_00403956 14->13 33 Function_00401B70 14->33 54 Function_00402812 14->54 78 Function_00402836 14->78 15 Function_00403258 16 Function_004014D8 81 Function_00401438 16->81 17 Function_00401FDB 18 Function_004022DC 19 Function_0040205C 20 Function_00401F5C 21 Function_004020DE 22 Function_00402760 83 Function_004020BC 22->83 23 Function_004031E0 24 Function_00402264 25 Function_00401EE4 26 Function_004032E4 27 Function_004032E8 28 Function_00401868 29 Function_0040286C 30 Function_00401F6C 31 Function_00401B6E 32 Function_00401FEF 33->1 33->2 55 Function_00401D94 33->55 34 Function_00401472 35 Function_00401474 41 Function_004013F8 35->41 36 Function_004013F6 37 Function_00402A78 82 Function_004028BA 37->82 38->22 62 Function_00401E28 39->62 40 Function_00403478 42 Function_0040227C 43 Function_0040217C 44 Function_00402BFC 45 Function_00401000 45->7 45->10 45->25 45->45 56 Function_00401394 45->56 73 Function_00401EB0 45->73 46 Function_00402D80 47 Function_00403983 60 Function_0040389C 47->60 48 Function_00402003 49 Function_00402104 50 Function_00402C88 51 Function_00402E10 52 Function_00401190 52->71 53 Function_00401911 56->16 56->35 57 Function_00402017 58 Function_00402F18 58->42 58->51 59 Function_00401F9A 60->0 60->18 60->37 60->58 61 Function_00402126 61->83 63 Function_00402DA8 64 Function_0040152A 65 Function_0040202A 66 Function_0040152C 66->19 66->25 66->35 66->45 67 Function_00401F2C 66->67 68 Function_004018AD 69 Function_0040362E 70 Function_00401EAE 72 Function_00403230 74 Function_00401FB1 75 Function_004016B2 76->39 76->45 76->66 77 Function_00402234 79 Function_00401436 80 Function_004019B7 80->76 82->22 84 Function_00401A3E

                                          Control-flow Graph

                                          APIs
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: Text$Color$CreateWindow$Proc$CommandFontFreeHandleLibraryLineLoadMenuModule$AddressBitmapCharsetErrorExitInfoLastLocaleObjectProcessSelect
                                          • String ID:
                                          • API String ID: 3548022523-0
                                          • Opcode ID: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                                          • Instruction ID: 44f13d8dc4ada08d969f55db554330e9d88bd117b0c18836a0928b418f5903af
                                          • Opcode Fuzzy Hash: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                                          • Instruction Fuzzy Hash: 89F0B724B651416AC500BFFB9947A0D6E2C6E8472BB50657EB0C1344E74D3C87009EAF

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 3 402f18-402f2b 4 402f2e-402f33 3->4 4->4 5 402f35-402f5b call 40227c 4->5 7 402f67-402f8c CreateFileW 5->7 8 402f5d-402f61 5->8 9 402f8e-402f96 7->9 10 402faf-402fb1 7->10 8->7 11 4030bb-4030bd 8->11 12 402f98-402fa6 9->12 13 402faa 9->13 14 402fb4-402fe0 NtAllocateVirtualMemory 10->14 15 4030c0-4030c3 11->15 12->13 27 402fa8 12->27 13->11 16 402fe2-402fed 14->16 17 402fe8 14->17 18 4030c5-4030e4 NtFreeVirtualMemory 15->18 19 4030e7-4030eb 15->19 28 403000-403003 16->28 29 402fef-402ffe 16->29 22 40301b-403020 17->22 18->19 19->15 23 4030ed-4030f1 19->23 26 403023-40302e 22->26 24 4030f3-4030fc NtClose 23->24 25 4030ff-40311d call 402e10 DeleteFileW 23->25 24->25 36 403126-40312a 25->36 37 40311f 25->37 30 403030-40303a 26->30 31 40303c 26->31 27->7 32 403015-403019 28->32 33 403005-403010 28->33 29->32 35 403041-403048 30->35 31->35 32->14 32->22 33->32 38 40304b-403064 WriteFile 35->38 39 403138-403141 36->39 40 40312c-403132 36->40 37->36 41 403066 38->41 42 403068-403088 SetFilePointerEx 38->42 40->39 43 40308a-403091 41->43 42->38 42->43 44 403093 43->44 45 403095-4030b6 SetFilePointerEx 43->45 44->11 45->26
                                          APIs
                                          • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,80000000,00000000), ref: 00402F82
                                          • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00010000,00001000,00000004), ref: 00402FDB
                                          • WriteFile.KERNELBASE(000000FF,00000000,00010000,00010000,00000000), ref: 0040305F
                                          • SetFilePointerEx.KERNELBASE(000000FF,00010000,?,00000000,00000001), ref: 0040307E
                                          • SetFilePointerEx.KERNELBASE(000000FF,00010000,00000000,00000000,00000000,?,00000000,00000001), ref: 004030B3
                                          • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00010000,00008000,?,00000000,00000001), ref: 004030E4
                                          • NtClose.NTDLL(000000FF,?,00000000,00000001), ref: 004030FC
                                          • DeleteFileW.KERNELBASE(?,?,00000000,00000001), ref: 00403118
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: File$MemoryPointerVirtual$AllocateCloseCreateDeleteFreeWrite
                                          • String ID:
                                          • API String ID: 590822095-0
                                          • Opcode ID: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                                          • Instruction ID: 1b8bdb635f3090c090aca30f1047892238d11e79f8ef36d2dcee79009cce4089
                                          • Opcode Fuzzy Hash: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                                          • Instruction Fuzzy Hash: ED714871901209AFDB11CF90DD48BEEBB79FB08311F204266E511B62D4D3759E85CF99

                                          Control-flow Graph

                                          APIs
                                          • FindFirstFileExW.KERNELBASE(C:\Windows\System32\*.dll,00000000,?,00000000,00000000,00000000), ref: 00401601
                                          • FindClose.KERNELBASE(000000FF,?,00000000), ref: 0040162D
                                          • FindNextFileW.KERNELBASE(000000FF,?,?,00000000), ref: 00401653
                                          • FindClose.KERNEL32(000000FF), ref: 00401660
                                          Strings
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: Find$CloseFile$FirstNext
                                          • String ID: C:\Windows\System32\*.dll
                                          • API String ID: 1164774033-1305136377
                                          • Opcode ID: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                                          • Instruction ID: b8f602421e8d3e3309feb9384621a56ef9d54da146c7d7394d3b11ea37959a12
                                          • Opcode Fuzzy Hash: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                                          • Instruction Fuzzy Hash: 30418C71900608EFDB20AFA4DD48BAA77B4FB44325F608276E521BE1F0D7794A85DF48

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 82 402760-402795 CreateFileW 83 4027f0-4027f4 82->83 84 402797-4027a9 82->84 85 402802-40280b 83->85 86 4027f6-4027ff NtClose 83->86 84->83 88 4027ab-4027be call 4020bc 84->88 86->85 88->83 90 4027c0-4027d8 ReadFile 88->90 91 4027e4-4027ea 90->91 92 4027da-4027e2 90->92 91->83 92->83
                                          APIs
                                          • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0040278B
                                          • ReadFile.KERNELBASE(000000FF,00000000,00000000,00000000,00000000), ref: 004027D3
                                          • NtClose.NTDLL(000000FF), ref: 004027FF
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: File$CloseCreateRead
                                          • String ID:
                                          • API String ID: 1419693385-0
                                          • Opcode ID: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                                          • Instruction ID: da411bd40fb0d6d878d2d447c4e829303a7e8bd202b0d35ae7576ead56d2946b
                                          • Opcode Fuzzy Hash: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                                          • Instruction Fuzzy Hash: CA211A35601209EBDB10CF94DD89B9EBB75FF08310F2082A5A510AB2E1D7719E51DF94

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 94 40286c-4028b9 NtSetInformationProcess * 3
                                          APIs
                                          • NtSetInformationProcess.NTDLL(000000FF,00000021,?,00000004), ref: 00402888
                                          • NtSetInformationProcess.NTDLL(000000FF,00000012,00000000,00000002,?,00000004), ref: 0040289D
                                          • NtSetInformationProcess.NTDLL(000000FF,0000000C,00000000,00000004,?,00000004), ref: 004028B5
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: InformationProcess
                                          • String ID:
                                          • API String ID: 1801817001-0
                                          • Opcode ID: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                                          • Instruction ID: 48adbd17ca007e7691ff2066b81a5959555298f4bd9a539b6f325b5cfe831ef7
                                          • Opcode Fuzzy Hash: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                                          • Instruction Fuzzy Hash: 2BF0F871141610EBEB15DB84DDC9F9637A8FB09720F2403A1F2319E1E6D3B0A484CF96

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 95 401dc2-401df0 97 401e21-401e27 95->97 98 401df2-401e10 NtProtectVirtualMemory 95->98 98->97 99 401e12-401e1f 98->99 99->97
                                          APIs
                                          • NtProtectVirtualMemory.NTDLL(000000FF,00000000,00000020,00000040,?), ref: 00401E0B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: MemoryProtectVirtual
                                          • String ID:
                                          • API String ID: 2706961497-3916222277
                                          • Opcode ID: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                                          • Instruction ID: 836d3446d31acb3b31e0b6cd8f4ee088cd02c28435d2c0c4ff934eaabbb3754d
                                          • Opcode Fuzzy Hash: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                                          • Instruction Fuzzy Hash: 72F03176500109ABDB00CF95D988BDFB7BCEB44324F2042A9EA14A72D1D7355E458B94

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 180 4016b4-4016c9 181 401859-401862 180->181 182 4016cf-4016d6 180->182 183 4016f5-401729 NtAllocateVirtualMemory 182->183 184 4016d8-4016f0 call 401000 182->184 183->181 186 40172f-40174c NtAllocateVirtualMemory 183->186 184->183 186->181 188 401752-40175a call 40152c 186->188 190 40175f-401761 188->190 190->181 191 401767-40176d 190->191 192 401774-401781 call 401000 191->192 193 40176f 191->193 196 401851-401854 192->196 197 401787-401798 call 401e78 192->197 193->181 196->191 200 4017c9-4017cc 197->200 201 40179a-4017c4 call 401e78 197->201 203 4017fa-4017fd 200->203 204 4017ce-4017f8 call 401e78 200->204 201->196 205 401815-401818 203->205 206 4017ff-401813 203->206 204->196 210 401830-401833 205->210 211 40181a-40182e 205->211 206->196 210->196 212 401835-40184b 210->212 211->196 212->196
                                          APIs
                                          • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00103000,00000040), ref: 0040171F
                                          • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000000,00103000,00000004), ref: 00401742
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: AllocateMemoryVirtual
                                          • String ID:
                                          • API String ID: 2167126740-0
                                          • Opcode ID: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                                          • Instruction ID: ad4b5e7ce53ce887a57ee0cc443bca07838dd3003dcb7b2c4dfa2ad75add82e8
                                          • Opcode Fuzzy Hash: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                                          • Instruction Fuzzy Hash: E3416031904204DADF10EF58C884B9AB7A4FF05314F14C1BAE919EF2E6D7788A41CB6A

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 288 40227c-4022ad FindFirstFileExW 289 4022d2-4022d8 288->289 290 4022af-4022cf 288->290 290->289
                                          APIs
                                          • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 004022A4
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: FileFindFirst
                                          • String ID:
                                          • API String ID: 1974802433-0
                                          • Opcode ID: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                                          • Instruction ID: 55f0629c3eadcc188d8749e42e063c0b49bca1bc4f8f265f590f61ae6da82bee
                                          • Opcode Fuzzy Hash: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                                          • Instruction Fuzzy Hash: BBF0C974902608EFDB10DF94CD49B9DFBB4EB48310F2082A5A918AB2A0D7715E91CF84
                                          APIs
                                          • NtSetInformationThread.NTDLL(00000000,?,00000000,00000000), ref: 00401DBB
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: InformationThread
                                          • String ID:
                                          • API String ID: 4046476035-0
                                          • Opcode ID: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                                          • Instruction ID: 482b214da63c1bafeb7c1bb62a0bbbc62c262419b9af6fea3894fce228737229
                                          • Opcode Fuzzy Hash: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                                          • Instruction Fuzzy Hash: FEE05E329A020DAFD710DB50DC45FBB376DEB55311F508236B5029A1E0D6B8F891DA98

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 100 401b70-401b9f RtlCreateHeap 101 401ba1 100->101 102 401ba6-401bc4 RtlCreateHeap 100->102 103 401d8a-401d90 101->103 104 401bc6 102->104 105 401bcb-401be7 102->105 104->103 107 401be9 105->107 108 401bee-401c05 call 401a40 105->108 107->103 111 401c07 108->111 112 401c0c-401c3d 108->112 111->103 115 401c44-401c5b call 401a40 112->115 116 401c3f 112->116 119 401c62-401c93 115->119 120 401c5d 115->120 116->103 123 401c95 119->123 124 401c9a-401cb1 call 401a40 119->124 120->103 123->103 127 401cb3 124->127 128 401cb8-401ce9 124->128 127->103 131 401cf0-401d07 call 401a40 128->131 132 401ceb 128->132 135 401d09 131->135 136 401d0b-401d3c 131->136 132->103 135->103 139 401d40-401d57 call 401a40 136->139 140 401d3e 136->140 143 401d59 139->143 144 401d5b-401d80 call 401d94 call 401dc2 139->144 140->103 143->103 147 401d83 144->147 147->103
                                          APIs
                                          • RtlCreateHeap.NTDLL(00001002,00000000,00000000,00000000,00000000,00000000), ref: 00401B96
                                          • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000), ref: 00401BBB
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: CreateHeap
                                          • String ID:
                                          • API String ID: 10892065-0
                                          • Opcode ID: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                                          • Instruction ID: eac1ce902914894448f3c06d12ced00cbe17960004271ddceb971b2a38276b5e
                                          • Opcode Fuzzy Hash: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                                          • Instruction Fuzzy Hash: 34513034A80A04FBD7109B60ED09B5B7770FF18701F2086BAE6117A2F1D775A5859F8D

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 150 4022dc-40232e 154 402330 150->154 155 402335-402347 GetShortPathNameW 150->155 156 402483-402487 154->156 157 402349-402359 155->157 158 40235e-402380 155->158 159 402495-402499 156->159 160 402489-40248f 156->160 157->156 168 402382 158->168 169 402387-402425 158->169 163 4024a7-4024ab 159->163 164 40249b-4024a1 159->164 160->159 165 4024b9-4024bf 163->165 166 4024ad-4024b3 163->166 164->163 166->165 168->156 175 402427 169->175 176 402429-402481 ShellExecuteW 169->176 175->156 176->156
                                          APIs
                                          • GetShortPathNameW.KERNELBASE(00000000,00000000,?), ref: 00402340
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: NamePathShort
                                          • String ID:
                                          • API String ID: 1295925010-0
                                          • Opcode ID: a0a4f684a9d9108a63d91a30c19249ae39ae68594d14297edb71c581cb82e24b
                                          • Instruction ID: 5bcac900e59d09c9622bdf940851d370624af246baed8abb1bc217228d1f7e1b
                                          • Opcode Fuzzy Hash: a0a4f684a9d9108a63d91a30c19249ae39ae68594d14297edb71c581cb82e24b
                                          • Instruction Fuzzy Hash: B6514E75900606EFDB00DF90E948B9EFB71FF48301F2082A9E6156B2A1C375AA91DFC5

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 213 4026c0-4026e5 call 4024f8 215 402730-402734 213->215 216 4026e7-402709 CreateFileW 213->216 218 402742-402746 215->218 219 402736-40273c 215->219 216->215 217 40270b-402727 ReadFile 216->217 217->215 220 402729 217->220 221 402754-40275a 218->221 222 402748-40274e 218->222 219->218 220->215 222->221
                                          APIs
                                          • CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004026FF
                                          • ReadFile.KERNELBASE(000000FF,000000FF,0000021C,?,00000000), ref: 00402722
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: File$CreateRead
                                          • String ID:
                                          • API String ID: 3388366904-0
                                          • Opcode ID: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                                          • Instruction ID: dec784d2d3492f4c007a4c80bb83cd8b4abde05e7af7cfb80cb91198c32a9eba
                                          • Opcode Fuzzy Hash: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                                          • Instruction Fuzzy Hash: 7511D774910209EFDB10DF94DD48B9FBBB5FB08311F2046A9A524B62E1D7B15A91CF84

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 224 401a40-401a5a 225 401a5d-401a77 RtlAllocateHeap 224->225 226 401a85-401a94 call 401e78 225->226 227 401a79-401a82 225->227 230 401ac5-401ac8 226->230 231 401a96-401ac0 call 401e78 226->231 233 401af6-401af9 230->233 234 401aca-401af4 call 401e78 230->234 239 401b4d-401b55 231->239 237 401b11-401b14 233->237 238 401afb-401b0f 233->238 234->239 241 401b16-401b2a 237->241 242 401b2c-401b2f 237->242 238->239 239->225 243 401b5b-401b6b 239->243 241->239 242->239 244 401b31-401b47 242->244 244->239
                                          APIs
                                          • RtlAllocateHeap.NTDLL(00000000,00000008,00000010), ref: 00401A6D
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: AllocateHeap
                                          • String ID:
                                          • API String ID: 1279760036-0
                                          • Opcode ID: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                                          • Instruction ID: 68c0462a3af62cc3e50a8e225ecc1fff045641083c52707b2e4de1a33f1d8fac
                                          • Opcode Fuzzy Hash: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                                          • Instruction Fuzzy Hash: 9F316935A14308DFDB10CF99C488E99F7F1BF24320F15D0AAD508AB2B2D7B59950DB4A

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 245 402e10-402e35 247 402e37 245->247 248 402e39-402e4e 245->248 249 402eab-402eb7 247->249 253 402e50 248->253 254 402e52-402e57 248->254 250 402ec5-402eca 249->250 251 402eb9-402ebf 249->251 251->250 253->249 255 402e5c-402e6d 254->255 257 402e70-402e7a 255->257 257->257 258 402e7c-402e8f MoveFileExW 257->258 259 402e91 258->259 260 402e93-402ea9 258->260 259->249 260->249 260->255
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                                          • Instruction ID: 64be472d3da9365df722bb42b6a14b0a0006b9682bbf08d732ce7ada7e71b141
                                          • Opcode Fuzzy Hash: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                                          • Instruction Fuzzy Hash: 8A214C71940208EFDB109F90DE49B9ABB71FF18301F2081BAE505AA2E1D3759E91DF89

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 262 402a78-402a9c call 4028ba 264 402aa3-402ac2 262->264 265 402a9e 262->265 270 402ac4-402ad3 264->270 271 402ad5-402ae0 264->271 266 402b28-402b2c 265->266 267 402b3a-402b40 266->267 268 402b2e-402b34 266->268 268->267 270->266 274 402ae2-402ae8 271->274 275 402aea 271->275 276 402af0-402b1f CreateMutexW 274->276 275->276 276->266 277 402b21 276->277 277->266
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                                          • Instruction ID: 5f31ce468cef0475a522e9655e813cee8f96e501922e94d34a843d9ecc1c4f5f
                                          • Opcode Fuzzy Hash: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                                          • Instruction Fuzzy Hash: A921F974901608EFDB00CF90EA8C79EBB71FF08301F6045A9E5017A2A0D7B95A85DF89

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 279 401474-401488 280 40148a-40148d 279->280 281 4014ac-4014b3 call 4013f8 279->281 282 401493-401498 280->282 285 4014b8-4014d2 LdrLoadDll 281->285 282->282 284 40149a-4014aa call 4013f8 282->284 284->285
                                          APIs
                                          • LdrLoadDll.NTDLL(00000000,00000000,00000000,?), ref: 004014C4
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: Load
                                          • String ID:
                                          • API String ID: 2234796835-0
                                          • Opcode ID: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                                          • Instruction ID: 140de97a3c31e0856ca0b204e221eb1e366fb0b1d4fd9a07ba92ba20ce5f8dd4
                                          • Opcode Fuzzy Hash: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                                          • Instruction Fuzzy Hash: F7F03C3690020DFADF10EAA4D848FDE77BCEB14314F0041A6E904B7190D238AA099BA5
                                          APIs
                                          • RtlAdjustPrivilege.NTDLL(?,00000001,00000000,00000000), ref: 00402861
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: AdjustPrivilege
                                          • String ID:
                                          • API String ID: 3260937286-0
                                          • Opcode ID: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                                          • Instruction ID: 70193a9dbc7aa9cd3770003b3bb97339f6e2972f30e24310785a39762e1cef45
                                          • Opcode Fuzzy Hash: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                                          • Instruction Fuzzy Hash: B9E0263251821AABCB20A2189E0CBA7739DD744314F1043B6A805F71D1EAF69A0A87DA
                                          APIs
                                          • RtlAllocateHeap.NTDLL(?,00000008,?), ref: 004020D7
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.2525521418.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 0000000A.00000002.2525464565.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525576708.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525630422.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                          • Associated: 0000000A.00000002.2525675555.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_400000_D9D5.jbxd
                                          Similarity
                                          • API ID: AllocateHeap
                                          • String ID:
                                          • API String ID: 1279760036-0
                                          • Opcode ID: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                                          • Instruction ID: 701e22a529f931561d5ec47da2ef603e250127bb9ab3ab4db12cbc5835053477
                                          • Opcode Fuzzy Hash: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                                          • Instruction Fuzzy Hash: 05D0C97A140609ABC6009F94E949D87F769FF58711B00C6A1BA045B222C630E890CFD4