Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
zhbEGHo55P.exe

Overview

General Information

Sample name:zhbEGHo55P.exe
renamed because original name is a hash value
Original sample name:82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe
Analysis ID:1558517
MD5:6c755a742f2b2e5c1820f57d0338365f
SHA1:0b22b6e5269ec241b82450a7e65009685a3010fb
SHA256:82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69
Tags:exeuser-JAMESWT_MHT
Infos:

Detection

LockBit ransomware
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected LockBit ransomware
AI detected suspicious sample
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Deletes itself after installation
Found Tor onion address
Found potential ransomware demand text
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Tries to harvest and steal browser information (history, passwords, etc)
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Writes to foreign memory regions
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to clear windows event logs (to hide its activities)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Enables security privileges
PE file contains an invalid checksum
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • zhbEGHo55P.exe (PID: 3656 cmdline: "C:\Users\user\Desktop\zhbEGHo55P.exe" MD5: 6C755A742F2B2E5C1820F57D0338365F)
    • splwow64.exe (PID: 2248 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
    • 3B5A.tmp (PID: 2620 cmdline: "C:\ProgramData\3B5A.tmp" MD5: 294E9F64CB1642DD89229FFF0592856B)
      • cmd.exe (PID: 6440 cmdline: "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3B5A.tmp >> NUL MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • ONENOTE.EXE (PID: 5844 cmdline: /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{D79D5AAD-BC63-41DE-AE42-49492D7025DC}.xps" 133764973860940000 MD5: 0061760D72416BCF5F2D9FA6564F0BEA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
    00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
      00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
        00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmpWindows_Ransomware_Lockbit_369e1e94unknownunknown
        • 0x1841d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
        • 0xbc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
        Process Memory Space: zhbEGHo55P.exe PID: 3656JoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.2.zhbEGHo55P.exe.e00000.0.unpackJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
            0.2.zhbEGHo55P.exe.e00000.0.unpackWindows_Ransomware_Lockbit_369e1e94unknownunknown
            • 0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
            • 0x2bc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...

            Sigma Signatures

            ⊘No Sigma rule has matched

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: zhbEGHo55P.exeAvira: detected
            Antivirus detection for URL or domain
            Source: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionAvira URL Cloud: Label: malware
            Source: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionAvira URL Cloud: Label: malware
            Antivirus detection for dropped file
            Source: C:\ProgramData\3B5A.tmpAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
            Multi AV Scanner detection for dropped file
            Source: C:\ProgramData\3B5A.tmpReversingLabs: Detection: 86%
            Multi AV Scanner detection for submitted file
            Source: zhbEGHo55P.exeReversingLabs: Detection: 94%
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for dropped file
            Source: C:\ProgramData\3B5A.tmpJoe Sandbox ML: detected
            Machine Learning detection for sample
            Source: zhbEGHo55P.exeJoe Sandbox ML: detected
            Source: zhbEGHo55P.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Videos\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Searches\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Saved Games\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Recent\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Pictures\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Pictures\Saved Pictures\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Pictures\Camera Roll\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\OneDrive\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Music\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Links\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Favorites\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Favorites\Links\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Downloads\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\TQDFJHPUIU\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\QCOILOQIKC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\NVWZAPQSQL\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\LIJDSFKJZG\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\GLTYDMDUST\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\EOWRVPQCCS\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\EFOYFBOLXA\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\EEGWXUHVUG\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\DUUDTUBZFW\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\TQDFJHPUIU\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\QCOILOQIKC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\NVWZAPQSQL\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\LIJDSFKJZG\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\GLTYDMDUST\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\EOWRVPQCCS\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\EFOYFBOLXA\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\EEGWXUHVUG\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\DUUDTUBZFW\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Contacts\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Headlights\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\7f127c30-a3b8-4aab-b28d-01f679ac280d\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\VirtualStore\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5652_1417691134\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5156_110794397\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Low\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_965461321\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_62919943\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_601093063\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_423664317\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_320437163\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_236606693\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_2073859434\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1819848164\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1798580215\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1779658456\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1763153001\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1740856358\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1725894609\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_17058258\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1567651471\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1239538394\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1077836906\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1012409649\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrocef_low\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\PeerDistRepub\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83e066fd-b384-48a0-aa9a-a84b64b92fcb}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3c6c2934-0fe6-436b-88a8-a2fbe2de3751}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: zhbEGHo55P.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\El4CmMA.EUPTJQjet source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\EUPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F72000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: zhbEGHo55P.exe, 00000000.00000003.2365604223.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2365448759.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ownload.errortt source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390480967.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385693273.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2387933180.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2388484993.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2395294951.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2392743496.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2397792630.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390941477.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\EUPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F45000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorF source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ad_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\EUPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382963901.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377813086.0000000000F72000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\IIdBIRa.EUPTJQjet0 source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ice\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\UPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\IIdBIRa.EUPTJQjet` source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\EUPTJQjet.README.txtE source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F45000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2v source: zhbEGHo55P.exe, 00000000.00000003.2365604223.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2365448759.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\UPTJQjet.README.txtLr source: zhbEGHo55P.exe, 00000000.00000003.2411212107.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390480967.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2405011103.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2406769539.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385693273.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2401189534.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2387933180.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2388484993.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2395294951.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2404192250.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2399827167.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2392743496.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2397792630.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2403895684.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2408003222.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390941477.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2402089878.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2403697628.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: lmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$ source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$ source: zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: lmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390901099.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\El4CmMA.EUPTJQjetne source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F45000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\EUPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F45000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\EUPTJQjet.README.txt_0 source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\UPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2365604223.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\UPTJQjet.README.txtt source: zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2365604223.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2365448759.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E074BC FindFirstFileExW,FindNextFileW,0_2_00E074BC
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0A094 FindFirstFileExW,FindClose,0_2_00E0A094
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E05C24 FindFirstFileW,FindClose,FindNextFileW,FindClose,0_2_00E05C24
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E07590 FindFirstFileExW,FindClose,0_2_00E07590
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0766C FindFirstFileExW,GetFileAttributesW,FindNextFileW,0_2_00E0766C
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0F308 GetFileAttributesW,SetThreadPriority,FindFirstFileExW,FindNextFileW,FindClose,0_2_00E0F308
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_0040227C FindFirstFileExW,7_2_0040227C
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,7_2_0040152C
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E07468 GetLogicalDriveStringsW,GetDriveTypeW,0_2_00E07468
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Jump to behavior

            Networking

            barindex
            Found Tor onion address
            Source: zhbEGHo55P.exe, 00000000.00000003.2552760214.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2552760214.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2648226451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2648226451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2297273167.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2297273167.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2422682512.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2422682512.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2504179596.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2504179596.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2296498981.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2296498981.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2476991809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2476991809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2650826923.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2650826923.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2450140900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2450140900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2290593821.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2290593821.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2440046436.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2440046436.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2606429007.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2606429007.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2639055540.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2639055540.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2454336369.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2454336369.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2587777133.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2587777133.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2314496043.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2314496043.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2503379476.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2503379476.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2515089028.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2515089028.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2285717895.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2285717895.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2514251222.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2514251222.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2279288820.0000000000F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2279288820.0000000000F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2433314867.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2433314867.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2581174848.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2581174848.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2454981543.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2454981543.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2405199774.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2405199774.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2323190189.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2323190189.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2529982078.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2529982078.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2534619718.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2534619718.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2301454401.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2301454401.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2594369966.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2594369966.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2490051782.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2490051782.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2301980387.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2301980387.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2593038756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2593038756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2424974864.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2424974864.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2543995067.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2543995067.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2527798294.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2527798294.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2460383683.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2460383683.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2514742163.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2514742163.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2465387132.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2465387132.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2643637799.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2643637799.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2303534653.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2303534653.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2439822951.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2439822951.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2602968931.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2602968931.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2658606866.0000000000F6A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2658606866.0000000000F6A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2497321700.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2497321700.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2563364825.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2563364825.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2405011103.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2405011103.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2443562164.0000000000F62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2443562164.0000000000F62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2532900142.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2532900142.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2407794773.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2407794773.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2575689342.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2575689342.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2445632152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2445632152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2672339183.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2672339183.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2505422046.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2505422046.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2465975591.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2465975591.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2530897421.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2530897421.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2351932671.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2517891534.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2517891534.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2582211101.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2582211101.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2700340015.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2700340015.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2624572778.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2624572778.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2605053255.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2605053255.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2444154759.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2444154759.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2615314191.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2615314191.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2558182773.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2558182773.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2315813387.0000000000F60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2315813387.0000000000F60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2624022072.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2624022072.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2550432472.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2550432472.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2298745251.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2298745251.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2329090344.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2329090344.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2425167377.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2425167377.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2672202444.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2672202444.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2363395679.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2363395679.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2388292737.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2388292737.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2315813387.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2315813387.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2533782084.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2533782084.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2638663286.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2638663286.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2501571701.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2501571701.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2292692990.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2292692990.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2656841718.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2656841718.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2412898221.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2412898221.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2306134304.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2306134304.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2289891973.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2289891973.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2311812250.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2311812250.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2598449828.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2598449828.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2557564232.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2557564232.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2527124552.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2527124552.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2462433496.0000000000F60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2462433496.0000000000F60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2411212107.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2411212107.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2326078121.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2326078121.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2598449828.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2598449828.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2421867005.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2421867005.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2431172890.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2431172890.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2453207669.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2453207669.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2663756924.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2663756924.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2629228044.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2629228044.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2492185762.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2492185762.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2435420753.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2435420753.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2406769539.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2406769539.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2326078121.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2326078121.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2642313205.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2642313205.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2299826761.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2299826761.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2488545517.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2488545517.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2448131750.0000000000F62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2448131750.0000000000F62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2603615010.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2603615010.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2638271600.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2638271600.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2550432472.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2550432472.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2536749612.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2536749612.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2577733624.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2577733624.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2395536838.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2395536838.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2524971754.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2524971754.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2613734789.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2613734789.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2610292246.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2610292246.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2324302390.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2324302390.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2567505873.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2567505873.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2664869208.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2664869208.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2590004910.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2590004910.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2578555238.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2578555238.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2481703573.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2481703573.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2647565923.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2647565923.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onional8>
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf>
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionins>
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionL>
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionY>
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionc
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionin
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionl
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion$?
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion]1?
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionh?
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionV?
            Source: zhbEGHo55P.exe, 00000000.00000003.2571088827.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2571088827.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2622331629.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2622331629.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2633284194.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2633284194.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2516009437.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2516009437.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2675945135.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2675945135.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2444435410.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2444435410.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2585446762.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2585446762.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2508671546.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2508671546.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2449322805.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2449322805.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2585227889.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2585227889.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2327053169.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2327053169.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2287544018.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2287544018.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2433542277.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2433542277.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2279087961.0000000000F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2279087961.0000000000F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2310044248.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2310044248.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2606810002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2606810002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2629228044.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2629228044.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2437367323.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2437367323.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2506659900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2506659900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2544519592.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2544519592.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2529621540.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2529621540.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2592668977.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2592668977.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2602968931.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2602968931.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2338435267.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2338435267.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2489163793.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2489163793.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2322094334.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2322094334.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2451730388.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2451730388.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2520502396.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2520502396.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2392743496.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2392743496.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2616214986.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2616214986.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2309319380.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2309319380.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2634094613.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2634094613.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2608493068.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2608493068.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2402089878.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2402089878.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2647565923.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2647565923.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2289694328.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2289694328.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2351932671.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2351932671.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2622077410.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2622077410.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2438465100.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2438465100.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2434652753.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2434652753.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2571431495.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2571431495.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2559211620.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2559211620.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2419975975.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2419975975.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2542047296.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2542047296.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2671114590.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2671114590.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2282402728.0000000000F26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2593565260.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2593565260.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2607936055.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2607936055.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2327053169.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2327053169.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2484493346.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2484493346.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2343563174.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2343563174.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2596072250.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2596072250.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2524181179.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2524181179.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2451232879.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2451232879.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2543750016.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2543750016.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2465387132.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2465387132.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2633284194.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2633284194.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2387674973.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2387674973.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2415697667.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2415697667.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2545780067.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2545780067.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2538835869.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2538835869.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2306794786.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2306794786.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2570757223.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2570757223.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2447369022.0000000000F62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2447369022.0000000000F62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2437602818.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2437602818.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2582643331.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2582643331.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2436441527.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2436441527.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2591738495.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2591738495.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2444872029.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2444872029.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2541792469.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2541792469.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2615607877.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2615607877.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2618092726.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2618092726.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2493869607.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2493869607.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2594369966.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2594369966.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2303174682.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2303174682.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2317048660.0000000000F60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2317048660.0000000000F60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2397792630.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2397792630.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2485469297.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2485469297.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2297770409.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2297770409.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2553009581.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2553009581.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2472881113.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2472881113.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2499567821.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2499567821.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2666469638.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2666469638.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2445802006.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2445802006.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2495200487.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2495200487.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2429577214.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2429577214.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2595030173.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2595030173.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2474497361.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2474497361.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2338552853.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2338552853.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2285196777.0000000000F36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2285196777.0000000000F36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2414335809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2414335809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2587263859.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2587263859.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2577733624.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2577733624.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2316910822.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2316910822.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2630619188.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2630619188.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2578834940.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2578834940.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2403697628.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2403697628.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2513906951.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2513906951.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2483623697.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2483623697.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2440566969.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2440566969.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2661208401.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2661208401.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2508350478.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2508350478.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2599734515.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2599734515.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2416819770.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2416819770.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2533782084.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2533782084.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2422398452.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2422398452.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2289495856.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2289495856.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2322094334.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2322094334.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2315813387.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2315813387.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2575019861.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2575019861.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2528575841.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2528575841.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2290797544.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2290797544.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2673356984.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2673356984.0000000000F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2317838081.0000000000F60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2317838081.0000000000F60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2486064811.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2486064811.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2552760214.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2648226451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2297273167.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2422682512.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2504179596.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2296498981.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2476991809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2650826923.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2450140900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2290593821.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2440046436.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2606429007.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2639055540.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2454336369.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2587777133.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2314496043.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2503379476.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2515089028.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2285717895.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2514251222.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2279288820.0000000000F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, SPL1013.tmp.0.drString found in binary or memory: http://lockbitapt.uz
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
            Source: SPL1013.tmp.0.drString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionY
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onional8
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionc
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionl
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion$?
            Source: SPL1013.tmp.0.drString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionL
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionV?
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionins
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
            Source: SPL1013.tmp.0.drString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionh?
            Source: zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionin
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupp.uz
            Source: SPL1013.tmp.0.drString found in binary or memory: http://lockbitsupp.uzFFFFFFFFFFFFFFFFFFFFF
            Source: zhbEGHo55P.exe, 00000000.00000003.2552760214.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2648226451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2297273167.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2422682512.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2504179596.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2296498981.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2476991809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2650826923.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2450140900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2290593821.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2440046436.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2606429007.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2639055540.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2454336369.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2587777133.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2314496043.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2503379476.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2515089028.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2285717895.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2514251222.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2279288820.0000000000F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
            Source: zhbEGHo55P.exe, 00000000.00000003.2476991809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2650826923.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2450140900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2290593821.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2440046436.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2606429007.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2639055540.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2454336369.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2587777133.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2314496043.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2503379476.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2515089028.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2285717895.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2514251222.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2279288820.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2433314867.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2581174848.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2454981543.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2405199774.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2323190189.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2529982078.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.torproject.org/

            Spam, unwanted Advertisements and Ransom Demands

            barindex
            Found ransom note / readme
            Source: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtDropped file: Hello! Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.--- Our communication process:1. You contact us.2. We send you a list of files that were stolen.3. We decrypt 1 file to confirm that our decryptor works.4. We agree on the amount, which must be paid using BTC.5. We delete your files, we give you a decryptor.6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- Client area (use this site to contact us):Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.* In order to access the site, you will need Tor Browser, you can download it from this link: https://www.torproject.org/--- Additional contacts:Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20--- Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged.DO NOT RENAME OR MOVE the encrypted and readme files.DO NOT DELETE readme files.--- Important:If you refuse to pay or do not get in touch with us, we start publishing your files.26/04/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onionSincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101Jump to dropped file
            Yara detected LockBit ransomware
            Source: Yara matchFile source: 0.2.zhbEGHo55P.exe.e00000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: zhbEGHo55P.exe PID: 3656, type: MEMORYSTR
            Found potential ransomware demand text
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedg
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedE
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypteds
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptede
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedl
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedeT
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted^
            Source: zhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedg
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedE
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypteds
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptede
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedl
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedeT
            Source: zhbEGHo55P.exe, 00000000.00000002.2852617018.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted^
            Source: SPL1013.tmp.0.drString found in binary or memory : Your data are stolen and encryptedFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
            Modifies existing user documents (likely ransomware behavior)
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile moved: C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.pngJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile moved: C:\Users\user\Desktop\EEGWXUHVUG\NVWZAPQSQL.xlsxJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile moved: C:\Users\user\Desktop\EOWRVPQCCS.jpgJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile moved: C:\Users\user\Desktop\NVWZAPQSQL.xlsxJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile moved: C:\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.pngJump to behavior
            Writes a notice file (html or txt) to demand a ransom
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile dropped: C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt -> decrypt 1 file to confirm that our decryptor works.4. we agree on the amount, which must be paid using btc.5. we delete your files, we give you a decryptor.6. we give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- client area (use this site to contact us):link for tor browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion>>> use this id: 39c1bacacedfec0f0089a12ec6a0dff4 to begin the recovery process.* in order to access the site, you will need tor browser, you can download it from this link: https://www.torproject.org/--- additional contacts:support tox: 1c054b722bcbf41a918ef3c485712742088f5c3e81b2fdd91adea6ba55f4a856d90a65e99d20--- recommendations: do not reset or shutdown - files may be damaged.do not rename or move the encrypted and readme files.do not delete readme files.--- important:if you refuse to pay or do not get in touch with usJump to dropped file
            Writes many files with high entropy
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\FlZxH2s.EUPTJQjet entropy: 7.99493182187Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\g9CYSNi.EUPTJQjet entropy: 7.99435299519Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\1OhAzBo.EUPTJQjet entropy: 7.99536598471Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\eNCVpLq.EUPTJQjet entropy: 7.99480033151Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\L1qUIpp.EUPTJQjet entropy: 7.99456541243Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\4DM2Gmv.EUPTJQjet entropy: 7.99557894029Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\dV917sj.EUPTJQjet entropy: 7.99543597253Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\ozHCh9b.EUPTJQjet entropy: 7.99480277496Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\YKT5YBO.EUPTJQjet entropy: 7.99477453532Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\duSe6Cp.EUPTJQjet entropy: 7.99517541472Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\eckcujo.EUPTJQjet entropy: 7.99483836602Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\7I6rPrM.EUPTJQjet entropy: 7.99469431136Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\NVMmR0x.EUPTJQjet entropy: 7.9948865043Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\lC3IX32.EUPTJQjet entropy: 7.99513675136Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\f4rjyfY.EUPTJQjet entropy: 7.99455529852Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\sex6yk8.EUPTJQjet entropy: 7.99506954451Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\mapuGD5.EUPTJQjet entropy: 7.99478814674Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\opyt6rz.EUPTJQjet entropy: 7.99521165787Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\JQvluum.EUPTJQjet entropy: 7.99472914712Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\w7iMD8h.EUPTJQjet entropy: 7.99550606515Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\LE9WQlS.EUPTJQjet entropy: 7.99550154556Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\dlFuARc.EUPTJQjet entropy: 7.99525474739Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\R60A3SY.EUPTJQjet entropy: 7.99506334379Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\XDeAwQK.EUPTJQjet entropy: 7.99431692704Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Y9iPdCS.EUPTJQjet entropy: 7.99470916967Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\lYRIZRn.EUPTJQjet entropy: 7.99424140712Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\3n642bg.EUPTJQjet entropy: 7.994767723Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\3ld25BO.EUPTJQjet entropy: 7.99425523845Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\VDmSOwh.EUPTJQjet entropy: 7.99521488867Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\9YjQYq6.EUPTJQjet entropy: 7.9940229052Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Ncd5nAT.EUPTJQjet entropy: 7.99504361173Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\00Ao58v.EUPTJQjet entropy: 7.99491315756Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\fjWevQE.EUPTJQjet entropy: 7.99499536459Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\l1QouX7.EUPTJQjet entropy: 7.9955512602Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\J9llIZR.EUPTJQjet entropy: 7.99539658098Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\GTw5HPj.EUPTJQjet entropy: 7.9954207629Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\yA2eyTn.EUPTJQjet entropy: 7.99387227088Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\QqBi7zj.EUPTJQjet entropy: 7.99459834059Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\oJfdn4X.EUPTJQjet entropy: 7.99455091871Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\IPAAwnT.EUPTJQjet entropy: 7.99553089613Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\y56issZ.EUPTJQjet entropy: 7.99450395273Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\AOc1zKT.EUPTJQjet entropy: 7.99495655822Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\0iJf6oH.EUPTJQjet entropy: 7.99460151478Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\liAG2zD.EUPTJQjet entropy: 7.99559076152Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\iDY7dWc.EUPTJQjet entropy: 7.99555861764Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\oWqeWwS.EUPTJQjet entropy: 7.99532807703Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\CcPHJEq.EUPTJQjet entropy: 7.99584827584Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\JYDzpUJ.EUPTJQjet entropy: 7.99549884278Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\ic45FFK.EUPTJQjet entropy: 7.99456550813Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\rZjTVQS.EUPTJQjet entropy: 7.99547914808Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Yi6PAyl.EUPTJQjet entropy: 7.99492995221Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\iK9NSTJ.EUPTJQjet entropy: 7.9948645216Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\xLRcjBR.EUPTJQjet entropy: 7.99554807968Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\aMB9eEi.EUPTJQjet entropy: 7.99525486018Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\WZg7yeT.EUPTJQjet entropy: 7.99532237513Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\9Fde9uN.EUPTJQjet entropy: 7.9953690456Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\hz6Voz2.EUPTJQjet entropy: 7.99552115459Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\3FlJDxY.EUPTJQjet entropy: 7.99481339397Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\naPBDt6.EUPTJQjet entropy: 7.9951340448Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\CnbdfpE.EUPTJQjet entropy: 7.99525782099Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\F3FDeZA.EUPTJQjet entropy: 7.99509660037Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\g8r1oNu.EUPTJQjet entropy: 7.99481585497Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\oajDB6n.EUPTJQjet entropy: 7.99597188418Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MhmrXou.EUPTJQjet entropy: 7.99456559194Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\hUpOPop.EUPTJQjet entropy: 7.99468850646Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\15mukzw.EUPTJQjet entropy: 7.99577988919Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Kxwla7v.EUPTJQjet entropy: 7.99581563184Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\uOzS8gV.EUPTJQjet entropy: 7.99532307595Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\J1sC999.EUPTJQjet entropy: 7.99505733913Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\pBohiXa.EUPTJQjet entropy: 7.99523839094Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\yuzXwmq.EUPTJQjet entropy: 7.99511852782Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Sa89Iww.EUPTJQjet entropy: 7.99514162675Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\aAedI9k.EUPTJQjet entropy: 7.99429278411Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\q4CFJnx.EUPTJQjet entropy: 7.99644184087Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\TGdEds8.EUPTJQjet entropy: 7.99459775843Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\vi4XvhV.EUPTJQjet entropy: 7.99611678345Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\deIuDfB.EUPTJQjet entropy: 7.9943896911Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\EdFJPef.EUPTJQjet entropy: 7.99413192667Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\A85vXOE.EUPTJQjet entropy: 7.99473118952Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\SWSCRek.EUPTJQjet entropy: 7.9958323122Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\D09rMD1.EUPTJQjet entropy: 7.99448329816Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\oxsITlT.EUPTJQjet entropy: 7.99917760356Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\iuDWUtG.EUPTJQjet entropy: 7.99388042093Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\qDzjXWu.EUPTJQjet entropy: 7.9918189947Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\LguFA6y.EUPTJQjet entropy: 7.99724222182Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\3AlcjmV.EUPTJQjet entropy: 7.99839864455Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\swK1I7z.EUPTJQjet entropy: 7.99523675574Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\NhlGfpp.EUPTJQjet entropy: 7.99582591531Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\43wXwns.EUPTJQjet entropy: 7.99522865174Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\bhnllJ0.EUPTJQjet entropy: 7.99534151446Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\FjK7yt2.EUPTJQjet entropy: 7.99452653437Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\KA3bcx2.EUPTJQjet entropy: 7.99577409745Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\dNggjpN.EUPTJQjet entropy: 7.99541982262Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\cYCClYQ.EUPTJQjet entropy: 7.99535432942Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\YnzxR8K.EUPTJQjet entropy: 7.99529946778Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Tdq0kJo.EUPTJQjet entropy: 7.9944732843Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\2yIcAqm.EUPTJQjet entropy: 7.99395045262Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\YKufZth.EUPTJQjet entropy: 7.99965397035Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\tEn9BbN.EUPTJQjet entropy: 7.99457970559Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\FsNYcLU.EUPTJQjet entropy: 7.99475026467Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\AGGa1BH.EUPTJQjet entropy: 7.99500285106Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\ENFCPnq.EUPTJQjet entropy: 7.99557542619Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\VcbaEWc.EUPTJQjet entropy: 7.99419193497Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\cxUtfQb.EUPTJQjet entropy: 7.99459197853Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\HcQ5qVf.EUPTJQjet entropy: 7.9996270829Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\26aF3Sp.EUPTJQjet entropy: 7.99964193222Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\lVUf9iz.EUPTJQjet entropy: 7.99965539896Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\420rzgy.EUPTJQjet entropy: 7.99453952637Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\zenmzHB.EUPTJQjet entropy: 7.9970446428Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\XWguEz9.EUPTJQjet entropy: 7.99908080366Jump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\xcYbgjA.EUPTJQjet entropy: 7.99921162919Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\zhbEGHo55P.exe entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\AAAAAAAAAAAAAA (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\BBBBBBBBBBBBBB (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\CCCCCCCCCCCCCC (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\DDDDDDDDDDDDDD (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\EEEEEEEEEEEEEE (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\FFFFFFFFFFFFFF (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\GGGGGGGGGGGGGG (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\HHHHHHHHHHHHHH (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\IIIIIIIIIIIIII (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\JJJJJJJJJJJJJJ (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\KKKKKKKKKKKKKK (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\LLLLLLLLLLLLLL (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\MMMMMMMMMMMMMM (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\NNNNNNNNNNNNNN (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\OOOOOOOOOOOOOO (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\PPPPPPPPPPPPPP (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\QQQQQQQQQQQQQQ (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\RRRRRRRRRRRRRR (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\SSSSSSSSSSSSSS (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\TTTTTTTTTTTTTT (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\UUUUUUUUUUUUUU (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\VVVVVVVVVVVVVV (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\WWWWWWWWWWWWWW (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\XXXXXXXXXXXXXX (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\YYYYYYYYYYYYYY (copy) entropy: 7.99703182947Jump to dropped file
            Source: C:\ProgramData\3B5A.tmpFile created: C:\Users\user\Desktop\ZZZZZZZZZZZZZZ (copy) entropy: 7.99703182947Jump to dropped file

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 0.2.zhbEGHo55P.exe.e00000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
            Source: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E104B4 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,CreateNamedPipeW,ResumeThread,ConnectNamedPipe,0_2_00E104B4
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E09880 NtClose,0_2_00E09880
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0DC60 NtTerminateProcess,0_2_00E0DC60
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0B470 NtProtectVirtualMemory,0_2_00E0B470
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0B444 NtSetInformationThread,0_2_00E0B444
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E17034 KiUserCallbackDispatcher,CreateThread,CreateThread,CreateThread,CreateThread,NtTerminateThread,CreateThread,CreateThread,0_2_00E17034
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0E1E8 CreateThread,NtClose,0_2_00E0E1E8
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E06668 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,NtFreeVirtualMemory,DeleteFileW,0_2_00E06668
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0B674 NtQueryInformationToken,0_2_00E0B674
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0DE78 SetThreadPriority,ReadFile,WriteFile,WriteFile,NtClose,0_2_00E0DE78
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E07E58 NtQuerySystemInformation,Sleep,0_2_00E07E58
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0B3C0 NtSetInformationThread,0_2_00E0B3C0
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E097D8 NtQuerySystemInformation,0_2_00E097D8
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E08F68 RtlAdjustPrivilege,NtSetInformationThread,0_2_00E08F68
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0B734 NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,0_2_00E0B734
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0982A NtQuerySystemInformation,0_2_00E0982A
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E09811 NtQuerySystemInformation,0_2_00E09811
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E07EA3 NtQuerySystemInformation,Sleep,0_2_00E07EA3
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E07E8A NtQuerySystemInformation,Sleep,0_2_00E07E8A
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E08F66 RtlAdjustPrivilege,NtSetInformationThread,0_2_00E08F66
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_00402760 CreateFileW,ReadFile,NtClose,7_2_00402760
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_0040286C NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,7_2_0040286C
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_00402F18 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW,7_2_00402F18
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_00401DC2 NtProtectVirtualMemory,7_2_00401DC2
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_00401D94 NtSetInformationThread,7_2_00401D94
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_004016B4 NtAllocateVirtualMemory,NtAllocateVirtualMemory,7_2_004016B4
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0A68C: GetVolumeNameForVolumeMountPointW,FindFirstVolumeW,GetVolumePathNamesForVolumeNameW,GetDriveTypeW,CreateFileW,DeviceIoControl,0_2_00E0A68C
            Source: C:\Windows\splwow64.exeFile created: C:\Windows\system32\spool\PRINTERS\00002.SPL
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E020AC0_2_00E020AC
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E080B80_2_00E080B8
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E04D030_2_00E04D03
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E04D080_2_00E04D08
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E052180_2_00E05218
            Source: Joe Sandbox ViewDropped File: C:\ProgramData\3B5A.tmp 917E115CC403E29B4388E0D175CBFAC3E7E40CA1742299FBDB353847DB2DE7C2
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess token adjusted: Security
            Source: zhbEGHo55P.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: 0.2.zhbEGHo55P.exe.e00000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
            Source: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
            Source: 3B5A.tmp.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: classification engineClassification label: mal100.rans.phis.spyw.evad.winEXE@9/1689@0/0
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeMutant created: \Sessions\1\BaseNamedObjects\Global\548aa41141e72339cf9daac6d40189a7
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
            Source: C:\ProgramData\3B5A.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\{649F4E29-16CB-DD42-8922-9FFF0592856B}
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Windows\splwow64.exeFile read: C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-manifest.ini
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: zhbEGHo55P.exeReversingLabs: Detection: 94%
            Source: unknownProcess created: C:\Users\user\Desktop\zhbEGHo55P.exe "C:\Users\user\Desktop\zhbEGHo55P.exe"
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess created: C:\ProgramData\3B5A.tmp "C:\ProgramData\3B5A.tmp"
            Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{D79D5AAD-BC63-41DE-AE42-49492D7025DC}.xps" 133764973860940000
            Source: C:\ProgramData\3B5A.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3B5A.tmp >> NUL
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess created: C:\ProgramData\3B5A.tmp "C:\ProgramData\3B5A.tmp"Jump to behavior
            Source: C:\ProgramData\3B5A.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3B5A.tmp >> NUL
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: samcli.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: logoncli.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: activeds.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: adsldpc.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: gpedit.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: dssec.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: dsuiext.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: framedynos.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: dsrole.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: ntdsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: authz.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: adsldp.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: mscms.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: coloradapterclient.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeSection loaded: wldp.dllJump to behavior
            Source: C:\ProgramData\3B5A.tmpSection loaded: apphelp.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: rstrtmgr.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: ncrypt.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: ntasn1.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: windows.storage.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: wldp.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: kernel.appcore.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: uxtheme.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: propsys.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: profapi.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: edputil.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: urlmon.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: iertutil.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: srvcli.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: netutils.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: windows.staterepositoryps.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: sspicli.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: wintypes.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: appresolver.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: bcp47langs.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: slc.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: userenv.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: sppc.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: onecorecommonproxystub.dll
            Source: C:\ProgramData\3B5A.tmpSection loaded: onecoreuapcommonproxystub.dll
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\InprocServer32Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.iniJump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
            Source: zhbEGHo55P.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\El4CmMA.EUPTJQjet source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\EUPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F72000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: zhbEGHo55P.exe, 00000000.00000003.2365604223.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2365448759.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ownload.errortt source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390480967.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385693273.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2387933180.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2388484993.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2395294951.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2392743496.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2397792630.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390941477.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\EUPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F45000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorF source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ad_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\EUPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382963901.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377813086.0000000000F72000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\IIdBIRa.EUPTJQjet0 source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ice\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\UPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\IIdBIRa.EUPTJQjet` source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\EUPTJQjet.README.txtE source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F45000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2v source: zhbEGHo55P.exe, 00000000.00000003.2365604223.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2365448759.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\UPTJQjet.README.txtLr source: zhbEGHo55P.exe, 00000000.00000003.2411212107.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390480967.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2405011103.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2406769539.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385693273.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2401189534.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367563247.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2387933180.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2388484993.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2395294951.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2404192250.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2399827167.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2392743496.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2397792630.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2403895684.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2408003222.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390941477.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2402089878.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2403697628.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: lmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$ source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$ source: zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: lmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zhbEGHo55P.exe, 00000000.00000003.2379770257.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2390901099.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\El4CmMA.EUPTJQjetne source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F45000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\EUPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F45000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\EUPTJQjet.README.txt_0 source: zhbEGHo55P.exe, 00000000.00000003.2378231819.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2385962002.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367898653.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2382002094.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366931152.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2366333505.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\UPTJQjet.README.txt source: zhbEGHo55P.exe, 00000000.00000003.2365604223.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\UPTJQjet.README.txtt source: zhbEGHo55P.exe, 00000000.00000003.2376581899.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2365604223.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2374943022.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2373288962.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2371778045.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2367406714.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2365448759.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp
            Source: 3B5A.tmp.0.drStatic PE information: real checksum: 0x8fd0 should be: 0x4f26
            Source: zhbEGHo55P.exeStatic PE information: real checksum: 0x0 should be: 0x23eb5
            Source: zhbEGHo55P.exeStatic PE information: section name: UPX2
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E061EE push esp; retf 0_2_00E061F6
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E035D3 push 0000006Ah; retf 0_2_00E03644
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E035D5 push 0000006Ah; retf 0_2_00E03644
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0356B push 0000006Ah; retf 0_2_00E03644
            Source: 3B5A.tmp.0.drStatic PE information: section name: .text entropy: 7.985216639497568
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\ProgramData\3B5A.tmpJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\ProgramData\3B5A.tmpJump to dropped file
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Videos\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Searches\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Saved Games\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Recent\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Pictures\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Pictures\Saved Pictures\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Pictures\Camera Roll\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\OneDrive\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Music\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Links\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Favorites\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Favorites\Links\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Downloads\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\TQDFJHPUIU\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\QCOILOQIKC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\NVWZAPQSQL\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\LIJDSFKJZG\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\GLTYDMDUST\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\EOWRVPQCCS\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\EFOYFBOLXA\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\EEGWXUHVUG\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Documents\DUUDTUBZFW\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\TQDFJHPUIU\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\QCOILOQIKC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\NVWZAPQSQL\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\LIJDSFKJZG\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\GLTYDMDUST\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\EOWRVPQCCS\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\EFOYFBOLXA\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\EEGWXUHVUG\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Desktop\DUUDTUBZFW\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\Contacts\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Headlights\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\7f127c30-a3b8-4aab-b28d-01f679ac280d\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\VirtualStore\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5652_1417691134\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5156_110794397\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Low\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_965461321\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_62919943\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_601093063\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_423664317\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_320437163\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_236606693\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_2073859434\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1819848164\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1798580215\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1779658456\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1763153001\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1740856358\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1725894609\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_17058258\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1567651471\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1239538394\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1077836906\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_5464_1012409649\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrocef_low\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\PeerDistRepub\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83e066fd-b384-48a0-aa9a-a84b64b92fcb}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3c6c2934-0fe6-436b-88a8-a2fbe2de3751}\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\EUPTJQjet.README.txtJump to behavior

            Hooking and other Techniques for Hiding and Protection

            barindex
            Deletes itself after installation
            Source: C:\ProgramData\3B5A.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3B5A.tmp >> NUL
            Source: C:\ProgramData\3B5A.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3B5A.tmp >> NUL
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E091C8 RegCreateKeyExW,RegEnumKeyW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,OpenEventLogW,ClearEventLogW,RegCreateKeyExW,RegEnumKeyW,OpenEventLogW,ClearEventLogW,0_2_00E091C8
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\ProgramData\3B5A.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Contains functionality to detect hardware virtualization (CPUID execution measurement)
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E010BC 0_2_00E010BC
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_00401E28 7_2_00401E28
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E010BC rdtsc 0_2_00E010BC
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E074BC FindFirstFileExW,FindNextFileW,0_2_00E074BC
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0A094 FindFirstFileExW,FindClose,0_2_00E0A094
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E05C24 FindFirstFileW,FindClose,FindNextFileW,FindClose,0_2_00E05C24
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E07590 FindFirstFileExW,FindClose,0_2_00E07590
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0766C FindFirstFileExW,GetFileAttributesW,FindNextFileW,0_2_00E0766C
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E0F308 GetFileAttributesW,SetThreadPriority,FindFirstFileExW,FindNextFileW,FindClose,0_2_00E0F308
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_0040227C FindFirstFileExW,7_2_0040227C
            Source: C:\ProgramData\3B5A.tmpCode function: 7_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,7_2_0040152C
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E07468 GetLogicalDriveStringsW,GetDriveTypeW,0_2_00E07468
            Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Jump to behavior
            Source: zhbEGHo55P.exe, 00000000.00000003.2377554605.0000000000FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 10/05/2023 06:31:11.105EXCEL (0x1EE0)0x24F0Microsoft ExcelTelemetry Eventb7vzqMediumSendEvent {"EventName":"Office.System.SystemHealthMetadataDeviceConsolidated","Flags":33777031581908737,"InternalSequenceNumber":148,"Time":"2023-10-05T06:31:08.304Z","Rule":"120600.4","Contract":"Office.Legacy.Metadata","Data.ProcTypeText":"x64","Data.ProcessorCount":2,"Data.NumProcShareSingleCore":1,"Data.NumProcShareSingleCache":1,"Data.NumProcPhysCores":2,"Data.ProcSpeedMHz":2000,"Data.IsLaptop":false,"Data.IsTablet":false,"Data.RamMB":4096,"Data.PowerPlatformRole":1,"Data.SysVolSizeMB":50000,"Data.DeviceManufacturer":"VMWare, Inc.","Data.DeviceModel":"VMware20,1","Data.DigitizerInfo":0,"Data.SusClientId":"097C77FB-5D5D-4868-860B-09F4E5B50A53","Data.WindowsSqmMachineId":"92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","Data.ComputerSystemProductUuidHash":"pNpni+sgFme2AbL0FaUYvRnb6Aw=","Data.DeviceProcessorModel":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","Data.HasSpectreFix":true,"Data.BootDiskType":"SSD"}
            Source: 3B5A.tmp, 00000007.00000002.2864147217.00000000006F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: zhbEGHo55P.exe, 00000000.00000003.2362670816.000000000103A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
            Source: zhbEGHo55P.exe, 00000000.00000003.2460795343.000000000104D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hyper-v:wux:hyper-v~
            Source: zhbEGHo55P.exe, 00000000.00000003.2316910822.0000000000F8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )VMCI
            Source: zhbEGHo55P.exe, 00000000.00000003.2362670816.000000000103A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware20,1
            Source: zhbEGHo55P.exe, 00000000.00000003.2700340015.0000000000F31000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess information queried: ProcessInformation

            Anti Debugging

            barindex
            Hides threads from debuggers
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\ProgramData\3B5A.tmpThread information set: HideFromDebugger
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E010BC rdtsc 0_2_00E010BC
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E05A20 LdrLoadDll,0_2_00E05A20
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess token adjusted: Debug

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeMemory written: C:\ProgramData\3B5A.tmp base: 401000Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeProcess created: C:\ProgramData\3B5A.tmp "C:\ProgramData\3B5A.tmp"Jump to behavior
            Source: C:\ProgramData\3B5A.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3B5A.tmp >> NUL
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E010BC cpuid 0_2_00E010BC
            Source: C:\ProgramData\3B5A.tmpCode function: EntryPoint,ExitProcess,GetModuleHandleW,GetCommandLineW,GetModuleHandleA,GetCommandLineW,GetLocaleInfoW,GetLastError,FreeLibrary,FreeLibrary,GetProcAddress,CreateWindowExW,DefWindowProcW,GetWindowTextW,LoadMenuW,LoadMenuW,DefWindowProcW,SetTextColor,GetTextCharset,TextOutW,SetTextColor,GetTextColor,CreateFontW,GetTextColor,CreateDIBitmap,SelectObject,GetTextColor,CreateFontW,7_2_00403983
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeCode function: 0_2_00E104B4 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,CreateNamedPipeW,ResumeThread,ConnectNamedPipe,0_2_00E104B4

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Overwrites Mozilla Firefox settings
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups\EUPTJQjet.README.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\EUPTJQjet.README.txtJump to behavior

            Stealing of Sensitive Information

            barindex
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\MiFnF08.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\EdFJPef.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\UBCSJLM.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\DBJmnXf.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\ls-archive.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\D09rMD1.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.dbJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\times.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\p2WXVQS.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\q4CFJnx.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\luRokCw.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\9JGPaqf.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\86928e7f-6ba2-4b62-8ea8-d89cfd7a97caJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\rj8XS8Z.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\b6281059-34c6-49d8-97c7-24de33b104abJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\vvKFAuA.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\d3698c60-da91-4f8c-b7c7-e14b40be8bb1Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\dd74a7e7-e73b-4ab9-8964-ca5c53c60966Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\kerr3sJ.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\aRnHayn.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\uolnHb0.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\compatibility.iniJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\Tr8rSwO.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838393.b7b7301e-d32e-49f7-b138-9fd21cf2ca6b.health.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\lI20xa0.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\session-state.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\NRMiOdc.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\2uMdmmu.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\4db4139f-6dcf-40ae-89c1-1ca4ca5a35edJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\AmjwmFo.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\state.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\mmfPvYM.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\sowfzvb.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\background-updateJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\8940dc38-b85f-4355-b090-8e4e300a9627Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\TGdEds8.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\SiteSecurityServiceState.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\UQVedfQ.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\iWtdOen.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\nZXNn6b.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\GveHEKL.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\hSbNHKN.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\fXLp9ua.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\zsqE47l.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\8czvcgD.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\previous.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\.metadata-v2Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832124.b6dd686f-a071-4a96-9ec4-4a8ffdac9d0c.first-shutdown.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\FDPlrx8.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\Lz2qrQQ.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\vJ8tVKk.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\eeQh4ms.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\YaAeQn2.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\pkcs11.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\b38522d7-1787-4855-a312-c27916e30610Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\Ld8u5RW.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\r5WydfZ.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\wXFvPT6.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\QLSulgW.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.jsJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\b6dd686f-a071-4a96-9ec4-4a8ffdac9d0cJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\b3e287d1-bcec-4242-9158-4e1296363490Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\OaopJx7.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\wA65Aca.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\b7b7301e-d32e-49f7-b138-9fd21cf2ca6bJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\AlternateServices.txtJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\ysvHg4N.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\vi4XvhV.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\1rF6mO8.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\K5rKki1.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\q8i0wrk.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\aAedI9k.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bftdmlQ.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\TvRLfZL.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\J92ULzt.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\KkkuZjJ.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838415.86928e7f-6ba2-4b62-8ea8-d89cfd7a97ca.main.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\handlers.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\fwjMEU2.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\hJx4orC.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\5HwZ1in.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\eventsJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\3ODH4vT.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\8gpd86p.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\7e03a685-c52e-4810-b494-0f433b33ac49Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\qwPRWvb.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\5Ss6Pa7.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\EaKl6Gv.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\OC0kYuc.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\iJS4opz.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832120.4cb4db2a-ee68-4128-8ff4-f04bdc710c24.event.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\fzVBbK8.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\xr6C18v.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\pWhDM8j.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\STEwJN6.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\deIuDfB.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\c96bazW.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\75265401-2d75-4127-a70f-7d6e61df69a0Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\times.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\0eeJis8.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\eQIOIGi.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\4cb4db2a-ee68-4128-8ff4-f04bdc710c24Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832123.3eb2db8e-f770-4c52-9d7b-27180bea4925.main.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\KW8ZwkH.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832118.b6281059-34c6-49d8-97c7-24de33b104ab.new-profile.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\x3atRlX.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838410.75265401-2d75-4127-a70f-7d6e61df69a0.health.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\0KGYUE1.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\containers.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\search.json.mozlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\3eb2db8e-f770-4c52-9d7b-27180bea4925Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\SWSCRek.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\shield-preference-experiments.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\A85vXOE.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extension-preferences.jsonJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\6IrB2Ca.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.dbJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\SxpehVo.EUPTJQjetJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838409.7e03a685-c52e-4810-b494-0f433b33ac49.event.jsonlz4Jump to behavior
            Source: C:\Users\user\Desktop\zhbEGHo55P.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
            DLL Side-Loading            		112
            Process Injection            		11
            Masquerading            		1
            OS Credential Dumping            		311
            Security Software Discovery            		Remote Services1
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network Medium2
            Data Encrypted for Impact
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
            DLL Side-Loading            		11
            Virtualization/Sandbox Evasion            		LSASS Memory1
            Process Discovery            		Remote Desktop Protocol1
            Browser Session Hijacking            		1
            Proxy            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)112
            Process Injection            		Security Account Manager11
            Virtualization/Sandbox Evasion            		SMB/Windows Admin Shares1
            Data from Local System            		SteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook21
            Obfuscated Files or Information            		NTDS5
            File and Directory Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script21
            Software Packing            		LSA Secrets122
            System Information Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Indicator Removal            		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            DLL Side-Loading            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            File Deletion            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1558517 Sample: zhbEGHo55P.exe Startdate: 19/11/2024 Architecture: WINDOWS Score: 100 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for URL or domain 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 6 other signatures 2->46 8 zhbEGHo55P.exe 30 1002 2->8         started        12 ONENOTE.EXE 2->12         started        process3 file4 24 C:\Users\user\AppData\...\fHxBFiW.EUPTJQjet, SVR2 8->24 dropped 26 C:\Users\user\AppData\...\IRlPAqf.EUPTJQjet, DOS 8->26 dropped 28 C:\Users\user\AppData\...\qmzcYeu.EUPTJQjet, DOS 8->28 dropped 30 174 other malicious files 8->30 dropped 48 Found potential ransomware demand text 8->48 50 Found Tor onion address 8->50 52 Contains functionality to detect hardware virtualization (CPUID execution measurement) 8->52 54 7 other signatures 8->54 14 3B5A.tmp 8->14         started        18 splwow64.exe 8->18         started        signatures5 process6 file7 32 C:\Users\user\Desktop\zhbEGHo55P.exe, data 14->32 dropped 34 C:\Users\user\Desktop\ZZZZZZZZZZZZZZ (copy), data 14->34 dropped 36 C:\Users\user\Desktop\YYYYYYYYYYYYYY (copy), data 14->36 dropped 38 24 other malicious files 14->38 dropped 56 Antivirus detection for dropped file 14->56 58 Multi AV Scanner detection for dropped file 14->58 60 Machine Learning detection for dropped file 14->60 62 4 other signatures 14->62 20 cmd.exe 14->20         started        signatures8 process9 process10 22 conhost.exe 20->22         started       

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            zhbEGHo55P.exe95%ReversingLabsWin32.Ransomware.Lockbit
            zhbEGHo55P.exe100%AviraBDS/ZeroAccess.Gen7
            zhbEGHo55P.exe100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\ProgramData\3B5A.tmp100%AviraTR/Crypt.ZPACK.Gen
            C:\ProgramData\3B5A.tmp100%Joe Sandbox ML
            C:\ProgramData\3B5A.tmp87%ReversingLabsWin32.Trojan.Malgent

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion$?0%Avira URL Cloudsafe
            http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionL0%Avira URL Cloudsafe
            http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionh?0%Avira URL Cloudsafe
            http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf0%Avira URL Cloudsafe
            http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion0%Avira URL Cloudsafe
            http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionY0%Avira URL Cloudsafe
            http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0%Avira URL Cloudsafe
            http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onional80%Avira URL Cloudsafe
            http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion100%Avira URL Cloudmalware
            http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0%Avira URL Cloudsafe
            http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionc0%Avira URL Cloudsafe
            http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionins0%Avira URL Cloudsafe
            http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0%Avira URL Cloudsafe
            http://lockbitsupp.uzFFFFFFFFFFFFFFFFFFFFF0%Avira URL Cloudsafe
            http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion100%Avira URL Cloudmalware
            http://lockbitapt.uz0%Avira URL Cloudsafe
            http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionin0%Avira URL Cloudsafe
            http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionl0%Avira URL Cloudsafe
            http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion0%Avira URL Cloudsafe
            http://lockbitsupp.uz0%Avira URL Cloudsafe
            http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionV?0%Avira URL Cloudsafe
            http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            s-part-0015.t-0009.t-msedge.net
            		13.107.246.43
            		truefalse
              		high
              default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
              		217.20.57.20
              		truefalse
                		high

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionLzhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion$?zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onional8zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionh?zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionfzhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionYzhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFSPL1013.tmp.0.drfalse
                • Avira URL Cloud: safe
                		unknown
                http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionzhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionzhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: malware
                		unknown
                http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFSPL1013.tmp.0.drfalse
                • Avira URL Cloud: safe
                		unknown
                http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionczhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://lockbitsupp.uzFFFFFFFFFFFFFFFFFFFFFSPL1013.tmp.0.drfalse
                • Avira URL Cloud: safe
                		unknown
                https://www.torproject.org/zhbEGHo55P.exe, 00000000.00000003.2476991809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2650826923.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2450140900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2290593821.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2440046436.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2606429007.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2639055540.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2454336369.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2587777133.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2314496043.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2503379476.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2515089028.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2285717895.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2514251222.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2279288820.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2433314867.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2581174848.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2454981543.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2405199774.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2323190189.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2529982078.0000000000F5A000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onioninzhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onionzhbEGHo55P.exe, 00000000.00000003.2552760214.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2648226451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2297273167.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2422682512.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2504179596.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2296498981.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2476991809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2650826923.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2450140900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2290593821.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2440046436.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2606429007.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2639055540.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2454336369.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2587777133.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2314496043.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2503379476.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2515089028.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2285717895.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2514251222.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2279288820.0000000000F1E000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionzhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onioninszhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFSPL1013.tmp.0.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://lockbitapt.uzzhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, SPL1013.tmp.0.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionlzhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://lockbitsupp.uzzhbEGHo55P.exe, 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onionzhbEGHo55P.exe, 00000000.00000003.2552760214.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2648226451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2297273167.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2422682512.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2504179596.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2296498981.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2476991809.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2650826923.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2450140900.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2290593821.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2440046436.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2606429007.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2639055540.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2454336369.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2587777133.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2314496043.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2503379476.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2515089028.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2285717895.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2514251222.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, zhbEGHo55P.exe, 00000000.00000003.2279288820.0000000000F1E000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionV?zhbEGHo55P.exe, 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  		unknown

                  World Map of Contacted IPs

                  ⊘No contacted IP infos

                  General Information

                  Joe Sandbox version:41.0.0 Charoite
                  Analysis ID:1558517
                  Start date and time:2024-11-19 14:41:11 +01:00
                  Joe Sandbox product:CloudBasic
                  Overall analysis duration:0h 7m 44s
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Cookbook file name:default.jbs
                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                  Number of analysed new started processes analysed:17
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • HCA enabled
                  • EGA enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Sample name:zhbEGHo55P.exe
                  renamed because original name is a hash value
                  Original Sample Name:82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe
                  Detection:MAL
                  Classification:mal100.rans.phis.spyw.evad.winEXE@9/1689@0/0
                  EGA Information:
                  • Successful, ratio: 100%
                  HCA Information:
                  • Successful, ratio: 99%
                  • Number of executed functions: 83
                  • Number of non-executed functions: 6
                  Cookbook Comments:
                  • Found application associated with file extension: .exe

                  Warnings

                  • Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, RuntimeBroker.exe, WMIADAP.exe, printfilterpipelinesvc.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                  • Excluded IPs from analysis (whitelisted): 52.109.89.18, 184.28.90.27, 52.109.28.47, 52.113.194.132, 52.182.143.208
                  • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, weu-azsc-config.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, onedscolprdcus04.centralus.cloudapp.azure.com, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, s-0005-office.config.skype.com, uks-azsc-000.roaming.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, azureedge-t-prod.trafficmanager.
                  • Not all processes where analyzed, report is missing behavior information
                  • Report size exceeded maximum capacity and may have missing behavior information.
                  • Report size getting too big, too many NtCreateFile calls found.
                  • Report size getting too big, too many NtCreateKey calls found.
                  • Report size getting too big, too many NtDeviceIoControlFile calls found.
                  • Report size getting too big, too many NtEnumerateKey calls found.
                  • Report size getting too big, too many NtOpenFile calls found.
                  • Report size getting too big, too many NtOpenKeyEx calls found.
                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.
                  • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                  • Report size getting too big, too many NtReadFile calls found.
                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                  • Report size getting too big, too many NtSetInformationFile calls found.
                  • Report size getting too big, too many NtWriteFile calls found.
                  • VT rate limit hit for: zhbEGHo55P.exe

                  Simulations

                  Behavior and APIs

                  TimeTypeDescription
                  08:42:55API Interceptor5x Sleep call for process: zhbEGHo55P.exe modified
                  08:43:05API Interceptor107x Sleep call for process: splwow64.exe modified

                  Joe Sandbox View / Context

                  IPs

                  ⊘No context

                  Domains

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comNew.Order Request-#54576.scrGet hashmaliciousUnknownBrowse
                  • 212.229.88.13
                  file.exeGet hashmaliciousCredential FlusherBrowse
                  • 217.20.57.20
                  Airtame-4.11.0-setup.msiGet hashmaliciousUnknownBrowse
                  • 217.20.57.35
                  Fluor RFQ1475#U00b7pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                  • 217.20.57.19
                  DRP130636747.pdfGet hashmaliciousUnknownBrowse
                  • 217.20.57.42
                  87654785457596574686FKHN-Copy.pdfGet hashmaliciousPhisherBrowse
                  • 217.20.57.35
                  Annual_Benefits_&_Bonus_for_Lorne.zuck#IyNURVhUTlVNUkFORE9NNDUjIw==.docxGet hashmaliciousUnknownBrowse
                  • 84.201.210.39
                  purchase order (2).xlsGet hashmaliciousUnknownBrowse
                  • 217.20.57.19
                  new.batGet hashmaliciousUnknownBrowse
                  • 84.201.212.67
                  https://url.us.m.mimecastprotect.com/s/7XsKCQWmqkh6El9PsPhEHGZMGK?domain=hbgone.docdroid.comGet hashmaliciousUnknownBrowse
                  • 217.20.57.22
                  s-part-0015.t-0009.t-msedge.netfile.exeGet hashmaliciousLummaCBrowse
                  • 13.107.246.43
                  file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                  • 13.107.246.43
                  file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, VidarBrowse
                  • 13.107.246.43
                  VNC Sales.xlsxGet hashmaliciousUnknownBrowse
                  • 13.107.246.43
                  https://midlandtxconstruction.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5VVmliM0U9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123NGet hashmaliciousHTMLPhisher, Mamba2FABrowse
                  • 13.107.246.43
                  file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                  • 13.107.246.43
                  file.exeGet hashmaliciousLummaCBrowse
                  • 13.107.246.43
                  https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/graylinelaketahoe.com&c=E,1,BWhR2At2OZAdw2Kzdn7d-U-fLZRdgzpdTFbcA87JOQxek-SzsLBqKBG-KMVpA5JovWFRbO4mN3q2zPe1YDaTOG57b4G9v05-IgsJXqrG4om_58_65Os9ldlZ&typo=1Get hashmaliciousUnknownBrowse
                  • 13.107.246.43
                  http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUM1RXUzBHU1RDUjlQOFBPUUE4QVRaS0pPSC4uGet hashmaliciousHTMLPhisherBrowse
                  • 13.107.246.43
                  EFT Remittance_(Rburt)CQDM.htmlGet hashmaliciousMamba2FABrowse
                  • 13.107.246.43

                  ASNs

                  ⊘No context

                  JA3 Fingerprints

                  ⊘No context

                  Dropped Files

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  C:\ProgramData\3B5A.tmpLB3.exeGet hashmaliciousLockBit ransomwareBrowse
                    LBB.exeGet hashmaliciousLockBit ransomwareBrowse
                      ggjLV4w8Ya.exeGet hashmaliciousLockBit ransomwareBrowse
                        yEB1xvr2rZ.exeGet hashmaliciousLockBit ransomwareBrowse
                          71p2xmx6rP.exeGet hashmaliciousLockBit ransomwareBrowse
                            98ST13Qdiy.exeGet hashmaliciousLockBit ransomwareBrowse
                              c8JakemodH.exeGet hashmaliciousLockBit ransomwareBrowse
                                Document.doc.scr.exeGet hashmaliciousLockBit ransomware, TrojanRansomBrowse
                                  Rcqcps3y45.exeGet hashmaliciousLockBit ransomwareBrowse
                                    LBB.exeGet hashmaliciousLockBit ransomwareBrowse

                                      Created / dropped Files

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\AAAAAAAAAAA (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Reputation:low
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\BBBBBBBBBBB (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Reputation:low
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\CCCCCCCCCCC (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Reputation:low
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\DDDDDDDDDDD (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Reputation:low
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\EEEEEEEEEEE (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Reputation:low
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\FFFFFFFFFFF (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Reputation:low
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\GGGGGGGGGGG (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HHHHHHHHHHH (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\IIIIIIIIIII (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\JJJJJJJJJJJ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\KKKKKKKKKKK (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\LLLLLLLLLLL (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\MMMMMMMMMMM (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\NNNNNNNNNNN (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\OOOOOOOOOOO (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\PPPPPPPPPPP (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\QQQQQQQQQQQ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\RRRRRRRRRRR (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\SSSSSSSSSSS (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\TTTTTTTTTTT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\UUUUUUUUUUU (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\VVVVVVVVVVV (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\WWWWWWWWWWW (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\XXXXXXXXXXX (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\YYYYYYYYYYY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\ZZZZZZZZZZZ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.501347894874276
                                      Encrypted:false
                                      SSDEEP:3:2aLpGCw/lFRtyi0sta6zuHC1bWVvQ6U5yv0WSBjfIXg8Wb:2ApGpFXV0snCHC1IQ6Rv0Wkjsm
                                      MD5:F93D9A1D1CCC18A25169C3175F42F815
                                      SHA1:EB4C271DFDE9ACD4115D87994719F6C05960E432
                                      SHA-256:C4895455050915330CD9CCBC262E96BAB1EDBBE8AA41DB47DEE268BCDFAB44D4
                                      SHA-512:DC45EAD1BB2021EF09495990DF0EFD04F170A047D3F1F646FD143C85175453EED39143BC09684A9064D70BCE12B3025D9F34769585C1C3BDEC9CB8B9C0E68F03
                                      Malicious:false
                                      Preview:...nI.."n...g..@.f...8..C.....^j.H+.._.K.HU.=#!..sp||J.&..q.........A......M...Aq...w..,.y."..=.Z-.W}.f.).....m.Jc..~

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\AAAAAAAAAAA (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\BBBBBBBBBBB (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\CCCCCCCCCCC (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\DDDDDDDDDDD (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\EEEEEEEEEEE (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\FFFFFFFFFFF (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\GGGGGGGGGGG (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\HHHHHHHHHHH (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\IIIIIIIIIII (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\JJJJJJJJJJJ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\KKKKKKKKKKK (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\LLLLLLLLLLL (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\MMMMMMMMMMM (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\NNNNNNNNNNN (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\OOOOOOOOOOO (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\PPPPPPPPPPP (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\QQQQQQQQQQQ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\RRRRRRRRRRR (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\SSSSSSSSSSS (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\TTTTTTTTTTT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\UUUUUUUUUUU (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\VVVVVVVVVVV (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\WWWWWWWWWWW (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\XXXXXXXXXXX (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\YYYYYYYYYYY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\ZZZZZZZZZZZ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.374491088854119
                                      Encrypted:false
                                      SSDEEP:3:qpYRO9PgypsU4LUb08skv4Gzfm6oqQ6MyBndigo2wCoy0Dmn:qpwO9/CU4L38FgGi6+6ndiL2wBnDmn
                                      MD5:D2672332B5065EAD743D5DC7AA79B0E6
                                      SHA1:7C48E3AEE512F38D0E71771492741F429D8197E0
                                      SHA-256:1DEAA7695451EA9E4E59E425B0574CABBA3B3DB4C1C6E97E40345974DE817557
                                      SHA-512:2A2689C13A0CA2E3B6F0EFB5E0F9B4459F9C700D74796071CABCC003D42EFAFA5CDA8422BAED84C889C9F100934DC3651EF3B64FBB7D88323E240747E6A0735E
                                      Malicious:false
                                      Preview:I.-.....8L MW../...U....|.P....PI.Y..Icf..e.i?..5..5A .n..A...yg.(......K...Z.8.%..-..@..,.G...:%B:.. /.-Q8.p2.B..Q.p..H..

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\AAAAAAAAAAA (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\BBBBBBBBBBB (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\CCCCCCCCCCC (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\DDDDDDDDDDD (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\EEEEEEEEEEE (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\FFFFFFFFFFF (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\GGGGGGGGGGG (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\HHHHHHHHHHH (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\IIIIIIIIIII (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\JJJJJJJJJJJ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\KKKKKKKKKKK (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\LLLLLLLLLLL (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\MMMMMMMMMMM (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\NNNNNNNNNNN (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\OOOOOOOOOOO (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\PPPPPPPPPPP (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\QQQQQQQQQQQ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\RRRRRRRRRRR (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\SSSSSSSSSSS (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\TTTTTTTTTTT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\UUUUUUUUUUU (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\VVVVVVVVVVV (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\WWWWWWWWWWW (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\XXXXXXXXXXX (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\YYYYYYYYYYY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\ZZZZZZZZZZZ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.412124832825231
                                      Encrypted:false
                                      SSDEEP:3:mV+ss1BNDNWbYgI+UmoWldzLnCvHY2pUFAmgto92Qo+hKzrLBe+xs:mVKZNsJnCvHYGSAmhHKzrLBZxs
                                      MD5:2EA1791805627EBDD126409A9F6624DA
                                      SHA1:FD19881BAE9DDE3377957A049391AB672401618C
                                      SHA-256:76371E74CDFFBB08BDCE593FBC29F40C7E59B14AC9E97F5F290300BE259F26FC
                                      SHA-512:92BDA18BAC92A5E5E66B1DA040669BC94948A2CCD7837239910C4443CAE3A45B7F41327697D0F3F43BD8231FE6C6BE31A2435AF617D2A683324FB1A0252EEE71
                                      Malicious:false
                                      Preview:V.0.#....r...G....q.(.EPr.......O|..Z........isM]......s....B.....-..f.s.n.Kq(1.|.I...t.A.......S..#<...$........{.8...G.q!

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\AAAAAAAAAAA (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\BBBBBBBBBBB (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\CCCCCCCCCCC (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\DDDDDDDDDDD (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\EEEEEEEEEEE (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\FFFFFFFFFFF (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\GGGGGGGGGGG (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\HHHHHHHHHHH (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\IIIIIIIIIII (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\JJJJJJJJJJJ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\KKKKKKKKKKK (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\LLLLLLLLLLL (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\MMMMMMMMMMM (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\NNNNNNNNNNN (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\OOOOOOOOOOO (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\PPPPPPPPPPP (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\QQQQQQQQQQQ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\RRRRRRRRRRR (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\SSSSSSSSSSS (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\TTTTTTTTTTT (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\UUUUUUUUUUU (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\VVVVVVVVVVV (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\WWWWWWWWWWW (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\XXXXXXXXXXX (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\YYYYYYYYYYY (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\ZZZZZZZZZZZ (copy)

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):129
                                      Entropy (8bit):6.726305646879341
                                      Encrypted:false
                                      SSDEEP:3:idokSBJfFR88TKBjw/lF7UpV/A6+SidmyHftb15eR6:idyLR+5wtBULft+m8tb1Ac
                                      MD5:7FDAA5BD4283874D727A1C69122E9218
                                      SHA1:986CFF85DC73541DC895C8E192A842A57902496E
                                      SHA-256:4D8D58B55B7DD1E8F27463F60E58AB2071AB2EEEBFE3BA16880F2D9CCB440C33
                                      SHA-512:C010F0F762B5CF3E6A4D4DE8AA12FE8F28F234663B61155C70D02821523E0C0CED3A9EEA0E795E26F94019CCC1ED05F477999CA7217467C66292F546CC7BA557
                                      Malicious:false
                                      Preview:...E/.dB....4...#...I....|L..,$...yx..QO...+KJ.(VF..R*.......;..Pp..'....u._S...w/M....."D......r.......aG^.Hp......A.jC$.._

                                      C:\$WinREAgent\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\$WinREAgent\Scratch\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\ProgramData\3B5A.tmp

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):14336
                                      Entropy (8bit):7.4998500975364095
                                      Encrypted:false
                                      SSDEEP:384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
                                      MD5:294E9F64CB1642DD89229FFF0592856B
                                      SHA1:97B148C27F3DA29BA7B18D6AEE8A0DB9102F47C9
                                      SHA-256:917E115CC403E29B4388E0D175CBFAC3E7E40CA1742299FBDB353847DB2DE7C2
                                      SHA-512:B87D531890BF1577B9B4AF41DDDB2CDBBFA164CF197BD5987DF3A3075983645A3ACBA443E289B7BFD338422978A104F55298FBFE346872DE0895BDE44ADC89CF
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: Avira, Detection: 100%
                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                      • Antivirus: ReversingLabs, Detection: 87%
                                      Joe Sandbox View:
                                      • Filename: LB3.exe, Detection: malicious, Browse
                                      • Filename: LBB.exe, Detection: malicious, Browse
                                      • Filename: ggjLV4w8Ya.exe, Detection: malicious, Browse
                                      • Filename: yEB1xvr2rZ.exe, Detection: malicious, Browse
                                      • Filename: 71p2xmx6rP.exe, Detection: malicious, Browse
                                      • Filename: 98ST13Qdiy.exe, Detection: malicious, Browse
                                      • Filename: c8JakemodH.exe, Detection: malicious, Browse
                                      • Filename: Document.doc.scr.exe, Detection: malicious, Browse
                                      • Filename: Rcqcps3y45.exe, Detection: malicious, Browse
                                      • Filename: LBB.exe, Detection: malicious, Browse
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....YPb.................,...........9.......@....@..........................p.......................@......................A..P....`...............................@......................`@.......................@..`............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...`....P.......4..............@....rsrc........`.......6..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\.ms-ad\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\3D Objects\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0G036xm.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):458
                                      Entropy (8bit):7.547440075337164
                                      Encrypted:false
                                      SSDEEP:12:kgWtcfcTc0XvksuuqPnG9mG0Z6A546H/c2J/u:MMJ0/rGPn/G006H9G
                                      MD5:22C29137F7FA60290F54F8F7F7A80653
                                      SHA1:974FC5220804FE4DE56BA32D41E7DAE07D07FA63
                                      SHA-256:E94C1205742D7FF954E461A0446BD7E91D49E19C6C728B06B951022C0B09D47C
                                      SHA-512:4C66F75AD29B552D4AE83D5DBE5A9400D3691694A4C3AAD6AC2D1C08902520B7733E03A7035218399F4757EDB8B5F0FB8CA6FB41F01ADED7D14E09078FA874A2
                                      Malicious:false
                                      Preview:.U...ez...v...@+;.....W.*.8.j.d^.e.ymg........A.}...c.5.....^Q(.Q..1....D...cEr.A......y.(p.n.4=5.P..t.W_..........g.p.:.M....../4..`..x.ga..5...;Y.p.G......)Y..*....{y..[..M.-.;T...J........W...JS>.-?......M..;O7..\..v...;.......5..H........x.y$. .%a}uB....B..M...sZD?..E+Y1./r..%.B...q.AmEZ...@...3.^9.s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ULl7bu.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.548334833462199
                                      Encrypted:false
                                      SSDEEP:12:ktgZA9NGxTf0n9aUdUHKUUwRURheDLmG0Z6A546H/c2J/u:kBul09aUqlfURheDKG006H9G
                                      MD5:C7B85F113B8446E5A8667EF4F42787D1
                                      SHA1:0241861F538879EF8966DBC7F3B9C7A1C204B8D3
                                      SHA-256:BDA015BF83327C9288BEBA39334FBAF53B1F59AD76B1A3B0B641CD13E543ED8C
                                      SHA-512:9E3D7E8A4CA93C8428EE6B8E32856BC3B27C42A81ECCD93768926E490F8824FCAB3581CB36B6F0D078B0B0725BB9C309192926089362C3F4A633A53EF80C9F2D
                                      Malicious:false
                                      Preview:......3.."..)C.9...J.+0....0Z.B3i...~.\,.....p..X...bym.hy(..!..Y_..........8.....y.r......Ty..<...)..l..~/.%p.D...:..%..Nn.5....~$:....Q"-.....=.|...D.pczg....{...V...<.P......6..t."..Tz...z..x..s.H.M[.K../.l...JP>.->Q?M.k.e...;L7..M#.?j.2...j...S5V.H........x.}.;..gt.*L.L..'.g.s!b.r9Du.VT..G..Mt.@........$..&.+(.[5E.t.U-.u.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0yMB6rp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):466
                                      Entropy (8bit):7.545609531205159
                                      Encrypted:false
                                      SSDEEP:12:p8h19pdKWLmLfoI91TYBE9IRNemG0Z6A546H/c2J/u:pa9mWiLgI91TY2SXxG006H9G
                                      MD5:139B72A13FDA8D68E1D0577498D04C99
                                      SHA1:59B4F47A6941513117D6FACB09609B1BB73F48A3
                                      SHA-256:152C692C0B498529C8D6D44AA7A505F98F53DF3E42D8DC750B91139CCF5D304E
                                      SHA-512:F33A1D6E8DB9D926179BC28FD4167A3EB2286D4D9375BFC0BD98BFC374AEBA50D6985367AEF031EA99E534E15EFF1D3B772BC5099FBA90A343AE2989D6717AB2
                                      Malicious:false
                                      Preview:.t.g{^.._Yun..>......qW.......O}...........vR;.K5..m......78...4.y...td..T0t/($.X.7.r....^....W\)A............L\h..,n..kK...Od..A..m.....e..vg. .7...@...q..7p.@.Od.&. .!U....9i-l..~..}=.NKe..o.h.....a..}..9@...J.>.->......*.G..........9.....S6..H....9.F..b-g0.`.-...Z......+x....y..TUC{....R.h...[.&.!.`..f..w.n.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\5eyazSi.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.570380901063559
                                      Encrypted:false
                                      SSDEEP:12:+AGlv4+KIHqQ5HDZ53q/ism5iyijramG0Z6A546H/c2J/u:+AGlwQ53101jhG006H9G
                                      MD5:08B51822B9DEFE1E2A77EACAAC875982
                                      SHA1:234C179BD1329A35B9064B507461F2EC705CF2CC
                                      SHA-256:08BD7766B93C9C529F895EA87EB74F5FB8D4B3CD63CA0AD2C190DD5A8B69DBCD
                                      SHA-512:8F5CB46EA048F4AECB85568C1AEC19D9C6E229ED18FF1517B1FB7C0DA9DF875E1C0F22252807064F0A00D0796D2D5D1EE907FAC8DC6B33A17E1D3E766B2D931A
                                      Malicious:false
                                      Preview:ir~.xo.]%..es?...Zod.`oy....+.i......U.....T.U.........Zl.....s.).......t..4.(7.0....D.....W..!..& .`I....R+..hTY2....$.(#..^.~j.`..(S.|2....L.y.w..}f...@H.....GZj.9a8..|..A.[j/..~\...>..&c.....r.8O..J.>.-n.W..@.."..cZ.....M.6o.q9.....S5..K.......W".RK.I..~........%u.....s..x_.C....O0...!.H.....FDX.?.%.k@..@.q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7JBIKrF.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Secret Key
                                      Category:dropped
                                      Size (bytes):457
                                      Entropy (8bit):7.549598592735369
                                      Encrypted:false
                                      SSDEEP:12:qglDuswOysjE5C66cV6e6eQ638lkimG0Z6A546H/c2J/u:qQys1E+e6eQ6MlkVG006H9G
                                      MD5:8FA9A9C0C190152ADB6BDAD0E88AA776
                                      SHA1:55AA4A19A9C20AB80BAECFFEEEAA25E5E00189D3
                                      SHA-256:45E249558F2976FBACA602255944409E20D62DF0E1D433A7D0016FB8EF396263
                                      SHA-512:DAE63A66EDC3C22139FF345A14CF4F2AEAE6CA504B3E971B79EC91F64DB809BE28602C94E9A8BC14EE1284563E99E058B9AFF833539B8ABBF808CDD258453B4E
                                      Malicious:false
                                      Preview:.:9.......(.Zm3|...'1xvJ.&..N..]YE.m?........ ..;..u...........-.... )f....t.)nt.w^.9...tc. ...'..1f..$..<..x..W.,...[Ih@8tI..#.....M.....fL4...6<E9.L.NG..ZT..L.R{..+1...z.....k........11.a..91..e98.\D.B{..J.>.-nQ?..C...[.._../..M-/..9......S5..H...........j..~w...N..eq.N+..c>K@.....)......>R..N...cM 5..m..=.o.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7g8ut1s.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):431
                                      Entropy (8bit):7.541069865479493
                                      Encrypted:false
                                      SSDEEP:12:ah0h0WwiDyfluzWiurSgKWtzHp7EI2SmG0Z6A546H/c2J/u:adPgyReg5zREI4G006H9G
                                      MD5:AC3667F4A2F63779A852A754BE8A7356
                                      SHA1:5B4CF9D439B060C309BFC17D2E4CA3ECF9D8D48E
                                      SHA-256:99F66DD4BAC0997C54DFEA396DAF673C52B3492B626F3CBB20A87B6452FF0B95
                                      SHA-512:5C31DFA35C8E90486731532FBCFADA4BE9D0D1526B144A65A08B8A8C5F968B1926ACBCB2681116E10F5BBB83FDB54529058C860EEA6369E78C94B5208D95466D
                                      Malicious:false
                                      Preview:....6$..) .M. .8........UW3#\..e...P^..+a..RM......N....1...../..1..n...n....x...i,.....2:S8h....t._Sb.-..>!.....%..(......YNh.0.".w....;..+2..$..c....B.....|.$[.+r...".....J.>.-n...dg.......Q/..b.v.....?...Sg..H........x.a..q..V.n....p...l...A.R.3..LQ...b...*4.K.iZj.L.......Y......t.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8ag7Scr.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):420
                                      Entropy (8bit):7.510931961834907
                                      Encrypted:false
                                      SSDEEP:12:rDGe6asyzLOvX0ibyDzGnrzPhmG0Z6A546H/c2J/u:r6eqyzLOvXhyGrzP0G006H9G
                                      MD5:7C3B5586120BDB7BA1269FA2915DC612
                                      SHA1:4AE5282B28E188114B7A5EFD6037FFC7A1A86FB0
                                      SHA-256:D718AF8B7A8901675A1BEEEFA27AB045D7A150DF1C9F64C02A14467412E93471
                                      SHA-512:3031F34555FE9C901FBBFDAE20123CBA567DF96CCD6D4452BC4617BF0CC54ED62A8711BD121E2682D8556BDAAFCFF39022A6AD35012E0AC7866040FA7253FB1C
                                      Malicious:false
                                      Preview:.O..p.....D.=...."..%.....z.<.@O.) .y ..[k* %..J...6R=......u.A"...?.....(XD/&x>.....{L.!.e..........-@t.....&.y.(...{9.t6.".|.@.*X.b..........l_.u..ec...O..h.......,.$<.Z..G.JQ>.-=~.O.g.......y.......k......S5..H......K.4.._I.P...&.M.S....r....G......r..d..bw..kE|.........l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\AdlSz4J.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):461
                                      Entropy (8bit):7.538661025135479
                                      Encrypted:false
                                      SSDEEP:12:8BTSqY48ka5GzgiK6Rf+prY7Om6OnO1TmG0Z6A546H/c2J/u:EKtd5GsiK5e5O1iG006H9G
                                      MD5:C6260B47D6EC60180F90C04FDC70BE22
                                      SHA1:7D03E3E0193B79890FF86A1E0F5C92C69360061D
                                      SHA-256:FC8D9D1ADE6E55C4E696BD5A41A116613D0E28F85F3709885A1E7D652856415B
                                      SHA-512:D7D2E392BECA3A25EC9120BE2734330216268EFCD54354DDA6AD87EA0BE6F81378C7354CD71AF46E6D932D3913F9E50C20C7F60ABDF5CD8CCE148F1214313D95
                                      Malicious:false
                                      Preview:..f.......y'.u.N..NAo...*`B;a.D7..H.l-}{.3.jY.M..-.7<..{]_+X.,V.9....!.,&.[t...m....s.X..V@.....f.........~.RW}.....D..>.4...C.NS.=E..Z......d..W.cmDK.b.@.x...`...Zq....9....*J.e....p.3..s.f...}..kN.D..~.J.>.->~.8.o..K..O..D..w.Y..q9.....S5..K........Z(.....l.[0B-..Q.l.i;^..9..:]...^v..'..N..r4.k....^.?L..&..,q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\Az0KgLg.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):456
                                      Entropy (8bit):7.50548171071911
                                      Encrypted:false
                                      SSDEEP:12:EAuAD9wofrxJJCePwHQwWqKxS+vhkmG0Z6A546H/c2J/u:lh9woNCzWqwS+hG006H9G
                                      MD5:AFD196DEF538F96D0BF66F78889D9220
                                      SHA1:1DF901C3006D31EACF7504D645F0EF3CDBB6D605
                                      SHA-256:2EB23FCC08B51E12CB5FD3BB6B4B26BCC8E57777C258A0CE06AC7B94F21ACA01
                                      SHA-512:E899F396D6C6A871C92E39D54D278E5C4FD9DACBA189DC1FC949543C1595CC29ED2C8BF10D4C8AC4A2ED2A1CAAFCB8CD8B5077783E6E49E4ECF4B875C62B6DC4
                                      Malicious:false
                                      Preview:.2...U.&>...}....J..b..wx..'..b=}..r.?......0mN...q...Q.q.|......P&.[@....L.!..:.d.}....|....Kz..=.e.8.m.X..9rr....+)..t.........Nv.p.j.W...w3.b.`+.<nv..%-..g.......H.G+.7.v(T.2..i..?.Q...|.v.t.J.>.-<Q3.....#....Y#..".Y2.9......S5..H........U.;..ib;/.w..X.Vqs..V}...H.,.H......2...>..=.lm$M:C..<.u...r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\DbxtvFP.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):462
                                      Entropy (8bit):7.555271209355619
                                      Encrypted:false
                                      SSDEEP:12:B4ePaYN+2Hp7Ptuc5NCmDBv5YrmG0Z6A546H/c2J/u:B4zkHHprcSNnDBR/G006H9G
                                      MD5:98967583A7DF3792CBC5D6D614AE5138
                                      SHA1:45AF1BD7C7DB4CED3BAE4877BF6EF9B4684A05BE
                                      SHA-256:5E656D1B3E805F81A99025136D1B5C1F3323E1F7A68B0CF0580BBC97FE2B2CAB
                                      SHA-512:CEBE6DFF2CD3D38C711B180E71FCB8C0A99D5B073A942E6A4121CDF4B0213F5398ED6CA500E1D2430AE15948786A85217D8319AE36D3DF9A2062718FC543151B
                                      Malicious:false
                                      Preview:i..D./..F.dR..o.;.e.....5.k;,>......Y.#.5..3...(.d-..A.. ._.[.......).....@..Gm..!H..]eN..6.......u.........L..vm.[/#_.D1.:K."?.."...)#....M.*.......5>r.Cz..C....kX...i.......~..t..)#.~.({..)a......X6....\..JS>.,...4.o..M.....:.....d.;......S5..H.........K/z.0> ...}.... ..p.......]7.{...m.tS..a..n\..../.....w.r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\Fy38bec.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.573351024359536
                                      Encrypted:false
                                      SSDEEP:12:k5OjsyUa+r0hcEjU6Aw+UqDtCV5mG0Z6A546H/c2J/u:40+IMRwGtC+G006H9G
                                      MD5:17FD51C8181D22B59390633CE107E22E
                                      SHA1:469C45020A31F688F71C0A9AB59EB02C36BD6D5A
                                      SHA-256:9FB1080FED61E145925CF6D58EE6D521C4413613B438EC3EF8B2631E9339B4CE
                                      SHA-512:E0A72980E39D8191F4F120E876DE2D81641DD65E1F89A12DCF7439362030B9A159EE147C4F2A5FA50496296CAA0871FFE552E046F8579AE24860D5A8CC8ACA81
                                      Malicious:false
                                      Preview:..<$b.l#.2_....U/....c.m...B....q......h....|*.....hp..8.F.... .-.Eh....F.6.1....e.O...bg.C..kN.............=.y./B.D..w}...=(..H.........,}...\._..r..X.........$.;Z....*U.#..^.. .0.g.(z...}7bN..*.~.....1`.ow*.._Cw.JW>........eL^..e.......T........S5..H........z@...>)D.D..........V@..........X.{G.....F...........{.y..78r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\GY38Dgm.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):466
                                      Entropy (8bit):7.4960465958136115
                                      Encrypted:false
                                      SSDEEP:12:+GrIF8oRaVYw2USfOnbtl15zGMCgbalQSmG0Z6A546H/c2J/u:1rI6VVfFSfOnp5zGDgbalQFG006H9G
                                      MD5:D1D6BAC9D10C69DD1523B3305402A7BE
                                      SHA1:0DD3C1E15007E413130CC1A467C995CC3FEF78DF
                                      SHA-256:2EBEA316C41F8A548BB2C160D23F17E0DD7BAF0AC666FE6EFEE57AF317658F24
                                      SHA-512:C15226BC5E72B59DD5434F00763D7AD4EC3CDD3AEE5BD5C2120FE383E5F2CDACE2E59761ACF832A8F1EC8C35E20AA2D4F75BC442407AF610E866CD530974DA28
                                      Malicious:false
                                      Preview:.2..s#5B.&...L...p.......7...T..)c......."".h....S6........~.e...)...2fW(SM.Slt.M....B.x..<....n.........&$.]..f......|e...dx...Y...cuF.U.l....RO. ..&Z.U-K.h.Z=.XE.....9.......5XW|....l./.E.-.W.,.....y.".A.JQ>.-oU3.......r...M@B..'......S5..H......l.d.`.<.KX.w...j...l.a.."h.......K..Z..7[....8..I.B.R...H..W.p.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\GyrpAz4.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):439
                                      Entropy (8bit):7.5212147609295785
                                      Encrypted:false
                                      SSDEEP:12:0dWqrkGo5Du2TSJGc+6NpQln/ImFySNoW5dmG0Z6A546H/c2J/u:0bHyK2xc+rV/B4SSW5wG006H9G
                                      MD5:60A4CAEEDAD3F1AAA5598337CA0386FD
                                      SHA1:EDD24670EE07F5686BD2CC071E983991A35D6828
                                      SHA-256:A13FF4CE6DF6D3693946C7ED09F599983620A126095766BCEE8630E7692B650D
                                      SHA-512:893C286C3919D5772CE8423EAE5BB0C5B78141B7DEC6A263367FEF5AC7CA963E55DC7A309A69FC82C8D33F64C0DE757FE9EE3F3151B78C72E21D1B15BF34636C
                                      Malicious:false
                                      Preview:I.4.qY...s..5...i+,....5.*9..;%.~...s.k...l...K...&.M..a........T%/.Bm..a...MDj_k.&..p.....<Z... ..nPc.S......m.Sw...9..BH.{h].7^av.]j.A...$.z....NA..0..?tK#.....Q.R..i......j.@.-....JV>.,H......'I...F......Y.b.9.....S5..K..........4...oV.d.....?+.1.V...fe..5kI.@.eH?#d..D....({.I...C.~..q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\HRKalNR.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):464
                                      Entropy (8bit):7.626990910152854
                                      Encrypted:false
                                      SSDEEP:12:PQfgSw8Ymae0zzjv6QWqzWfJOmG0Z6A546H/c2J/u:Cgf8Ymae0nW6zWxhG006H9G
                                      MD5:4FF1E81E51AD80B4E7E0D73B2DAD252C
                                      SHA1:ED350FB67C7F59B3733FA593B89C1E9BBEC899F5
                                      SHA-256:36327681E729BFD123334D72466185808A06B8658A2C69F096D8721BFDDC9851
                                      SHA-512:072CBBCD91B37DE75438B768371285E48ADB945443ECDBF00DCA49A935787A882066A7E4F467743D3615C4465755D50B161F3598976914D9E834FFEA7D8F8504
                                      Malicious:false
                                      Preview:F....h_./.6f..j.Z8M.."9.....%._....V.x.....@.....7.Q.C...:....L...<...(..:c*<.q...~..Ih[|..V..n...B....z..j.EG..7.2...U.8.X....s]b....,`.S.. ?e{........d.. 8E..9.RF[..,h=...8X\U..S...3<8s.N..v...4g.>...K...9..1.~.e...ag.....*.>..U.......5..H........x.#Z..^.1....BK..*.......t..^~.....;y.JU...J....q.........?|.%s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\Ki9Te09.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):479
                                      Entropy (8bit):7.489909959793111
                                      Encrypted:false
                                      SSDEEP:12:KnhlVm1uVTOi76rFlIFd1VRYc5XRJmG0Z6A546H/c2J/u:alVCpFIFd1p5hMG006H9G
                                      MD5:632FDB71E4B2F962053D72D1C287C7C0
                                      SHA1:F1CF53E2CA1CE15D6ACE76B8E51DF52E39DBBB0B
                                      SHA-256:D0EB3643EA30DEDB84D97A32DD50E6720BB42415DD5139BCAB4C0F542840EEA2
                                      SHA-512:6B01C86DF5A66F1C7E626F7A6964CD33FFE94E93BEE94FF4D46BB424BF96FA1CF59DD33644A2F9F032F4A29107BC7F40162C2302979EA301ECA9AB30127287A3
                                      Malicious:false
                                      Preview:.....SE..5...6..4......0.y...9(....Ex.}..d4.*.....&..U.u1p..!YOLT2MT.)D..=d...j..].w.......UmO{......3.2.K.l.....<Dz.Ao....}tMKU..${UY.%~.S..F.y..v..~Y....&ZA...y..;..3..2...Rr.eb...b,..s...y..=...y...Qg.$c.>.dm.x...e....Z-m..JU>.-344..D.4.......(.......9.....P5..K.....}.~.V}Ue......=j....P.....x..F..z..)d.%.D..H(s...]..:...t..m.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\KoxU7A3.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Secret Key
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.487576452471929
                                      Encrypted:false
                                      SSDEEP:12:M8fzEklAf0PpJEIwh6fqjyfhT3bEnxoTmG0Z6A546H/c2J/u:1zEklhmIwLjyjiG006H9G
                                      MD5:1E5A3FC6DE86F82E3FFD335CB7AD86C1
                                      SHA1:191ACDDEEED994C537C476189BE1DB5A079347A4
                                      SHA-256:1F537B1D0D1E36173ECCA5CA0DDD56032AB636F676DCE152631BC7DDE9546090
                                      SHA-512:86A67F570998B410DC20DD56D9CE61CC72D748613D4DB8D6C6F38885537406693CE8144E81273421502A76A7D095AC4D328D1331F366E4E9F15F6265CEEFFC1F
                                      Malicious:false
                                      Preview:......CB...........(..D.~.28.U..[i.7....[%"lM.3.U...a.0..\..!.M.q.>....f....v..o.8.<&....<..LK.......D....`.Nd.....U>.i........#...t.g.a-...N>...x'...1\.L.@.....L1....q.M.....:......!h)..@..[..u".pP.O.J^>.-i......"[..k.._...T........S5..H........n./....=.........7..{.Q.\.%=+.j?..z<....L.-7...M.h...5.=.[..r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\M23aLyt.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):477
                                      Entropy (8bit):7.574896205831372
                                      Encrypted:false
                                      SSDEEP:12:H6XNZa0Pc439/Sl+CX+VWoCxRuvmH2Aw6sdmG0Z6A546H/c2J/u:HgNDPc4tC+CuWxRuuWAw6nG006H9G
                                      MD5:61D7BF7D129B69E26F1248FE1986359A
                                      SHA1:54AF4B810CD6EC6C90FECA628E8C692FA2A0C939
                                      SHA-256:9E49595E4A925C47239EFB63D3589052441F4ADE2BEA0A77D5A52C53A5711890
                                      SHA-512:B66D67F9A6FB024C4A6FF617F756704F92FF66DA02B4E01A2F428280983D43E0B797EAC62323B805223B2D533E1357F3E5BD465B9ECE98BF2F2001BD72956266
                                      Malicious:false
                                      Preview:^..._..(.>.b..B.....c...^N.!VH..^.J..*...eX.a9..O..,.....".l.(..g..^..#.n.>..M[..g.4...c~....C.V..x....DrV.'.G$._p....tN|-....x.R>8^fN..[.ve..GK<.........s.>+.............[;...(.[G/-. ..lo...l..0+..$......sg.C.Y.|.3.A.]..JS>.-;.S..I.&........2.Y..19.....S5..K.......A..k.....'&.....6...$@.e.g...^.=...H....[..I....Fe.J.#....q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\NWmyvU0.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):462
                                      Entropy (8bit):7.590385535170604
                                      Encrypted:false
                                      SSDEEP:12:EGxS98wY/w4ruSHFVZzm5hx4mUR4mG0Z6A546H/c2J/u:EmS9jY/w4VlDi5hxyJG006H9G
                                      MD5:3B0DEF10F82FAD68AD61D993839685AC
                                      SHA1:7E5F8799C53D1D3D6223E1D1F5760379308E11F2
                                      SHA-256:632781B65B3A9C4CECA11DF7BA337D1F0AD0E59915AD9847D3F72DBB15A68395
                                      SHA-512:4BD17095AE3246AF84BD11253E8348F70C508EB78129236B881C171BAFABBD830C6D61A47F9B21DE3FCF5948CF4DC4ECA563BE0C02E13107C95DD00442C57E74
                                      Malicious:false
                                      Preview:q{.K.@....).i@.<..^..E\bC.jF.UH ..2..g).. .W.:Si...1.5b@...<..`..2...{G...#...z.:.,..mG.XG....G'...<O...uSF`....')l.}jh.f.r..w....eE.}........PGY.'....<.]f.|.pL....Iv,....]>+..*;&...{0&}....mb=z..cu/.q....J.>.-8Q;J.F..:.X...$>.}M.6o.q9.....S5..K.......OB...A!..n.*.-....?.T.!..g.{.j...`~.8a;>l,...c..e...B....q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\OYtmy95.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.6004367906798755
                                      Encrypted:false
                                      SSDEEP:12:k6We+TwcQp0m0kHqokUz/gZFvzcxkamG0Z6A546H/c2J/u:kRNTup0m0kHdk82cxkdG006H9G
                                      MD5:79383C121B897688D4FC65094913C11B
                                      SHA1:E6DAC52C37B15CEC8458B6CDBBB2293B8B9DE6C8
                                      SHA-256:0A44020B9644FC351D483E2E063D0F00743B46975B3A1CFFEA7594B335723A6E
                                      SHA-512:23EFE7E85B9530B10227E4F5D40C45ABAD5CF3BA86AA74645D0DC50F1FDED639809D9F6AC3138B31AE30A50FDE942C5A39BC22F9DD6CB1B396075551676A9436
                                      Malicious:false
                                      Preview:4.I.u...<..i.>:.g.^..I.+..~..?.o..}?..@gn.f..$.-G....$..vL...t|..\..Z.$.DT.. ..,...Fy.;s..<r:[U.M...!J.:.P.....B..3.......);..S.L..;....t....;..X.Aw...l.4L4...K...fA......wX..+.(\vG...q../.7N ..qR;N1.h..v.~\4#N..JW>.-2.S.....!...p....g3.3.d.;......S5..H.........6,.xR....5s...LW...Gq<...C..*.@.K}{y..q.9....|.o.z.r.jS.E.B.r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\Ok9UbAY.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):475
                                      Entropy (8bit):7.536064804541211
                                      Encrypted:false
                                      SSDEEP:12:eU3zujgpsQkKk3y/jQEqu8R+hLTmG0Z6A546H/c2J/u:Pz2gpsQkTy7QEV8RmiG006H9G
                                      MD5:02203F3AD9BDFBBA3B4C25FE6FACF1DE
                                      SHA1:09959AEDBCC390A4919077DB5D99C5E595C28E9E
                                      SHA-256:BAD9B8E791BB0E1FD7C7E4F1F76302A24F2777C484DB1D5564005EF43948E50F
                                      SHA-512:27A6FEC6005063BBD28DC3A879C00FA2B3363284F0C8D9A20FA52B244D42E1312B455DCC9D8CBD796310320DBF16805810BDA9DC927438CE3D6D34AE69EC5A45
                                      Malicious:false
                                      Preview:...T...,.Y.{.VXc.``b....?P.$N.4..]....w.a%..."ijV..B..^m-..k5.4.9.K}^h..<...fl;Q..|,.U02..KL.Gkm..R.4.g.o..w#o......N.1T.u.fG..|..G..|5....C..'j......X..GT}u.wE..1!.g...+:.PQ?i...V..,].NC.L..U66._....4..<.4...j.-..%.w0....JT>.->.....y6.....B....Y..i;......S5..H........?..k..O]...D....\....K)..3&le..A...8c....p.....>..?../T...Er.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\PDJaGWr.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):455
                                      Entropy (8bit):7.5777935472971105
                                      Encrypted:false
                                      SSDEEP:12:FCtNgI0RJNIM8jO2qMwNFLETwx4mG0Z6A546H/c2J/u:FCtNgV7N98q7PNFwTsG006H9G
                                      MD5:4E6DD0A3B078B412A71A05938DFE286B
                                      SHA1:721B386CEE1D4C07BB843FCCCF3DB39093C5FE9F
                                      SHA-256:7F95BC029430D94B3B23826050F894557255FC89FFCC4A959643D01F454D5865
                                      SHA-512:252B3BD54ABC45E3C9E5632DC6007929CB5B77B8114C4B6B6455FC3B6741A131781BD5C060C62C2204E7C9A51A0D299F86BA5651468656DEA76186999E5CDA0A
                                      Malicious:false
                                      Preview:..N....~..{.w..j..@..... .i..N...D`...2;;Z.\.@.Wfx..>..pPd...e.pEQ!..+.s....A0...l+..8.A[O..](A...=..Z...F...0.1....J}O.....P.|sT..H.JZ..c.Av.].{P.n...IZ5oV...zr...lR...$(.A...R..|g....~.O.*.Z..$.r.JW>.-;.U...DM...GE.*.}s.cj..,.......5..H........xm..:}.Wm(PA/7B.*.Ng../(8T..^.....y....'.b..l..z..<.......|.]s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\PL4CMUE.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):487
                                      Entropy (8bit):7.595496175955247
                                      Encrypted:false
                                      SSDEEP:12:LGStXexzvBgrju7sk1hzjs1v/9m6w/XO19mG0Z6A546H/c2J/u:6oXex7BgrXknsVsv/O1QG006H9G
                                      MD5:4CBB148271D216448F26AC50D776A39B
                                      SHA1:5411F7AF301293E8FF49C26BA6779AA5FDD26D8B
                                      SHA-256:7EEC865AC9B09D5E6778850D0749A9575526B3403E20C80E0C4463B1A8F9A0FE
                                      SHA-512:304E11F8183FDF8368C2092616277A8C1C65C14D3DB0D3EAC10F51688AAB6BAECEE9040D6780D5A21008113D2D71668103540AD5B96A311F2AA2D8C2CCD9E1FC
                                      Malicious:false
                                      Preview:...;~4....=3.....f./.o.j.}...?...^;.4...p..3.g8YY.|L..uc....[...T:`j.5...P<.8V..W.+.9I...H..3...B.U4p..>2....p..A.]..f.\...12...!..BT.....-....$..j.U.s.[n...)!..~ a.{9..]^.6Q.y..<zvX."..... ...{..Pa._.a.M...S.....N......=.2....+O...J.?].;..9..3...b..D...Y..9.....S5..K...........w....C....D.ZT.(.;x{...;........{C=.....K.[......9.[..!qq.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\QmDqL5k.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.5027680754304065
                                      Encrypted:false
                                      SSDEEP:12:M9h1+ATG4/FtsttTSAx/izvY0bWmG0Z6A546H/c2J/u:ehkAB7sD2lvY0tG006H9G
                                      MD5:5DF749860B00B267E8F4DEBABB908B91
                                      SHA1:48874C1B7C27F3AA15EB2B21105A7CB236D05F55
                                      SHA-256:8D355C1FFAB74E226B66AE0570F79C2421E8DA50EE92E01665B63249F004B30F
                                      SHA-512:254A4462A458616A067D0FCFBB7B65B4F195B9DB2925B6CCF3E270F7B256B9E96C7F4CD4DD88AE5AE5F6543EBA2F3A40238E1A41E51CEF4BA0A1AD06495B66A9
                                      Malicious:false
                                      Preview:....^...-.Z`..^D.=1b.*..i...cb..d.. $.X..h. 4.4 4.&.;...c.......f....$.C.....(..]{..f..O.U.{-..J.m.. .....bX&V.o.H%4.....^..X....NR..AKY.....H.....`.U?.\@.'....:.#..e.~....Lw..hI...^.06X....Q.%.RM.Q.........J.>.->.S....:.r..$.:.0.....9......S5..H................{/+.4...h...q...OiI......l..|.A.....R.m.98..C.'.R......r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\Rwn6GX1.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):442
                                      Entropy (8bit):7.575338739474525
                                      Encrypted:false
                                      SSDEEP:12:g2H7y+DVB2xwbehm0MimG0Z6A546H/c2J/u:D7bCUQmDG006H9G
                                      MD5:4C5616DE0A1D398672A13A41F882F199
                                      SHA1:D11A3C84DF6E3BA192E3048C07F7D8B1821FEDF4
                                      SHA-256:68A4E63C269B5485730DAFAAD5E26C85AA11F446066A3B606EC426A5FF55AF5F
                                      SHA-512:05FD3FC5CD742E3852EDDB214861175C8C100F006C07202B4BCB7664B9E79F123EFD0A8C9AF7990116660A95E95F3A2438F4665A14351F3D8D27EE9915FF1236
                                      Malicious:false
                                      Preview:/.cu.9..f..O.8{&>.............a.K...[..^.......J}.U....4>.....w..oo$..^|...s.....".. `[bL%...y#...!X.D.9..kJh.....T.1........?.......|...J.h.0..X.="...R.D......nQ..Hd6.e..8W....?.7..H....J.?].>............."..M@...'......S5..H......j.._.Ns.gx..{.Xb.A......P.m.7<.v......3..z....!f.mk.2!1...."|.p.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\UDJfFhI.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):463
                                      Entropy (8bit):7.563448562840571
                                      Encrypted:false
                                      SSDEEP:12:6ajTD/p8vnOOWCIkgh24f1WqQJXYmG0Z6A546H/c2J/u:6a/p8GOJg44JQG006H9G
                                      MD5:5CC5735C39F3E259DA482AEF0C37E332
                                      SHA1:10C5286B7A98A8FE4B402ECC3902BBC26D126E95
                                      SHA-256:CBA26D507A20EF44E4492E2FCEEC3C2A84D01BCE87A519E6936F8BE4ADBF69D4
                                      SHA-512:FD6F896F2E597C82A1225FD579957E4CAE22C0D0906F7D3691EC42BDD2C8F9C2B778418BCC971C9CA9FB54B55D2D7767CA5FDE8125F86C2B5187DF45B7A21438
                                      Malicious:false
                                      Preview:-.*.....3;@./B0O...'^.Bj..g..[.Ki...... D...f.*S.....fJd..U..._.9x.DH....jF...n..].,..8g.?...>.I.65I..v.'.....J.w.....7M.....{....o..6.S...Xc.>...=.~......./.'.2.E.m&@@OYEx.&y....p.V.%R..HS\\.9L..}@...,.JT>.-j....&.....M...o..>..U.......5..H........x/H...`......Ok3..4...]..:.^.....J..].!V.../.z>c!....3....k...ds.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\UESAOxK.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):468
                                      Entropy (8bit):7.57208940646345
                                      Encrypted:false
                                      SSDEEP:12:enB6wmvRbo1sdEbld/94/zYgmfxjCauMimG0Z6A546H/c2J/u:wx8B1dwMzYfxjXG006H9G
                                      MD5:11845B17A93F636AEC43622B82EC0599
                                      SHA1:F4CC4E9C94B62FCA3035EE7D303443EF764AE6E1
                                      SHA-256:887D406F46D42132A5FFC28AEA464F239B2BD716CA3A9AA0C04F095DC302C4D0
                                      SHA-512:4EB557EE0D596A2DC9727A6E9B26A8E7545220C0CF5528746AFBC600181070251C22085355656F5D2173C7488D95EC270CEB85E0D644A33EBFA0C86DA2ECABA9
                                      Malicious:false
                                      Preview:..e...........dO...ET.\.rs..[....l......p..?e.h.X?X}....JG .Zb".I..M.W..1P@.+:^[...?...1..v'I[..q.....8.....I...M......=.)....dEy...X...J........X....z...W...-...nw.x...u0..%....b.9.d..N....t/..;J...C[..6....JU>.-:.......6.r..Z7...Y.9.....S5..K.......i.@&..?.b.H62~....K..g.a................l.I.O=..;.s.ph:...$..q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\VSeEPpa.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.532099073945223
                                      Encrypted:false
                                      SSDEEP:12:3J8Pj+HPHG8walJWu1jkonkmMlio73OmG0Z6A546H/c2J/u:Z8aPHouY4jk8tSFG006H9G
                                      MD5:82F3CBF05D06391170889F8BAEBB5573
                                      SHA1:86A8B78FFAFF4F0736B9C23D7860FE6779F13C9A
                                      SHA-256:3F9A4D8CFB991287E071A797F84CFAC09F35B5320F4A5ABDC40C7C67AD052D26
                                      SHA-512:75A169617641BBCEA9DBAAFC694DAF871FB68F4DE776078664ED142C10AE01B06943FCD9DD060973CD47C2657871D5AC056F7BEB8C41A185E23EC68FE520D877
                                      Malicious:false
                                      Preview:....m.U>....ZX=..\....(..&teC..n....oBi..f..5..?.jD.b.....1..\.`..S4Z.k..k..*>.R[$@?x.....O.s.q....Wj. 2.sp\Bu..O.%..;..I.S..S.vsy."H...KAV.&SGj$c.C..G".,../,..#..p78a{]...p_.........P`Vb..........n,.G...J^>.-jA3..Ft....h....M.6o.q9.....S5..K.........x.p]......dd....oX9H..M..S.ephn..Xo+..~.....'..)V+\.ii..`m..q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\WKCPDGH.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):455
                                      Entropy (8bit):7.478375320088587
                                      Encrypted:false
                                      SSDEEP:12:MkAnK0FqQ2cTvXz0+BGvUIhcXAMmG0Z6A546H/c2J/u:5AnK0A7cTvDPBGsIhcWG006H9G
                                      MD5:E52F3ED7160755B2CBD9F430575446C0
                                      SHA1:65C6673764AE4349CA6475502325FCE01C6BA6E9
                                      SHA-256:FBFB2A5C61468D280B56E9322250280D8D6433FD7C27CB04756CD907AF10B5B1
                                      SHA-512:A933FDE09B95294DB660FFDFD0D0F0999A6F6E261C8A2CFF6D9C5123D1EC072B6EB3ACF009BBD37D7636C644739258BE2C13E0ED4CF58DE43EF809041D088859
                                      Malicious:false
                                      Preview:.:...A...2..`\.B.u....c..K7x.<JW...gp.m(..D..."K..%_..8l........z.45.s.d.n58S..#.dN.... .-.Vg.H ...!.5.- \.CZ......i...5N.jFbM...H=.....J..y.......T#..@.o..8...5-...\.y..w..j.)Uh. ..!......"H ..G.(....JV>.,...9.K.........S....9.....P5..K...I..<....:.e..>.&..C.jp.,+..+.Aq.8.'..k..u...6.d.../M.....?0m.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\WtR2tRM.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):438
                                      Entropy (8bit):7.557799767498779
                                      Encrypted:false
                                      SSDEEP:12:KrcoPJwJjaX27gZN8L5Hmh938m/R6ZumG0Z6A546H/c2J/u:KQkJwJLgZsZu//MG006H9G
                                      MD5:8D18EA4DC7F0AD005158DA9A413A999D
                                      SHA1:50BCA23D0ED2417CA350D3119118566E7EE9FACD
                                      SHA-256:1675A13DF2FB548F4480E2BF33959AB467C6917016E9D4413BF78963C7F13E7E
                                      SHA-512:7693E347EDACE41B3D8AAA21155B38CDB5B2EB690C51E000C0207190769F73F5A613657679A5AD2EC1B7916B33856B6F501A4F9BE5B73C7D6983B25587470C31
                                      Malicious:false
                                      Preview:.5......=...eYc........t.1.G1..@]AV.s3.5......VY..Q...$.....w}...~N,._..H..>g...rWn.........&c.i`.1R.>t...Uc.C;..N.bv....i...F\..r..........al.c..0..e)t....L..Y....P.2..2~...A....._.JP>.-n.....DM".#{.0..v.Y...9.....S5..K........ .gj..W.?b.mA.]7.(..h^E'.3.F4.*....U..j..._..A..o.*.s....kq.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\XjZ6esZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):457
                                      Entropy (8bit):7.588958410939705
                                      Encrypted:false
                                      SSDEEP:12:DUt9l1lCHUNS/WFGeGMII2a9mHTZmG0Z6A546H/c2J/u:ItbH+WF6LILswG006H9G
                                      MD5:9C57FC10E94A86C1BA8D135775AE057E
                                      SHA1:DB577B6451FA95246EF7315B700B618D4AC6D86C
                                      SHA-256:25D4D3168E220FEA560CDCD3C232D0487563325CDB16DDE6A955476A263F6936
                                      SHA-512:2D480C00A0157E5A856A5FC79F48F6A2F0A72614E8519134C15741CCA096565B186FC388024C3FA547C1CE15D3099EB5321A325889E89CE09DD20A9286D0B365
                                      Malicious:false
                                      Preview:z...d........t&.Q..0.@E(..@.Y.P....s.V....t_..grJ.8.EsY.B........F..=Z.:.oQ.2&+..U..ae...`c|.j.!.{=..(.D.*...&'...7.Z0UoIk...s..m.....}..{.,b..rU.......C7.IS-3..`..&....+.k&F..)/lM8..<...~..O^..n._=..*G4.JP>.,...3.z......M.J.."....9.....S5..K.........Z.z...L......hf..S..P_.0...q:6.>M~..V...X.S_(,....19...|Y..q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\c4PeCiZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):461
                                      Entropy (8bit):7.486923030787059
                                      Encrypted:false
                                      SSDEEP:12:6g60/QsYCZXW/s5vccvMsbVYmG0Z6A546H/c2J/u:6gVZigvxVHG006H9G
                                      MD5:E7CC14C031B775CE0C790295D215B16B
                                      SHA1:C74D187163828C6992CAF23DCB3FEAEB3CD5EE20
                                      SHA-256:AAB7BF35E58F88AC024706FDC73E847B02C792A625332298F3F6A6FE2B45D7EF
                                      SHA-512:0CB9712B0D837E4351659ED92542664748E968F988782C7A7F34B639BCADF7B1DD8AD531FAEDD7B1432C3CA8BDFCDF92BE7AF5BB082224251F602A5BCB7D3E1F
                                      Malicious:false
                                      Preview:e.:...6.hS.%..k..`.GX....x....2.W?..j_Yd_K..hI..eccT~.a...m.g.VXS..F.^~MCn4....9.H..W..............K.-Y.....h.1,..Z...B.o.L....:..x.....>.w..|...h6.......h0g.T.x.+3...........'jS.H.T}..$....:.$....[..n.JQ>.-3......!..s......0.........S5..H........0.xZR...W..!..x.z.....V..O..6R..O9.&m..:.k....@..4..........r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\dBrBWyV.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):467
                                      Entropy (8bit):7.551678285943495
                                      Encrypted:false
                                      SSDEEP:12:xXtIqkw0btRuddUl+jqbl4mPvmg6EiWjmG0Z6A546H/c2J/u:pSqkw9da0jqbPPuOIG006H9G
                                      MD5:41ACB8B30C73E232B24C0F933AEBB23A
                                      SHA1:69E5DF79ECDED4E156FC451ED59C6B36FD0474F3
                                      SHA-256:29D8297612BEAFF42D14AB3152F89A81E5FD33C8E5583DE4FE8D41BCA4CAF359
                                      SHA-512:E1E1E5CF0736D8C0F5F5EE5167780F573BBFD926643969BEB46955660EF3F69FFCABF35EAA3142051D286A364CCC591636279139E202EC016128D11E7C3E1C13
                                      Malicious:false
                                      Preview:6$Q .m..#.....=..z..u.S..S|.r7.A...r............HS....c./S...............e..6,*U6Y..R...Gm4N...9...#i.Cd."....."....}.~.C..{q..?..^.b..Y..3?[),..h..5..g..T.l...W.2.(.3..+2<...m.PG...V0...d..ZYo...W.Q.......a.hc(.JU>.-n......&...F..D.q.Y..19.....S5..K........*..Q.s..B.L.q.....g......|..!..S.^zr.q..Z.rq...VX..$?.w..q.q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\eqqONV2.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):478
                                      Entropy (8bit):7.579233095883621
                                      Encrypted:false
                                      SSDEEP:12:6X0ghyZgchPY1OEwam9RsDOh0TRmG0Z6A546H/c2J/u:5POwamADOioG006H9G
                                      MD5:B09406E865FE6E63F132BE7B06794FD3
                                      SHA1:6E4019B49B4FA9DF4417FEDBB677ACF74F60CA5F
                                      SHA-256:F3A4D75601A7F6A6F69DD97B181798004534C2AD85BE43684058502BB9328AE5
                                      SHA-512:FEB7EB18C46AF84C358EFA7BC6BDE86B342AFEBB29005DA45720E404C0054D5A1995BD010B6412B6B2167C540453FECB656654A9B6C29E2455CA6C4433EA2467
                                      Malicious:false
                                      Preview:.7B[..r..@.r.....Vh..O.....Y.a\;._..Uy.]h....T....bA.4I:.{...............a[...[.(E..f..?.........u.=ON1...K.F.-V`7}..Y..-.O8..:.3..W.(..t.i.\"....4.x.'T..k+D....M..:#..d.....>.O.....LG...[Z..Q...D..X....B?).Y.q4..^x......JT>.-2.P....6W..z..E..............S5..H........*....,WsP.....u}4.*....}.2...n.p}[.'..."...LQ.EE..U........%.xr.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\gVcTR4q.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):462
                                      Entropy (8bit):7.553204935670806
                                      Encrypted:false
                                      SSDEEP:12:T5bS4Cvpf7gbdBHofevn7N1amG0Z6A546H/c2J/u:T5bS4ChfEnHofIG006H9G
                                      MD5:F247BB8490D3B6043718F8357D9CCD2D
                                      SHA1:6987BE837FCDD022896C2DB989500527ACB4EB84
                                      SHA-256:02C84CFDE44175999CBDD6E9B57A0E2EBF93556E571BE3C18D83F135A1D8AAC7
                                      SHA-512:9BA9A348B83316FED4E410EDE5B61A3846710507C0EC2C77A13CBD337A8B786F2962342C4F57141415C2D478336665FBC3543DA2D12920B716292779765712E8
                                      Malicious:false
                                      Preview:b).....).}.S'.j..-...,\.p...jI.DB.i....s.$...0_...b......BS..A....>...(..;r..xT.zm3.[.....V..7u..v.#..WW%.Y|....._ #.h.P...`...=......<G.p$(su....0..........v.9.....Ro...t.[..7............>..8Kl.r|s...d.J.>.-?.T....".r...+....Y..;......S5..H........N$...F..:z&.[8...K.s........+..X?..m....R(.><..v.U..4...h.^r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\gaBGWCw.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):440
                                      Entropy (8bit):7.5521031386569115
                                      Encrypted:false
                                      SSDEEP:12:PKdcIAKmzLtb3vU9rXrHtVDGmG0Z6A546H/c2J/u:EszLt7vQrXzt9pG006H9G
                                      MD5:5BB6D1F98069FFF752760B0B456F9D26
                                      SHA1:FF010E56EE21E4C17DF7954F2BF8063C4CA91230
                                      SHA-256:66C077B9C38A56344FFB2F641859074CD4053E2B7AC64C0104DBF72A5EF8DF8B
                                      SHA-512:FC813A14C1CE57C764A8501358F526640696E6347F21DFCCA7D9C6F722854E7E88CC0F9673885A8A21BC9A7270449EC9268ABD8200A57A34E1A128382872861C
                                      Malicious:false
                                      Preview:..W..Z...........Y.9MN.....|........u....+....{.zV{...A...Ti.......p..&Z.....L(o.Y4.........B.....OS....c.F....<..ID..CNu%.x.,....C..X..+|....Z?1..T...rk..>..H-V>.B.7..?.<.....C...J.?].=..4.o..I.......s.'.........S5..H........U.r..hib..D...A.5..B&Z.b...0.._..$h....Q......V...U..0...v8r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\hoKms7G.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):463
                                      Entropy (8bit):7.546029704166121
                                      Encrypted:false
                                      SSDEEP:12:radIuMMu22aPXlVDhVomlVEcnrLMSoMImG0Z6A546H/c2J/u:rdhM52aPPDUykSoM3G006H9G
                                      MD5:66DFCAFB2C53D82F7F4376F2123F0901
                                      SHA1:3986BEE644B6BA37E6946A0DFEA6511973E7521D
                                      SHA-256:13E2501A129DAC57B2FD165EBD1355DFDA6E83314C8537D95DEABB9AFEDA9E57
                                      SHA-512:5C1FF877499B96304CE118566C8916547C5BC9E65904399BE5A5303C33D005AF63859F9792B74BDDA24273E6E6D4CD39578816C346C0C500CBD561635D62A05A
                                      Malicious:false
                                      Preview:w.+...p........}..?..Fn.`#P........i........6.m.4..JS.^..#.T...|.Z..b.s...5.e;y....`.+.!..{.M/.S....1#/....=.#.b....I.~.A..9.W.....K......N/...+....A..q4.:o.....|.ip..$vD6..X.d...N..F5...]$n...........<.a.....J.>.,..R4.j..L..;.O.A.......i;......S5..H.........E...T..L.._?.n....80...~1..a..:%W..(b?8...H!....h^...(4...;r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\itckQhe.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Public Key
                                      Category:dropped
                                      Size (bytes):468
                                      Entropy (8bit):7.579803845005159
                                      Encrypted:false
                                      SSDEEP:12:4XbG77qOa6hCBcM/ox1Hpf8Rvvm/jeQImG0Z6A546H/c2J/u:46qOa6hCBcM/ovJf8R2beQ3G006H9G
                                      MD5:A7E3D666A2A9F5650F32CCE5D0EB3209
                                      SHA1:BD97318D3E28A4DB5964C378BB0F86C89436A133
                                      SHA-256:92A692864BAF34A0B7A5298A7F848D8F705B0AF6DF2B99CA7E107B26791E458D
                                      SHA-512:39F39298A9D8D58E79C69C583F9DB0927458762DD2B70F8A38A0EE5FB70273AF5F0D321778563172F8E221497DAE370B3EE87FD22FB25E0040D17E0551AD4465
                                      Malicious:false
                                      Preview:."v..yG...psc.....x...lt...u..~.8..[E.&#...-..-.......p.@..x*.O..8...$.....vp....kt.U.H'.M..,.......g.0....&M`..Ci......qDj.t....6..Lx.dR..B...~c.[].k.d@.J... ,J.l.:...-....#.....Y..>...oG..2o..\.L...B.....3.8..JR>.d....9J{....F.....M.6..9.....S5..K.........L...'[dZ...$..e...t.k}{n.M....H..F1....5."v..Is.4._9V....q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\jWu0OXa.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):432
                                      Entropy (8bit):7.49959688540723
                                      Encrypted:false
                                      SSDEEP:12:OnPlGOt5Hj2lYmNUg/EL9cJqfjtVmG0Z6A546H/c2J/u:eGOtGYmNU6ScELiG006H9G
                                      MD5:154EFEB30E502469C8A4DF69648897C1
                                      SHA1:7077F12631A3117652A29EC8A6A2A4AE19A03CE0
                                      SHA-256:06AD66347DE227FAD015184AD120CBDDD375A48C2F1D24C3E88A8ACB60328697
                                      SHA-512:F07854B2EDD6CAF1F233390C86E2FD3E2E8B25140523F4F18E299470D0E4165347C7830ABF5E83B5B7481DBA8C085E9D8A7BE6A1F6EEA5CC3D2570BB35D1796E
                                      Malicious:false
                                      Preview:k.......N..!.\./.4......R.EQ......l.k5..<\-.~......~.~.!Z....C8@..-.3&.%... .r1..f...Gt.Z..>..,.n..z..mcl7.?.np....:ns..4te.'....'k..Y.6.G...V:..l.w..H.).'N..$.h>..N .o.f...8...J.>.,...4.o..k.r..wD....Yj.7;V......5..H........x...-...^..Q.;j..c.........^...R.._rLf@0/,.b. :..x|.......K./e.s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\jlAkejA.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):476
                                      Entropy (8bit):7.5921031122771225
                                      Encrypted:false
                                      SSDEEP:12:bvfmhH74hqHoLH3ybwRYiVTlmG0Z6A546H/c2J/u:bGF74hqID35XVUG006H9G
                                      MD5:89C6093BEE4B390E59B63602A31DE0BC
                                      SHA1:65223E89AC0D70DBC52D45A4F9ACCEF145C06BB0
                                      SHA-256:E1EAC14CFAACB7A5698BB5D247AAFEAF6A6B5A6DDAFB6AD440597AF523DBCB71
                                      SHA-512:8DBF9C4F4E2D68A88FEEED1393DAC6CAEFF8E8A252C3188A4617D06F872EFB0BF3A7EC6823C26D7B2EE700A7D15B5F680A2A0D53257D5505D8424F99A510263C
                                      Malicious:false
                                      Preview:..d......(q.[..ZH...1.4r7.:...=."...:...J..,a..is...FE......m..+.;.H...w*#x...b.[.....#..{}$;w...#.O..S.....^.c=.c...I.q......(.+.....a'.)~`R.2.......8..)q..k.4%w....a.......RF..........?.x..u%O!..V%.i.....R...y0...J_>.-:.....DM"..................S5V.H........x.}.tF.m..g....z?(...x-.fN...P.p.I..=m.:$....v5...DW....U.%|)..Tu.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\mMAYuLe.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):463
                                      Entropy (8bit):7.482725073358119
                                      Encrypted:false
                                      SSDEEP:12:tbZRxRkjryMj2/7HCgdnptkq2w6yTmG0Z6A546H/c2J/u:9UCE2/uYYq2w6yiG006H9G
                                      MD5:04402F8FCC6C9D38E232BBBA8062ED12
                                      SHA1:F15239C37F6080153D9C6275A150EB55ECA56D42
                                      SHA-256:3725A4E22EBDCD9CAFAA6BBA62A8A71F7348C8B0BBFD23BF7DF71269D2BAB8E5
                                      SHA-512:C4792C7A22725744A91BFD17EAF6C249BE03D652F4A2150891714D07DF848BB20FC62327FE79F651837211FD9BA09FE0790B625EE94F39BE049820A7E0D00E04
                                      Malicious:false
                                      Preview:s..n..4......a....>~..*.D....y.u.k....,..z..t:..5....@..).wO.N.......U.C .xC.\l".jPL.{S....F.7..k..q.....U._..{...v.._e.....X..<yQ..".4.h.....LU1`7J.(+...Z.....$...z.9.QP.@?.F$>G.(.(.`;/BC.z........y..!..JV>.-9.....DI".#w...7....i;......S5..H...........a ..........y....?i...8.&q>.....C.t..a.o.V.;....{.......r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\mUuROT4.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):468
                                      Entropy (8bit):7.5125094805322385
                                      Encrypted:false
                                      SSDEEP:12:onOGckLcq1adsKRAG1PmQ35iooNYvmqz4cmG0Z6A546H/c2J/u:o7Qq1ahRAOJiNNYuIeG006H9G
                                      MD5:9C0DA7F3097D0273C13FFE47CEA27E8F
                                      SHA1:DC1D5438D95B47C95AC037CF996EC330E709DD3E
                                      SHA-256:7389F6CD7845D8798556F9F2A79425B443BD83E1969FFE5B1D602216FE6FDAA9
                                      SHA-512:ACFE1FF43CB08D06317C895D40CDF71975D61168291363A669A2FE127AB25768D9A4704CDB00146D97AE0D3B831F4EECDA957148EF12EEECD8997283095458C6
                                      Malicious:false
                                      Preview:{p..K.>...=k.76-..>..U..#..<Afk .`..."..{R.S...p.5b../...D`-.-..G-...=.5A....(...^.....os..y....G.W^C.p>o6..}.?ty....v........[gn..D.eE"."./...'.....\.vg.....d.\8....Ir.#.<....-.7|..c.._@......u.q..}...S.i.t..UE...J.>.-?......!...k.L..8..Y..19.....S5..K.......c...)...)....P...a..Dq.=...Vi....U.u.A....~j..ZDox*.-..D..+2.q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\mZBZBIf.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):464
                                      Entropy (8bit):7.570741200087962
                                      Encrypted:false
                                      SSDEEP:12:jM1qOyHjxlAkKKqlmSHlzVoImiYDmG0Z6A546H/c2J/u:jtOWtlAkMsUlz8idG006H9G
                                      MD5:4778634E6E54DA15D45BD6938C17A5CC
                                      SHA1:7F605CBB92D54B14F7DDDFFAC13F7C03275F30F3
                                      SHA-256:797058880A691583500DEBD1758D4C4ED1AF92A353D3214AB848E62E9738F267
                                      SHA-512:340F516971533C41083FCEFCD0469783E372616DF28A6D9134216C732C164C1CEC05CAD27B2E1B454E04F537434D4BBE1B07E0FD0F8583DD8C6C53399C3429FB
                                      Malicious:false
                                      Preview:)..$P..ECE.U.'.xCp.^Gqe,...(.6j....#Z...G..F..T..0A..#.8.....{6H.....$^U..0......z.poL..n..2...Kg5.........HF]..EqX..]....0..&XY.q...#f.}2}.y..YF..%.a..m...j.=^Y.2.o.GnNrq...K.7D.#+...?.u...:..:`....n.U....U.JR>.-3~.............+.b.....9.....S5..K........e7$...]OVe0(h...{.a..zF.*...A...`e!S..'.K....{..=.zS~...q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\nE0JAji.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):465
                                      Entropy (8bit):7.626390093370324
                                      Encrypted:false
                                      SSDEEP:12:Bq1EJycQ9zbkUGW8PxeOIAT6ZopR8KvpmG0Z6A546H/c2J/u:BBJvObk7g66SpmK0G006H9G
                                      MD5:C5F055B029FFBBFED02728AADF1E66B8
                                      SHA1:F89212639AAC1D5BC5507CD24396479E9375939B
                                      SHA-256:A6BA9F3E53FC40E909463772C980C75961C1A0C89E00FEBD77783E658B5FD035
                                      SHA-512:FB7E92B5D406D9113A54BCE2051CE5AF91A135BF441A837693F10F4FE5C2668B00AC99659E86494CE082D3C04EE8AD6C3721BBC3CF8AB531D32985E8FF44FBD8
                                      Malicious:false
                                      Preview:.+r.]2.6.e.xZ..|.w3.,.:X..y...._.A.....x.a..I.....!..3.\...d.t.+7}s .njZq....l..k.I|.IV..+.. .oOXZ8...x.Z...Q..B..9..[N.8....Z.o.!.&.l..J*r;..i...B@.z.*.p.])V._....\.|........yb).Z.=G3..2....p...6.....0......J^>.-mQ3..F..".az.....v.Y..i;......S5..H..........'T.E..Na....a:.r......(ws.....k..4G;..c.g....#...V6r...h..n5r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\nZGR8IM.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):438
                                      Entropy (8bit):7.5502218076380885
                                      Encrypted:false
                                      SSDEEP:12:0g9dWsSQfCV7G3cu2ZHLFMIGVTgXGMrGmG0Z6A546H/c2J/u:5WsSQfCNgu1TGGhpG006H9G
                                      MD5:5CEA6F01F2D3911FD5D00186C7AF0851
                                      SHA1:E78D755B0DEF0A8E729F2454E6424EFA4EF7247B
                                      SHA-256:37241DDBEB6319F0BA0BBB67155C828AA6DFCA9844EFA999BA4AC70093045F99
                                      SHA-512:C083700CC52F64733B9A4A5D58B7F47D008BE44125C336A388ED83395A1D79EEC3EBD8E4C32BDF67CBE65E4FFCAA237DC41421F2400404F7FCCDCC691FED3C61
                                      Malicious:false
                                      Preview:..\...WUB.....K..2....._d%b.E.F}TXA..\%j+....!cZW.@.7)PJJ.Om<Z.U.5'.gV...K..sR.t.5r8.|.p..!\`.(OR7\.........n1.o.5A`a.q..c,.....p@..$....:..........~.b...I........ojzs:..O.2......JW~.J.>.-:....{.eK..;M7....7.&.........S5..H.........z.Xy!..m..-R[o..B......h.wn.Vh.,.4.p....m./P]......B.v<.].R....r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\pFyCXAs.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.589363074793689
                                      Encrypted:false
                                      SSDEEP:12:QCqY1L1ZYwyjxT/LhqQ631J93WmG0Z6A546H/c2J/u:8A1Z1yVbtqQ6t35G006H9G
                                      MD5:CEDF684E22BA651ADB4A4B469991FC9D
                                      SHA1:873CEA8EA06E0187A2AF5E114470B3C7B9877575
                                      SHA-256:04CB8B8EA93A20F96837B2CAD7F2584C931074692EE44B282BE7EB414B46B537
                                      SHA-512:E93E567929795207EC2BE3F5281EA04005030A9B82A0D087ACA38006CB20196A02C731E5EBEBE9309E3E7955EC291FF385C87430F6B7C9E0541DF37708861A39
                                      Malicious:false
                                      Preview:.2....|"..97..(..M..\}..gh.3...&D..J...aa..i..u.........lu..C.#BB..TL`........h.\....b....5I.3.....X.*R.g0..GG.s{...p.C|....).......")k.cL86.,......R...Q......5.p.`...&C|a.a.OJ...>.uS.;.,P..Y<....^.........JS?P.n.P=......c.Gu...}"..).9......S5..H.....?V.z......c.....V.u[1.r...SI........._W....`..B3..r.{.....^.o.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\pKz3d5t.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):497
                                      Entropy (8bit):7.618745126074852
                                      Encrypted:false
                                      SSDEEP:12:8IDW1cWA5XIslqJ1rlllm7mG0Z6A546H/c2J/u:tDW1XANIsgJ1ZJG006H9G
                                      MD5:6E4E428ABE32D27285A2504FCE085640
                                      SHA1:65DCD3A3F109F6A9C315B578134A1B303CAA2D66
                                      SHA-256:B79E65CD24521214A1C5DBE30BCEEFF54CC391C7D75D4DF74ED2F3CB9D4ED132
                                      SHA-512:708566241037DB669A61DE58CC1DCA06DF547861B217DE2CCE515F1F528C64FF25DB6AAE85065789D25E63F1FBBB2DD4A802D3F51F4AEE6EAA077BAEBF5888C9
                                      Malicious:false
                                      Preview:...c.....p.........`?ER6...g..o..<3...r...G.b}.P......2B.t..Kr........iy$...H..Fel.,...U...!..#.K.......om$....(..8o...TW....d...~.7.z.ap..?.".M.y..h]>"...X....x..<B.9.i".m.O..g.&....|..DM.k.6.wn....$(.E%.._.Db.,..$..N.k..$O.-.z...JP>.-?Q?L.A..!...|j.?..pZY(.rY.......5..H........x......x.oU.n/`.._...$.. ....)_..p.t...5....B..f.n.w.s..j.`s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\pNlq8Hg.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):465
                                      Entropy (8bit):7.529303540622522
                                      Encrypted:false
                                      SSDEEP:12:8DlVvGiSxYR3mvjQqXYo700Bl7j4mG0Z6A546H/c2J/u:8DnvGTYVCjZXYo7FBl7DG006H9G
                                      MD5:74A779135D7474A4CDD5BDA8ACAB6F8C
                                      SHA1:E572BF71F51FCAC43348D3C1C8370D0C031E0024
                                      SHA-256:C54C8DFF611CFACD48C9DF4F1DA31A867376121502714917A8B0AB2724E6E000
                                      SHA-512:FCEEC200F8AAE42750A398E58C98449427ED5E20C671F9D711EAC963EB81F3FAF79BBB22A5ED017122D550C806772B350C25C7433FAA5F13C7E674EB52985146
                                      Malicious:false
                                      Preview:2.]..Q.t..........<.S........Y..B.:.n,%...-Kw&..P..z..8..<....d.]n..Z.eo}V...fL.3R./.m.m...U:.)?.!ig....--...[Q.vW..e...."(.j.`...j....>..h..2.....O.]......1.!.9.......d.8!.......1&V..BP..v.<ol..`..k....D.<Y7.JT>.........,...{..y_.....9.....S6..H....6k..z.+.].w<....(.G.......5V..mTr..*..V..".d...E..0..J..].|._d.n.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\qkJO6Mv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.530064950098379
                                      Encrypted:false
                                      SSDEEP:12:9nwyqNjOihx8aco1mWJRWbv+P9O+aNq54oymG0Z6A546H/c2J/u:hwPiihuimoWbI9O+a45TG006H9G
                                      MD5:F03067AB21C44EFFFF1416E71F635A48
                                      SHA1:88E7A6314659B3E3451E5E9774EBE2BA1CF953EF
                                      SHA-256:EE0307A454BA48407D867FA72FAA2C917DBA9E2773EA74BBFD55C495F82632F8
                                      SHA-512:B42F510232D5D6B32255E09472B1D23BAA008C210A8B48D7A013B5840DEF210C63110E482924D465BBDD315105845BEE17520CBBAE1A6272890B099D90DD97E8
                                      Malicious:false
                                      Preview:.....w%.}.._...$.nO._z-5..b..q.....BR...x.|..)...I`9".._u1....o.L...1...<VX..$...n..|*].......cT.?n...v.G.E.5%X.X......5%.y4.M.$x...x.M&.8%.tixWsP.}./.>....9....*...g%.l..B.i7&../..Z..[[K1.A....w.H4.>..JW>.-nQ?..E..*.r..Y?..s.3.........5..H........x..`6.R6un,....].....R.......Y@.D.|.+..R..........xR.>.l.+.s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\qlBIeLp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:MPEG-4 LOAS, 4 or more streams
                                      Category:dropped
                                      Size (bytes):461
                                      Entropy (8bit):7.571353461375343
                                      Encrypted:false
                                      SSDEEP:12:0CnwzJd3irgKUnC/PPD7ZzXAM9TumG0Z6A546H/c2J/u:0Awa7F0MvG006H9G
                                      MD5:D3850BFEEE14A2DA96E0690DBE860648
                                      SHA1:FBE4501902F2D3F5722953F7315AB8E9FD000989
                                      SHA-256:6259AB2017272B68521883E8DB77CAF0C19FD21F088B3B40CAB21C67D9E1ED7C
                                      SHA-512:A0F26B1287643ECE3AC07BB6ACC748754B4B7371C0D9B103EB3B060D6E4D70982E41C5BDF56EFA3FF3B64A5B339561BCA7E1A0F3698F4D65E4F33C617D00C67F
                                      Malicious:false
                                      Preview:V....9.A.b....\TV..) ...o..#y..Z>wW.8......\.@......r>........X...z..a...$).Q..m?(`.e..qO)..FV.k...r..w...|."..O..Y.....X....}R..V.Xy.U.f[.y..)"..l>...t...a...;...#aV.^.D^..J...[lX.Z....O......"E..<.b.JW>.-n.T.....*.K.j.. .M.61.'......S5..H........O..7."...f.......80..z...iyFW8.Ka>.K.....ji.....tC..:.<./.M.p.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\qwtve7a.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):468
                                      Entropy (8bit):7.590879978086246
                                      Encrypted:false
                                      SSDEEP:12:4/W7bE0rOoZCgpe6DVtjH2s0mcQSCN9lmG0Z6A546H/c2J/u:v7hVVdWknSCvIG006H9G
                                      MD5:0C8FF344CD65BCA4713764041BA95091
                                      SHA1:50D8347AB2C0FBA6617BC4D858E0E4EBD4B9AEFD
                                      SHA-256:992B242F06F9E8EBACCE5253E94E78CE6FFE514E58EC5ECB39A8F2A7D90BDFFB
                                      SHA-512:239472A94265D836D4CD2E57D5AC64F238958259B71351AFDE6F1CBF4681D925776F5C94D65A70554CC6B86086E2DE9F4F609D18D21A36EE7AD0E7FB07DD4082
                                      Malicious:false
                                      Preview:...t..3.|.v=K..\. .J.L.....`..u4..1.,....[.-.g...@.".../2.W.3t.....Zg...,.u.d..Q.E.H~?...`j..C(.......1.|......T.....b.....$..p."...4.p.......G..o. c..,DX@.b.2.............&...O.br.1.SI......U...wc.S.JT>.-oQ;..@..#......&.Y..9.....S5..K.......O#......MH..3.+_..d...I7a.!... .MT N.._`...E........:.e..0q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\r6ERxwz.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):481
                                      Entropy (8bit):7.544234049889198
                                      Encrypted:false
                                      SSDEEP:12:+q/chYCfDF3D4DtWvstl4qtbm+gSolmG0Z6A546H/c2J/u:+Wc+Dr4qtKAoIG006H9G
                                      MD5:31A828F6E55F07340BE5120E0F10904A
                                      SHA1:5DA698DBDACDB508F1E5A8436C954027993ECD8D
                                      SHA-256:6D65A92A2053CA9C84F8366B17F9FD74E813D2EA33163AE2B41661F006158789
                                      SHA-512:5FA0233B68BF2E4DFFD36552A0576E10B466B477362D6443C6CAB154201107C4701EE5D1F4C1DA76AC1E0023A74B60E22A01337CD08F777D7DEAB162D12A3369
                                      Malicious:false
                                      Preview:.FS..._..W.......2..D.....n.....`Bw%9)_..=u........Fow.T...P..(k.."..U=.O...Rz.R....:lEkm,..'..nW...?....y....D....[\...u....h6.....1~Y......dhV.@..'...-g5...$>..;.V.|.s.'...I.#..M.V....<....b.Q..V...?...g.p..[e...O...."Oo.J.?].?.R4.o..N.........$...9.....S5..K.......s....P...:.(UK....z.....q4..e/...u.!..........=.....P.h.....G.4q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\s3SQcMF.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):445
                                      Entropy (8bit):7.527913907925218
                                      Encrypted:false
                                      SSDEEP:12:OPwbKfYjBBTHTQAgss51D20zwkImWn4DpdbzmG0Z6A546H/c2J/u:JbT3EAgh1MkBWn4DzOG006H9G
                                      MD5:34A8EEAA3B19ED9D6F1A278F649834F2
                                      SHA1:8F05023DA5483397BB8AA9CF416B336B2B8385AC
                                      SHA-256:BBB7EB9033019A616AC54BAFABF48CDBB98D0338E0896260C300E10CE1802DA9
                                      SHA-512:DCA36977E0FE8FD2B25B5A46B374858E63E49A93D9FB2E8E801A1AFAB6D0D42E620ED485B428DAB3AA33996777DB8B9C9FCC8899ED7C5AC021D946E87177C2AF
                                      Malicious:false
                                      Preview:.,..n"...E...t..`.Wa...o.I.$.f..6.1t_.q..0.6............b9..k.)..F.._..Yi...Q....u.I.zg.IS...&.sZ[...k..U...@...T0.l...&y..........{..@..c.e.ZB1w\.......7.7.V[1x.85..{k.B....k..r.......[..I.J.>.-:.S...}>..v.....*...b.9.....S5..K........pW......U.m..}.....[Q:...|XL.{/.i.9.R........J...m.3.f...SGq.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\xLL48yR.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):462
                                      Entropy (8bit):7.556166116524162
                                      Encrypted:false
                                      SSDEEP:12:DOoPx/UFBPgtmViHOubjRTYdCmG0Z6A546H/c2J/u:qqx/Wytm6OUjR07G006H9G
                                      MD5:E8756968FFAEB4A4BDB9C88D08266CF3
                                      SHA1:6B874FE128DFE8CD0A57C5BDE19FE4FCE26C2795
                                      SHA-256:D880483339258C5A58520B615B8349EE486D2685384766D851C574F57EE35B85
                                      SHA-512:F26E096C0A6F2C1690766A0DB6FC3C8ADC00241DA4A07099D73C95532491A2419534A2E7E8EBDA64BE820DADC98254755306B4AE407343715B59263D0965E8C5
                                      Malicious:false
                                      Preview:...{5..(.SeP.....-.Zq_..e..n.I-...m........#..(_....c.Z%.o.[....XD.}...>.pl.*..W...5...`...#...U.n&...s.@..Gk.,0......._.! X.`W.+...c..e3.v.....+..FTNB.^YxY..S\..1.....B]`~:.>.T+.H.Cw..)...ea#b..,m....?j;.W....JR>.,.3L.@9....G...@.M.6..'......S5..H......P..;..~i.g........r...xH..2+<..Q.5..v..w#.-U....a._,.y.....p.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\zGVqGv2.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.566891815134349
                                      Encrypted:false
                                      SSDEEP:12:sLV6n6RUfm5EuylqTcaNKyNcMZ7mlWTmG0Z6A546H/c2J/u:sJyO51kNaUPMElvG006H9G
                                      MD5:64E4B32D00E1566E5002657B58ABE7AA
                                      SHA1:8560A50DA04256F81D7623B5B2208845E090CD1F
                                      SHA-256:5A1F64A0208B0DCEB8FC90E9D686DCD6F6FF830465C789B79B1A5DDC3571C27C
                                      SHA-512:3D0E7D8FB2F2C572C915E6815B0CA5AC731486456B7B591F1159EEEE265B52406C8501883647091F67C896C3A405B186F7BAA60BEF0F81B7012E1005E2E7C8BF
                                      Malicious:false
                                      Preview:$.0.E.4+.8.)v...O.m..i#...a>.......[.y.f/...+.=.dY..*Rj..R4W..Nj...d'..t.].<..Z.B......rV}...1......_...E..U..........K*0.Z.T...4...6`.......;.v..8^.q......)ck8/.}w..|.-.'s.....!pu..9nL[.>..?.A..f.@..f..i.c.)%hR .JQ>.-=.U..k.8*..._.V@o....T........S5..H............t..O.....m.[...5<r..(.4..L.......Qh.%....T(.j..C..~f.5.'r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\ztdV5fc.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):498
                                      Entropy (8bit):7.562809803884867
                                      Encrypted:false
                                      SSDEEP:12:wVALYrPObwhexVA9kGAqzw5rgmIpk1jEJemG0Z6A546H/c2J/u:TAPU4uVAFAqzw5rfjaxG006H9G
                                      MD5:0B60F42A1F097769234822E0185656BB
                                      SHA1:175EF1F720227ACB9D716CA98F56199D4F6DEFC6
                                      SHA-256:A7457D3B506A7061A941DAA34942BDF1DC9A70BD654D5A2561EEC54230B5C894
                                      SHA-512:739563B7403C02089E4F6879AC727A501253CD2DE83FF7FA342D3662C1CBAA2F092D4BD1B195AAC1175C386EE380B77E68CBDCA049E866AD8D87FD76BA9A328B
                                      Malicious:false
                                      Preview:....5.>..x...j....G_...m../s.|.6.bJ.K...?~.3..._7....4... .<m] .`.6f3E.p.....KU.*.......I....... ......5e.t..jJ...5......+..:/T.u./J.y..4..{+4....b.M..vZ.\b...8..i.c...d.?Y...#n...H]o........q2?p.t.a.]3...."i..9....&...||..v...........4|..J_.....8J.@..&.C.r.....#.Y..........S5..H..........V...^D.?.0.N..P..'.U..lD.v...9..(e....h.VW.(.H.k. +<.1.{....r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\dMvGz2n.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):291
                                      Entropy (8bit):7.300602791250378
                                      Encrypted:false
                                      SSDEEP:6:RrDB85wfrb+3TYcLSJBKpzKAY9mxU0ud6687d4046HIhKcQNJ/7pk:Rr98aHrcLSrKOmG0Z6A546H/c2J/u
                                      MD5:CD6DE6A965BFD5344F52CAAF96404F9D
                                      SHA1:C5A85F7CFAD0F8C1B68330576D7FC389BB655D32
                                      SHA-256:C4AD5C36F527EF2CD276F5AA60B3F227C2A21B7793686E5C9049AB3A0DB29C65
                                      SHA-512:79FB2C7AC72EB5BBC5C103C1D758A36F097D64A52CCBD9770452126AD769474A5141B1D3F704325BADDCD026D7531F287F0FEE3D7C8D88B8C6CBF81B08D319DE
                                      Malicious:false
                                      Preview:.BY.id....W*.0...ybR&..\tw. #.F_. ^E].w.....mL.J.>.-&.D.....:.r...Y;.......9.....P5..K..../....t..'".......K.`s>#V...N.1d..nUew....h..7[.V6.A......m.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\tyxUROa.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):253
                                      Entropy (8bit):7.17154108068841
                                      Encrypted:false
                                      SSDEEP:6:yoPvfm77NExCQJNtsEnQeNrrMAY9mxU0ud6687d4046HIhKcQNJ/7pk:yivOCx/nFr2mG0Z6A546H/c2J/u
                                      MD5:ABC67C20AAA608D8509443D0CB763C72
                                      SHA1:D075728D346C8DD79AF5DE957FBFC0B83798CFB2
                                      SHA-256:AB066F9C055C0E7EE065F00B1B8BC39817A1C31C95EB0E9826A3A7B190FF4423
                                      SHA-512:C0495CC03676EF85C1AE87841D4384E8B9CE1AC0C6251C6B647F92446E5E87A85DFEEA5AECFDD1811CD1880F4520BF64029FB0456E46CAD8BBC0B9BDBBD1B914
                                      Malicious:false
                                      Preview:..F.;My.Rd,u...EP~.....J.>.-n.N.Hq../..~..&.......9...LP~C.='..&eNeA.3.,.M.g..`o0.....^N.#-..8...U".....b..0.o_.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\13QMvAm.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):283
                                      Entropy (8bit):7.239879555603414
                                      Encrypted:false
                                      SSDEEP:6:VJvmLAM6surhEA0xTXoZTeuAJkAY9mxU0ud6687d4046HIhKcQNJ/7pk:VJvmLAjPSA059uRmG0Z6A546H/c2J/u
                                      MD5:76D5F2B38BF24BD49B1EF5359C72DE6A
                                      SHA1:9791BDBF39D85B7D78E2A10A387D77CC5387577C
                                      SHA-256:0B3D9C66B4B4ACA420A4263DB57C7D72D15416C579CA08C0F6B7352680AEC148
                                      SHA-512:7AEC76E81198B99EA2142A140E4E4727E8B5888827C4DEC440D1954A851A93A28C69BDBB4282809DFEBB73E5735CC93FD90306B234CBF835260E78206AC0943B
                                      Malicious:false
                                      Preview:S=V......fH.M......z.].N>.....X..@.....J'>.-B.p...D{"..NX.V.&.....k......S5..H..UT..R.[Ka.....?.>_K.#..=.#..(...s...%cH.zU..K..)..|.~..t...vG..l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\HOUtiRW.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):572
                                      Entropy (8bit):7.58867919572539
                                      Encrypted:false
                                      SSDEEP:12:TOhTyTnrciPPSQQE3JBDDokkN21ivtOJNO5HmG0Z6A546H/c2J/u:TO2r9D3PDUkkN2FDG006H9G
                                      MD5:38E812FFAAE29622D82F91B8A937B262
                                      SHA1:C14F88558FB0FD0DE44E4E8C1B99633168CB8C9D
                                      SHA-256:850E9F2B5B04C3A1292D1A6521D147C63EB9F05232D71AB1BF693E3E42B005CF
                                      SHA-512:E7A1FEAD2F49D71B14BEB62560D054194A6F48C007796C730F1715DDF3669ED388613050E4CD82C166D180E78E95FA9DC273B3F7CAA118D20C06FE265F64DFE2
                                      Malicious:false
                                      Preview:....&.U9.S.R<.......g..>...U>..... x.U..Y/..l...^......B.w......@...l.G.0f|.q*.......... J`L.1h.'x..KUx....R.kd.f..5L...-.f.....#@o.n..#..X.D....?...0!.....l...n.?..\f.@v ^L.T...t..Q..b-..A.J.... ...d...U...KC.u.\G...ki.'Q.=.R..\Ts..^......N>...Z4......6...+.3...*. ....\....t...R.U...Ak..Lt+=q.H.#S#8..W.1....G....f.....CIY^?..J)>.-%.Y...E....~..t.......9.....HN.GW.a...c.o...]..Pd7d...n..RP..Bjl"..*d.]..z.8._.8..oO.....c.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MGKbRLn.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):248
                                      Entropy (8bit):7.109748011989451
                                      Encrypted:false
                                      SSDEEP:6:HiMnj2/GFXaPBLKFP3FAY9mxU0ud6687d4046HIhKcQNJ/7pk:CMo/pKFfpmG0Z6A546H/c2J/u
                                      MD5:1FDB5CF811DAB2460B866170966D7CF2
                                      SHA1:DADD5A8643BE57F7DD5E4EE85A05E112E8CB4751
                                      SHA-256:1D5EC441555FCF9EA237E55B492A1064F3FC11AD0F4679B3D97ADD61A08467F1
                                      SHA-512:1E71EF7B7F38E1FE337703DCF3DFABCC23260A73C304B03BE71F93F19FC2BB562A9CBFC653004168D6FE5BD8D1F8890F0EC1DD0A6A34E3547DF3B99DF483EE18
                                      Malicious:false
                                      Preview:...F.....{..6...J3>....8f.'../..~..&.......:....x..I/.F.M..v..[..1x.....zS.....8.A.93..9.PR...U..s.2....S]....b.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\qweUKJF.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):564
                                      Entropy (8bit):7.67694018511715
                                      Encrypted:false
                                      SSDEEP:12:Mo65Ee5duIx7JXcsM9VMCw2xuXAPBm1NP07idG8ai6hhKmG0Z6A546H/c2J/u:V7e54U7BcsMy2xuXV11Jii6hhNG006Ho
                                      MD5:61499AEA83263A1530B71515EC07D4AE
                                      SHA1:E6C9AFD3F0FC88F6BF7C146CBB33238AD7E3FC9A
                                      SHA-256:34B51239E0AE855DEE9EFDD590E054CE14B2F7887865ED5214F84E023EA943E8
                                      SHA-512:411ADE174FFF8B393C036AFDE128D9662CE133B54710CF380B4205ABA34B3F72CD169B514654C1BB97E4F569BAC0DB068FEF168B69B7ED067836FBE64FFA56A9
                                      Malicious:false
                                      Preview:.{!...2..H..>....E...|........K.JM.<.5.YF~.5{.T!*\...g.+...!.z...N..7P.P.v..-..P..'...,1..+/._b..7.....E\...;n%.i%u..OU.1x....P.j.}lBx.,.8^....8.I=..u....U.{)..X..d.e.2..$.....W.+..E..l..XAJ.1.`.d...(@0MTEUv1....>)...O........U.....p.=\.G....J...."3...y..*..`.xBs..Pk:og.!.Z.w...\I.6.Bco.U.....kl9w"Sw. 2.\[K..rV.).>4L?..."...J)>.,..6!.s../..~..&.....C!G.z...6....}].[.%..LNy>.&...."k$..K.jr.....#..>.)|..?..cI[.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ADSTF8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37113
                                      Entropy (8bit):7.995476734050442
                                      Encrypted:true
                                      SSDEEP:768:F520elVtJUY5quZwcm3CJlJr2NROmAptN0zuLv/ZuZxMJkhe:ZiVHrZF9Fr4ROfJv/eQ
                                      MD5:B6B52A24A1E772CCAFC48EF862238F1F
                                      SHA1:E607005413BAC8086066FDBFB743E07E656807F9
                                      SHA-256:4C8FE94A350B5B29CA048DA03A01F1E440C99241D04714E93851FE2AED0B0EE2
                                      SHA-512:98203E4CB7C97C9DC77F3833886509D8C6C524A0313D943551970C74C506D105B2277AB0A9683B047FD0A757C55DCA20F42FBA4B574945953BDC21E1DDFE63CC
                                      Malicious:false
                                      Preview:...I.<.8,.iQ.d...|(..e..J..$...<.......K.....Dk@!.{cB.}.s5y/fv....xE3#..wb.Qy/.7..5..kl.._.........A...!.....v*.U.z..M.r...df}.".b@.O+..H....fo.e..$....4..-.dRw0(.q.../....wxb......'.?.:.c=...['.lJE8F._,.%.zj......f.{u.a...a..'f./.......o..wN.*...a2....@,:.>..b...$.u.pu..+..O.s|V..r.>...~^..4q.bd..WaC1q........{h.L.|HP....h.Lf.W.my..?..S...k.....p....4}....z.S.>_.8...v9t..e...xH.kA..7..2......F...mH..c.5*#.&..4.*=.m.....G.4_.>PM9.iq].&..k.m%\k.s.`...)....)./....e'^.}]1..`..m5tbA.g.!........R...k..z...|^h.Zg.5A.&j..d..L...-.......E.....~....[29EQx.....F1..O.cb.g......A..."|.N..i)$H....x.|V.....)..q.a.].....$....^..By.9.&.....?`Fnw..v......q.3eD..0-I4..l.'....O.r.f......B{....B.y....s....M.|."\m.*..;....%z.............'Y'...q...>.]....\.q.KV.K.X.F.,...|.^..i.x...)....gb....5?.Y.i...pwz.....'.... ..t..A...1.].......C ...L........I.MfS...My#J.^.._..`.H....(...+d.?..).{.....8.m...k5.....;5.t.....RY..;[.."OD..i...U..&...$c~.....p..j&.0.[.>.....

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\RdWfknV.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20712
                                      Entropy (8bit):7.9908920303708
                                      Encrypted:true
                                      SSDEEP:384:iCu/2Jf1QI0YAyyxxmfMUcqfl9C0uFGIHqJELIEa2Rj:iV/2d1Q7YAyyufMU19zQzHqELek
                                      MD5:11A3B562996B4CDD9FF38D27E3A0F988
                                      SHA1:6C06A56A99005C38FA0AF4C51B7529C24D27E8FE
                                      SHA-256:4A63A5A73E1AE17D3085B4F759594785A258758B50044DF7A5A5BDDAC5BA4C62
                                      SHA-512:81CB0DEBDC55149B0AD9D1F8DD7CCBC33490847ED8D0EF2889B6ED8F7FC4C772F7285F47D3D913E37CC6E45680936E8F64AAB36C7AF2275E0E28E35D93240B13
                                      Malicious:false
                                      Preview:0~n\.qx.b.!...p.....K.MH..#.%....ZA......p.4......S..E...8&....f..?..E.......t....r>vc+?.*.^.#J..g.T..k..)g..O..~-.._..>.F|.v4...H(.......s...~.;...i.....`.#.......'.[........`PmDQ.a.`.4.FN..b.U....~.....F,r.Q.Qj&i.Q.?.R....O]V.`.w@....UJ..`j6._z'.Pl..,.S.o..I...S=[)..x...<{+....!...4P...N.q.Bf.I..S1.0...U.U..%.H....1.^....-..Bh.o.$.' .j..Z..w..]$..bTa........#.C]...m.#[6\..f.......D...j'..6.....=.S....I.p..0.$.oc..L./.*1.`x.q)..+j4?.|..C....&........-1*.....uE.`[p.+.L....V.B.5...s.....lJ.C#B........%..3......Q...W=..@$....|)_.3...1d...+95W^.~2...=O.>....y..L;.5/w.v..\zn.p.L..d..bX.%v..V..\k...7.q.B.p.-x,...%n..../.FH,.....Qa.Q./.`1^.F..F..o...}<;TR.....nOq...>....W':...6S:..L0..q..{x.Cz"r..c.N.....w3[dW..........xR<#.9x!.c.7.?X-_..../.2>._.0.H.&..'...~.5...q.oz..~.d...Hp...M'.....f.\..X.t.]..O.?...".1.{..h..doO...h...@.2.G.-.....&8.t{.}.....D.~.1.32v9..l..N...^.......=....9F.. .m....S..!...WX.C.a]'#.. {~...;...V.*!..../.|..>....

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ltOtMGj.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):730
                                      Entropy (8bit):7.735929130455978
                                      Encrypted:false
                                      SSDEEP:12:9CoUWXarehUjI75s1K2koMvwgdzozkpWSgKvk8WAlLwsyVrmG0Z6A546H/c2J/u:goUWXJujVK25gdkz+pxs8rTGqG006H9G
                                      MD5:1F4B23FED6A014E69CEC28D8B6A3C929
                                      SHA1:083E0AD0CE0F9F6ECA25CAA756BB07BCC12F4061
                                      SHA-256:B22D6CF208E2B116CDA9AD3E11D73C9C7E23EF211055A9FD82B2AE0E9A9539E0
                                      SHA-512:469F7D9A80DD930495D192F50F255456D803AB0F390285632C9337FEC5CF923BF40940907DEB9EAC226AEC11211EBBDF71BC8793B7FA6FC3C2C2F2C74EA1F8B4
                                      Malicious:false
                                      Preview:.1.^....:........a......g...B.t.....g..(.NL.r.X].5.MN..E..`.mc.....s.l2...xV..B.....XGHi~B.w?.%9..,.....8....@.@8....b......0..G.....d[....b...0..t....>XZ..NXA..?.Uw..!...deT.......jR.|<.w.&.G.}I<......v....V...E..i%.-.kM.l.p....D...u...M..+...:L......I5.V.;.....;.......GQ.|.1...@].Vi.....ZK.QE..ju..~.0.D..E.8..'dT.oe[x.`...z..*4.E{......5F.e.3.r6!.x.YNL8..1.LJM.D....,.$4_.`^...3..*7%..U...*C.UY.^.1+>.XX.\.b..Cs...O....U....a+.)..S.g.eE...zH..O3qrz.J.>.-|.Y...D.".#_...g....a......lQ5#.H.C......x.}...Y03.........[{x..9k..Tn......M{..!..e.L.>?.....$..'.S.$[.?P..y.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\SOgj7T5.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:PGP Secret Sub-key -
                                      Category:dropped
                                      Size (bytes):523
                                      Entropy (8bit):7.601988309690859
                                      Encrypted:false
                                      SSDEEP:12:oBzFqFF1CH5TtxI/fmkgL28duWrjDkMUT8mfFHumG0Z6A546H/c2J/u:ogaTtK/fV8duWzk7VFHBG006H9G
                                      MD5:D15856E64F2E3907240ABBC6E826B88D
                                      SHA1:F4148CBD3E6B72B6E3CCDFE5DF8B4CA6428FF7FD
                                      SHA-256:BD29B257669C87956A5276104F8F9B75AA32B7A89273964A40DCDF44D4CC1702
                                      SHA-512:5385B5E3B9CB664F80C6BEA1AEB73A35283A4399D9EFC1F7E2A431E155986FD1E4E0120B59C8E219DFDEFA35A7BBE2A8AC9E27E7C43972A58ABE4831BFE4D035
                                      Malicious:false
                                      Preview:...V.n..&......E.&x.........,EC.[...Dg.l4,.^.....6p..2W.#.@.3....)...[.84z...<m.+.w..S....t_..q70...XJ..a4.h.. ..aM.wo.....<.......h:....G.....]$..3.m5..*...n.K...q,{.hQ'. O.X.2a;._d..........>...`)%.._.X...K.Cj..`. ..(S.....zc....U(... ..(.t6.O+(.{u....'.Y.ysH.! ....U..\.{...$8.r....,...N/.J)>.,..6!.s../..~..&.....d.q.........I...>.q...($.$G.\....(. Zf..)....z[l]2+.e....5.."[.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\3afWp7o.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):552
                                      Entropy (8bit):7.610127403789529
                                      Encrypted:false
                                      SSDEEP:12:fUW9GYNFYUdpe295OC+LKgXlDO2tp8dQxmG0Z6A546H/c2J/u:fUlcKUreIeLKLMEG006H9G
                                      MD5:0718C3EDCAEF8A44FF66FDAB13A01233
                                      SHA1:8E51CC7E261DEC421A0626CCD315D89B3F63AD86
                                      SHA-256:9E81A78D99ACDC5484811873D934312DEB1741051CC819CD978648B8FF7A4090
                                      SHA-512:E7553B05F9F50CB909662F869EC13A5E123ACDF37830475160FDD74118F50CD5C240864368C0E10547A4F7AD2ABCFC56187CC0CE66D714E6549AC063D5830CF6
                                      Malicious:false
                                      Preview:fd1.^PaF..\c..ST..{.?V.._6..#@c-..}..6.....x8..=&.|..R..~...z...........P..fV...~...6....v>..CC..:......R..=.-.5k`...._.?h....{..q.A.=AW....m,HQVa..{..)q.....N..P..(U..Ta.....d+.q.gggh.......,...Z...S...A.*..X-.|E.Bv.....wJ.7......\....)4h.p..=r.kZm.....Tc.!.q..s8|.R.F+..V>8v@...>.......,....QV..Cd.BP../...`...J)>.,..6!.s../..~..&......rYt........."...P.t.i..BO0.#_.u=..H.r.\b&1.....4.9......b.+.Hg[.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\C9zk88f.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5196
                                      Entropy (8bit):7.964708397880732
                                      Encrypted:false
                                      SSDEEP:96:5QZeqikRFu+hbyrjE51rlU0nR+eR+FyBZBZw1o4BrC4r4wucfxcy8Cw2nBTK:5QsuRbMjo1rlV2FuHCFBeG4wYy8NmBe
                                      MD5:DB55B381A3B668AAB8BD422202270AAD
                                      SHA1:849ECD3A20E466FBD2FBF2B9DEB0416069D80748
                                      SHA-256:9B199D7F262CC70BD89851A344C4CAF0A2C62A9AF0BDF643735287B89A2673D4
                                      SHA-512:CCD4520990A54A802101F1AC3865A91A7FB6E324C7B9706B8C2D2B49CE453853580A8B4428E210DDFBD8098443619A9F87A6640CDE7A777C65AD6F3F934C58D9
                                      Malicious:false
                                      Preview:..P...8..k....P.4./0)...I....*P..+_.lO..Cn.|5.x..........;-"6.|.Rx.z.u?YX.UQ.~k@......BHZ...p......B...O.h......ra....>.Vj...].N...FYu..cc-.....Q1_.^;}.........,.P...H....=.s<W..a..;..N..Wrc...s.H...$T....-.b......A...T5..:.d).+lln...5.hSE.i(.Y3_.1|.S.'.c...,....vC..-._[.../lDj...6.3.?R._.G=...^........4|.?.. ..=.HA......eG.....x...'...k/?. P(M02D6..dF.G.5......t~....-.*.!...@uZ%c?.....U.3-..}..c..RA..1p.....Q@.G..S..cpuG..XZ..e.R..\)..0m^..t.p...D.Vf.1GE..f...."c...x....[..b .D.....O.!`...f.uK.Vft.u[.s.f4.c...$7.........C.....~1.......X.2"7..X}..M:C.9_pq..C...,.....+7...B.n_.'...J.....e7.$^..t.[.U...s0.a..vg....{6<..B.5.;2.D3.'_...b.tC).B.:r.r...}4.h.j.q.:..c..N.O(h;...@.5Qy.N.M$.cF.=.Q.....(....v...@5.......b..|.....c0!....'....O..6..B.>.s.|>9.<.6.G?.T.....k.*M."..:"_.".f?...8Gi....|....LG.pSf..OI.A....`L.#o.&#..SW.L.h.6.<.a.!....a.X.DU...l....5..y......+.A.u...J.>l|..d.hgM6V.....l..D.P.*.....O...y..yv...=..u.=.........

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\KE6htSv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):560
                                      Entropy (8bit):7.635026968912424
                                      Encrypted:false
                                      SSDEEP:12:vy3DnrCxksxt4ZjjQD1JhxemG0Z6A546H/c2J/u:vUnZebhvG006H9G
                                      MD5:4BE6D23CD645CDDDC5314727095D662F
                                      SHA1:771503CD59C097959BF6343712D62CF9B8C4FE83
                                      SHA-256:5D4F97F89A9739A05F32A34A07B30F05B094818E600A349DDA2D65E7887F19E0
                                      SHA-512:22A77E190518FB43396A04204A7B05475D439901246C08EA750ACBBA372F6E563D3C2486DE596CB788405E35635E0C87E2BCFD076F9D45C1C38C068530063E2B
                                      Malicious:false
                                      Preview:.G..>.".....t..uv.]....h.`}.....M=.\J%/`.j...d.8.{.%....{rYn.L....9.d^...~..5.O.G.+zt...TZ Y.U... .Qn..Sg...%.].l...W.....q..J..O_zOx...D.....P5.e.T.2W<.Z...O...N..U.<.C8V.....\.'y.w.d..mk.8b).z*KJ....>O.y..kD_c..~.:w.E:.v.N..#.#..Wn.n.><u.$.9.kWe..pbY....i.......>....sDnz..(...;.-V..Q'...@,..>D.MB<...k.|.....j.<...J)>.-%.Y...E....~..t.......9......).:.gO[@.8<Mb=......y\+..j0n..!...c..}....I..U...].....} .:.[c.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\XFEX27o.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):248
                                      Entropy (8bit):7.151540463507998
                                      Encrypted:false
                                      SSDEEP:6:QfHokvmj2/GFXaPcFhXFgkBICa3b72V3AY9mxU0ud6687d4046HIhKcQNJ/7pk:QfHTvr/+bBg3b7emG0Z6A546H/c2J/u
                                      MD5:357D77CADCDF62129A7BA60BC6CAB45B
                                      SHA1:85DF8D0FC6E0A8DC17B3B60447A78B9EDA51596D
                                      SHA-256:7475223266B7BC6ED894EFA94179FA33A0CC6195C4C60A7CC00E5B83EA3AB9E3
                                      SHA-512:6939CDA6A01E4FD8C4F784943B6F0E636982974DA6219B435F3D541D3DD9E3AC9F03D7BD440FF4EC4C1DC951837F46F0DA3E1BE9EE2BF64D7D10F8C6751B5CF3
                                      Malicious:false
                                      Preview:d2.........N.n..J3>....8f.'../..~..&.......:.........u.._..`Z..k...N2 !..>_.W.T.$r.x.Q.Hm!.TrL.@I$..V.-?..8..Nb.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\aGHui54.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):283
                                      Entropy (8bit):7.230053693231943
                                      Encrypted:false
                                      SSDEEP:6:wQuzpICNiQD6surqnBUrrJk+AY9mxU0ud6687d4046HIhKcQNJ/7pk:Iiw2PqBU/JTmG0Z6A546H/c2J/u
                                      MD5:3F79F92FFA04B5B2DFE1C2D188469D91
                                      SHA1:9E65B7A99DDB6550C0611F9FDC5FDDD0CAF626EB
                                      SHA-256:00DB3E493A51E53DA3E7EA9BD80097AFE5326375F0CD386B9841CB99639F072B
                                      SHA-512:626A89E068B59F45DC0178B8BF87A2713FF7A17AC02C2133623908F9715C133A8734C59E1AFECE3B397EA57E1249E7E77F237A7462874FA64C2637F852740525
                                      Malicious:false
                                      Preview:g...z...R'.w.6RM..Hj .l.0w,...e..Af6'...J'>.-B.p...D{"..NX.V.&.....k......S5..H...64..V.i...F.EKs....6}.._..Z:.]V...G.r{x..O.{.A.-..U4..Ptmv,.l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\bmnSHf5.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):131313
                                      Entropy (8bit):7.998581216432755
                                      Encrypted:true
                                      SSDEEP:3072:kKLiuvF4W6Al7J1sUTScymkLdlxbIFYNPBNhySU+ylfk9w:kKOu94W1FD6c4xk6ZBNxvylfk+
                                      MD5:CCE40E0908454FD720C1A195A88D9CD4
                                      SHA1:24EDE4FBCAF01E8435B2A942ABCC5A903DA232CE
                                      SHA-256:D6C5CA23135B979B172BED37ACA81736D6D0733184BCD5EC695FF68E83804D96
                                      SHA-512:749EC33A68B383825D2F6FC01C4287EE5B48ED3B3A27DC16DEDD7CEAB8D2335A99C79FC57FDB4FD30335F0CAF07D00940F7377DC6ED074EDA1B8210C79C50F39
                                      Malicious:false
                                      Preview:..K....O...F..h.j!2&.h........9eW..W....?..Z.#.7|...y3..Dh.....]......5bkV...c)f..1......$.f.-UI..C..U&Z....6z...y.^.R..1.).a.....Ib.?.-.6~x.O..S^u.....\..n.>.....m....Y...).^4JV...5..8E.Q.jCG.m.>%.?*Z.kF*.|....O.{...SF3.0......Hu.%...O..m.h....Q^!8.<....uwaO2.....FP0..Y ..`.q.].9k..k.b%..w.Q....G.,..X..-.R)V[.l.[..;{O......o.pP%7.D..%...Wt.Z.,...z.{t..P+v9#e\..$Oz.....d4d6o..E..+..I,.(L..m_.1.g.~..nH....."QBtK.Q.D7..$.<7.-.)./.+..2"[.,%[.U-V.u.W..eI..<Bc.....<>....4...$.@.yTX .+W0J)G7...kPysrrk..+.Y. .jT..!$...%..V.4q....@..IOq~.|.2P."T-...w....Xw...@...y..27c.....^.....q.y.b......A..{r@..=.. ..H.A,*.eS...(...&.... .3..[...~.XQ..5.A......w...TG.kE.D.......L.'...Lq.~."t.....L...O..Yn....2+.BJ(......E..8l.~.'r....|..w.....R..q.Z....|..M."......u...N.6......$hZ.s`..u..N....|<\z....?p..Z........Q..V..O.f.`.......b..p.n......kt.....-...Wqv...T...k.0F.+?..7.x.b..>h,.]...:...>.H........o....s....<..}....i....=.<...R<a.Ohg..+..L.{.<h....

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\i12VdOP.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):528
                                      Entropy (8bit):7.620686114062756
                                      Encrypted:false
                                      SSDEEP:12:6zv3ZYNxDIjkWnIORJDqVObiypDDPO6DFGPgamG0Z6A546H/c2J/u:6zvkEY/upq8t5GKG006H9G
                                      MD5:3608648242F7AE473A6CB555FF0BA22F
                                      SHA1:CA23CF5EE79C879DF143F0ADC9C355CA07A145E2
                                      SHA-256:8D58DE323D06929590233C1458335184BE0658DD1BF8407645555D62BE2D78DF
                                      SHA-512:0A2B3241D488938624C64DD9206FC038AC9E8DEFBE0522AAE35464593010B3A85F96DD0B8DADAED74FEA184ECAF8256FFB90DFA378C155D46EF2A990DC91FE7D
                                      Malicious:false
                                      Preview:T....L.:........|...D...T.x'.g.V.........O....$S....&Z.4...;..Z....6...dj...Iq.`.doR..Ae.-.Z$...'...3.R......}....>...T.......;..'.d%4+.)..C.....k..pL_&.....m....N.'..5...7R.[.!.V....r-..c.M..V[..sP..U.X......p.I.....F.*..v....Du..S.Z...d.2+.8....}..n&...0..B...d.k~.}.0... ....J)>.-%.Y...E....~..t.......9....^....qv. &.......P......,.......e.=.7T..w`.....q...xV...7.ft*..c.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\qMzLEzp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):731
                                      Entropy (8bit):7.749603630043169
                                      Encrypted:false
                                      SSDEEP:12:9occ6cvf7nwBiPY42erir9S88Ix/TATEb1Mwuplm/wLCIemG0Z6A546H/c2J/u:9lc37wBR47riQ8Ry0loLCIxG006H9G
                                      MD5:FFD8985E0E119558A5E4FD0435D5D389
                                      SHA1:708E7B5AAEE15BFD5467A2DB5B5C1EF279A8029E
                                      SHA-256:92EC206BCDE71330C0599C07C0B6314CF1F90AF71A596EEF139C882613A6D32A
                                      SHA-512:B73C29D8D38B3542264C27CF5CA75BA1D63325A5D6F719649E573B7EBD4136B7477F8014C29835CCF49CD5C7FEBC68AEC5D8029D37E06D58A03EA223001EBB2C
                                      Malicious:false
                                      Preview:.=Q^...Er.)hb...!z......@&/D.^j....j_(........=Q)1.%.I...-.J=v.w..d,.....e..V.;...[......e.h....IJ.).K...).%!.....I"..@I..R.?j2....o".V..o..B.+._n)+Z8n#g...M..4{T.|n......`.L-^....I.4...u' C...x.S..^[...C..NSP...w.3..H...]ke)..D..!..*uu.... .6......G....<.2.s+.mv..W.....,...../p=.N...}Z!....|p..8`...f/.[.....H...2..I:>...E2.J.#\.5.../].....%:..I..d.3...|..t...F....%X.JgbB\.....gT......Y8j..G...h6.Y._.#v..GN......IM.A........B...bn.)K.y<}M..38R<h.$.stM..&.%..;..J.>.-j.Z...DJ"......'..h*..9.....S5..K.......o.....u8:.+........q.Mh..Q.....e.Dme....GS...7.:.>.C.Ik.....q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\1a0AZrT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):248
                                      Entropy (8bit):7.146519848597368
                                      Encrypted:false
                                      SSDEEP:6:4gbnj2/GFXaPT8kGKJxwa3y3AY9mxU0ud6687d4046HIhKcQNJ/7pk:jbo/L8Kx3yTmG0Z6A546H/c2J/u
                                      MD5:0168942F55F6EC131E45C8632BE16763
                                      SHA1:400F2A809E2718F20B1C2364AE4912FBEDD6A3BF
                                      SHA-256:28B155766198D638E03F975DA5BC7627B235B89A7C132901E70A135A6CE2EBC6
                                      SHA-512:B0B14EE0503458604EE5099299AE046AE1E3702E403979BA66C7C6C22901CF93C1F416A993DDFC322E172C0A8638A7FEE10099DFDBB821FE4EA44CFD2BB9389F
                                      Malicious:false
                                      Preview:.oK=u.Na...q.)..J3>....8f.'../..~..&.......:...."..4....@C.U^L.../?....C.._..+X..u..(....XA...G.....Y.{....swb.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\JV0F22I.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):512
                                      Entropy (8bit):7.569471278829786
                                      Encrypted:false
                                      SSDEEP:12:vuBJzgh4euxP+k9FgnxcB8dpcMKmG0Z6A546H/c2J/u:vwJsh4Ck9MceNG006H9G
                                      MD5:9D9A318F8B07DCD34B2C04267FDA08B4
                                      SHA1:AE1F1F762CC48A98DD9B647CADA9402C1D38EAE1
                                      SHA-256:F17A4878E5396808C5D025A6DE483429F45577133A45896B586AE1E7DD1C0D91
                                      SHA-512:33FB712487A5DC81BA3A5F978076E26BBD33B8059CC172BB46B8145E2CDBA0B4BBD92D362DFFD3EEF05FC1AC0818FAE772A0C97FC6D65FBF87477EBF88D795A4
                                      Malicious:false
                                      Preview:.^...Q.D...H.n9...2)..+`.+P.A...x.>...%nX..)|..B.}..>...R..\@...^.C.pi..............%[._-...mr.JkK.wgd .c.BA.C..k.[n..l!.j..|Uj...........>S C_........uC.P..n..X.5......j/O;a..........k/K..;n.....r.5...H..`AOB...%B...=..q....4h.....7..L..z...~.z....CC.Z50..\.Zs....J)>.,..6!.s../..~..&......n.WD.....e+.N...1..Oi.b.NLY...\a..Y.....C-G....9w-m)*vx.9 .<..[.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\fEE8g4y.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):287
                                      Entropy (8bit):7.237410989487281
                                      Encrypted:false
                                      SSDEEP:6:r2FrvPp9mO7NW/EQ7Abg2cFMcZkPG5GYAY9mxU0ud6687d4046HIhKcQNJ/7pk:orvPTbW/XweaPIGamG0Z6A546H/c2J/u
                                      MD5:7C0224B4DE765317DC6C9186894877F5
                                      SHA1:506E56774DD80ABD24AF19500BDFDEB53D3E8CE1
                                      SHA-256:99EB86F10118B3330B204929D681C13B3BA3C9BEA45748843175E3F793A840DE
                                      SHA-512:F7106705ED6D8B421817C7027E55128EB977BFF0D7FB4416D496676AB8463CE83D3BE9DE662A28E81E114DE1F94BFCDFB99F3E6AB6353C95388E3254C0EBD9BD
                                      Malicious:false
                                      Preview:.s...1'..K=...ho.F.h.e%"*..w........4..g..RI....L....K>..-%.Z...E....~..t.......9.....I....`B.^...R..SF....[.W-~..2...#..!.... /....rd.Q.pR.I:..c.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\llBQdRA.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):283
                                      Entropy (8bit):7.250902225139682
                                      Encrypted:false
                                      SSDEEP:6:0vfmc6surKBaK3fdBfANBkAY9mxU0ud6687d4046HIhKcQNJ/7pk:03YP6Xf3YBumG0Z6A546H/c2J/u
                                      MD5:E7AF0F3D88700D5571CB32A1DB3F5B17
                                      SHA1:039BCA986F552A1D0B2F34AFB6FE98DC3FA2FDBA
                                      SHA-256:974490B78C5C11563DADF0F8DD0304DBA3A20D3A7B7B3A20664FCB0A3CE81555
                                      SHA-512:F0DFF611CA551EFCEBB75AC524065375D338C0669F58C8DF30CE19957F2573F9DA6C1FD1544CD55971A1945C01668F8C27C1E5303F5FFC97AA5B40745B5E8898
                                      Malicious:false
                                      Preview:..f.......|<>,.......=.0.r.Ig....~...J'>.-B.p...D{"..NX.V.&.....k......S5..H....eG.......Rg....#T.|$ ...9...."x.U.-.?rI.".{..C.@.....HA.*l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\JQMuBjj.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):248
                                      Entropy (8bit):7.1554938908924575
                                      Encrypted:false
                                      SSDEEP:6:T1j2/GFXaPRz9oSS8AlKAZAY9mxU0ud6687d4046HIhKcQNJ/7pk:O/FeAAVlmG0Z6A546H/c2J/u
                                      MD5:11BA8091F1DB6E6A0ADE1C4517961541
                                      SHA1:E696388F2E53A8B51D233F60F17CF7210752B564
                                      SHA-256:E7CBFACE7AAF0FBFBAC08B476B218F9436F5272DC0F1EF17A6F64C8A2D52112E
                                      SHA-512:CF24F8831E0627496B7033C0B22C11BA716E132C5B29EF3DE74D0C36C375DDE6725A796B3F9BEE3EF0B3009122A34756F1B3472815198720DDE8BBE70BAE0191
                                      Malicious:false
                                      Preview:.....R%....n^m.J3>....8f.'../..~..&.......:...-"qyx.2...v.....H.Z..B/.P....L..3..y........T...)c......,.Z.b.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\ZCklHGy.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):283
                                      Entropy (8bit):7.266062981519374
                                      Encrypted:false
                                      SSDEEP:6:4TdD6surHLBaTzrZAY9mxU0ud6687d4046HIhKcQNJ/7pk:4pWPFarlmG0Z6A546H/c2J/u
                                      MD5:95142B6868A2639FACF70C78B40AA96C
                                      SHA1:DB666CC76A487A16DD34C878CD9BB5068629A672
                                      SHA-256:7498E49120A5A38BAA582F6A51DE5D45594739EF1BB88C5E37E754346EA1A6CF
                                      SHA-512:3D194AE7E1B56032F6491FC18540CF8627E8C51136595B181A15002A4D50024F9CE4D5700BFEC4A9A5B77852624FF14DC7AF6965EF793D0033AA0EAAB3FF0553
                                      Malicious:false
                                      Preview:r'.Z.=...@;.q.]._...kB..)..N........<.o.J'>.-B.p...D{"..NX.V.&.....k......S5..H....S....q.`../w2Ls...xt i.=9...o..4..-.m<..M.S...;..4[..L..5Pl.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\ahmeVZt.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):359
                                      Entropy (8bit):7.380206764952317
                                      Encrypted:false
                                      SSDEEP:6:E0fxkOIycraL50cxbGPJ5tbg2cFMPMxh9NWIHUAY9mxU0ud6687d4046HIhKcQNc:byyWOqcxbKJ5BeWwhGI+mG0Z6A546H/A
                                      MD5:222B2C5A90E50AA915FCFF81B3672470
                                      SHA1:7A0A20FFCC1FEA65D3455400AEFF19E89E0EEA70
                                      SHA-256:477A7C39AC142D5031219E3B19122BE3CD4634F43A8645B16C96F17449F9ADAD
                                      SHA-512:4E154E20231F947E6944166FC12786EED48DAFA09C2AB268BF2B491535CA40AE1F815AB8229DCED92AE48E6788F0A1521590B2E24E548E8BCA5B4C24A1BB45E6
                                      Malicious:false
                                      Preview:..fqn......l.5....9..h...(_\.qg...w+'.W.t.I..&~h..........*...#o... N.&.O.~$....Q.l....5..X..K...v.../.o..".G.....D...I.K>..-%.Z...E....~..t.......9.........=.LrA).s.....Sj..:y.&..z...'...H.......(...n1U.R...b...c.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\i4AGRZW.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):530
                                      Entropy (8bit):7.5850126443369215
                                      Encrypted:false
                                      SSDEEP:12:vnMF2IfPdvzu+lJoIIi4tM8Q903ZbpluumG0Z6A546H/c2J/u:vnMF1dvzfPGtt3IBG006H9G
                                      MD5:ABB64A0D1820F3C30345FD3963544178
                                      SHA1:6A5421D54B0ACA7A0AF6AF682000CB47A95DBBCD
                                      SHA-256:55A2274CE9E41209F2208ADB222F8AE1EC8245715B51A66041589FBA4E7E5CA1
                                      SHA-512:F82B1D5EACD4572BB13694D3538E17D1FC93582B259465A1CF45E7497C052BCB4F9453231F734DEB882C2FB743F16D5BC08AF04D033C65FACD090F9CCD2DCA8D
                                      Malicious:false
                                      Preview:.Up.l......}...4".......A...q..b./.[..)'...;.mb!.'.V.=.T........MF@6i~L..#..8K...R.}?..c.`.......(.A..9..*....".@...#.._.C't...x.../.`.l6.{..X...3...;C./....:.qvm.....l_...8..\..F+9B..k.kU-.QLK..t.....~.......3p.....t~.6.lO...P..%.....$;......~...R......:b.}$V.#-z..u..s.i....y)R.J)>.,..6!.s../..~..&.....{S.Q.>.a6V..87........."....Tz.._.h...l.h.x.w...!!':2.K.V....[.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\u5k9lfG.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):283
                                      Entropy (8bit):7.247743734010421
                                      Encrypted:false
                                      SSDEEP:6:TGskUyMcg6surYlhFMEo3AY9mxU0ud6687d4046HIhKcQNJ/7pk:TdyM0P6FzoTmG0Z6A546H/c2J/u
                                      MD5:5F6873E3387E942D905838BF4C0389F2
                                      SHA1:92399066D710D6C04AADC34F2E3206A6FF2ECD61
                                      SHA-256:D1BE75169D9AFC0062CD0C8F24D40E3DF453635546162ACE2F8883A8EC1FD04B
                                      SHA-512:5606987A11BFE79D9B50EA1B693676877AECAFFB515FB621559EC8DFDF6C67485E16DFD6E66C760CBCB251675908A236FE6389CE86EBA33FCB916618F44AA2EE
                                      Malicious:false
                                      Preview:%.W.HQ.%z%f....v?...Q..Ma..d3..s5.V...6..J'>.-B.p...D{"..NX.V.&.....k......S5..H...y2...V.#.XV..~:.........t%Q..w|DX.>.......lZ..i,@;c..W.Ll.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\uBrkqbt.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):248
                                      Entropy (8bit):7.158135108763642
                                      Encrypted:false
                                      SSDEEP:6:Ezj2/GFXaP3U7HbAjs6rlG3AY9mxU0ud6687d4046HIhKcQNJ/7pk:EE/PUDSlrITmG0Z6A546H/c2J/u
                                      MD5:2F1E8ECC73B619A505017DE49E5A21C9
                                      SHA1:6A5EDD9D030268FA61C24961BE9000DDC7CFFFF1
                                      SHA-256:EB1A1F0C4DCDB0E52BC7261482FD35566DE990231B0A23C266B57996E2F110DA
                                      SHA-512:072AF07D706BDE83801BC9531335FC293843B112D7DCDB3F0BA6AA90682E8F57BD8DE074276E6E5F5C8F7A976B26244807BBC443B2E14179597CBCC2C1EA8CD2
                                      Malicious:false
                                      Preview:..G..t...&.2o.J..J3>....8f.'../..~..&.......:....2.9.3..x.....;....l...V.._N.No.l....#>..$.md.{.Y(.y./...~;&.:._b.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\Adobe\Linguistics\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\LocalLow\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\ARM\Acrobat_23.006.20320\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\ARM\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\ARM\S\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\8Z13mt4.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Public Key
                                      Category:dropped
                                      Size (bytes):476
                                      Entropy (8bit):7.60686918867109
                                      Encrypted:false
                                      SSDEEP:12:UoNWpnqsL6rI/rBbAaLIifd5E8l2raIleWThjmG0Z6A546H/c2J/u:vWpqqEI/91J2roWTsG006H9G
                                      MD5:C84312D891608D68122687439DDCEFB9
                                      SHA1:F13382253706D846C05756833EE1A2247D10CA69
                                      SHA-256:8B4233ED23C7F87A181A8FB8B7DB7BDF201EB98EEE0091D849B0DD52B495D5E4
                                      SHA-512:CFF746D4AE58568659AFB10E76574F6397BC384FE6DD573CF1B5E576DF22685282922FAC3B80DA810355D35D83F8DEF1CB5CDF283B1D9A496425EECA3505E067
                                      Malicious:false
                                      Preview:......-..o..J.>!.g.....K.0v.|7..y.I..YC.6e.$G2.@........1...."H.*.5.,.A`y<.'r...J~C..B...Y.......H.... ..]x[.[...N3.v...U3.....`.Qg2......xYw.....?8..n.....:..Z7.%..`c.x..^.d.....~I....l7..J.7........;r.....t!D....RlL=.......+..-.. ......J)>.,..6!.s../..~..&.....b...Y#K..w.2..X.....R.v2..sv...MQ22.>....\;....\...~..^....h....[.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\9hHiOzv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):248
                                      Entropy (8bit):7.237206239708954
                                      Encrypted:false
                                      SSDEEP:6:K2di6Oj2/GFXaPb7Ka4RdoTs88rYAY9mxU0ud6687d4046HIhKcQNJ/7pk:Ht/TTUKT7eamG0Z6A546H/c2J/u
                                      MD5:7D586AA3C041D0ABBA78BE51986D47DE
                                      SHA1:3356199A8437217633DF3A972939CAA8EA493219
                                      SHA-256:64D0992EB082BF4218E6A8C64460118C4640D5A5DDE5A6380D4DE3FA85856CAF
                                      SHA-512:938155DD3227D0ED190AB10DB3C1F0EE898F7858E5F81058B7F7898B4CACC6E7911C25D05D82D7ABB690B15BDA41111EB2AB94203A2AC9B3CEA2A4130A0E35F0
                                      Malicious:false
                                      Preview:F..h.>5....O.....J3>....8f.'../..~..&.......:...{G\..o.R..)...(x..,6Kv..I/N.{=u..z....Z...J.Q...X.....}.fe.lb.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\0rz2p2G.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:DOS executable (COM)
                                      Category:dropped
                                      Size (bytes):1056998
                                      Entropy (8bit):4.950802461692079
                                      Encrypted:false
                                      SSDEEP:6144:PaAE7N1CS9Ua9TD4LqUte7nlK4ztetjZXZlyy9h70UF7GC/C08CdAXO1n9AauvFH:m65NevzotjhyQl0UH8sezpw8m06bo
                                      MD5:5F5CD0BF0D55A40F1B0D84A48CA4227A
                                      SHA1:E3F39ABFD3E5F3671A8C27C3A4A07790ADDF16C0
                                      SHA-256:B979022CA5BB78B5DE163C21F7C3C94BA33222BD03540458F272102BC84A6072
                                      SHA-512:4D1DE5C0C91F0DA9394D7AF12FBB42B0DDEFC8CA9434A8C7683BAEA5B5EB86A4E3313DBB5C64D8884F35A1C9EABD76DEAA7F05783C6FFB05F7113DED6DDB3531
                                      Malicious:true
                                      Preview:.:.. :.:Z.b.....G.!..........I..w......g8.d.<.|Z...~.y(.o....!.x..n<._.......8./...h"...U...Ue>uO..QOCy..n|.h..p...8.$..n{F...8....^ur.6>.T....K..=..H..e. \.o. ..Q..N..1I../'....r.QY...m.s."*...}......g"U..7..k..]'...h.pBR....._MVO..@.X.9&b&.`......]..9>../..:...t..].........q.w...;=E.E.IaP.k.B.Y.(...Xh..;w......7....?..........epH....m..t..$qb.e./Q....^.pP..O.Z..dr.O...rsxk.l0.:....S\.Pl....8a.V?.K.d!.B...>....5?.m\..?.`p.....".....%7.G/...CM.Q.l..=..D5...aY...nN..W.....g.?c>c..2.<.V.^.C....W....*.B......J.;..CW.n..:[..r6./.SB}.U....O%....Lg.."+h...v........#.W.l..:.x..).xu..,..t.`...}G...,:.I{......T.K..c..T.L.........'z..E.......8u"..H.....B"|.f..-..F...........<.M.^.@.t...y.fZp.N.,.... ..d.<.v.:.-.&#.yu..b....vn..S..e....D.j...r>..OQA@.F,.N^..q...d...N`l.PQ....x.]|..c...38..3....#.n..6z....U.s.. Um..H......jTx.i]..`...#.....t....00f..&.)[.1H../N......6Z.1rLv......Lv....D..W.....><>.[...g.T:...2Z.vF....J.i......aS....8'*

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\HJv2ATE.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4202726
                                      Entropy (8bit):1.5356049333516115
                                      Encrypted:false
                                      SSDEEP:12288:gOGepbyJZwkUAogaiJsSavVH0Ao1aQyObPO9LwdALij6:g+Ab/JRCVu11yObPO06
                                      MD5:796B31B184AF2EF8D28AF7CF39B4684C
                                      SHA1:CE1CBF4E6E384DDDDA695E71E0A12FE9C7391863
                                      SHA-256:D36FE785409F75EF167C423D42AF5DCDCEEE25C972966ADEBA8E8EB5EE9E0466
                                      SHA-512:1BC6822D9E777BE933A13E4FA774336212EDFC95BD73FA43809BB08B3013B2B9F13E1497CFE28AA23F38B07CD6A55836B003E22EA5CE67E6BBAF678BA06E3EBA
                                      Malicious:false
                                      Preview:R.....!..+Q.?v..QZ.3......1.]}|.:.v..p5...G.6..|...?....]a....(....=.....0.......V..tD....f........j...L.....J.g.......cm....}.>...Y....)..."..u..Hq. !>.....L....f..n.wjO.uc.....[~..EX:..U#8....L..B.Ae.d.o.h.T`T.C0.E ....y....RPN.\.....>....6.=L.UJO...P...".p.S.[.6n........1n....M.f5...Ol].....mf.N`?.5..r..;.....f.q.N%. ....._@x.$"......A....Y..q.p.g. .....<........gu.E.p.l.Y2..lH..%...L.4..2L5.q...,.....w=b~..(*.6..<O'........Lw.....|.L.....v."..@..........(..{..0...N..}&{....\Y|.Wp..A.q.Sb..AD....6s$..E8t.s.E..2.....%F.K..c.........8....p..k..2:..9........c...C.H.?...+{.kb..Kk@.b.....G..Dk1K<..W\.AK...-L!.v2..U..I.Q......LZ..Y1..U..@k..x..@.c.bC|.}Z........\....Cxt.s.....P...?.:+....L.............>.s6..."........?.]&.P...Y..U..`._.#}.P,...\.H...d..m......%....A.&.:....,2..A.S.k5.'=yi.F.}..]8B..s..!...dm4T.0....0HRt^.N.'%./.+).6Cd..>.....}...2.....A.i.....q....r|....Dfl.0.v.CK6.....*..}...t.4$.W%.N~A..^.4..>.T.B.Pjw-.L..W>.`...(.p.H..d.:.B...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\JGPlQBf.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):45286
                                      Entropy (8bit):7.995524260338823
                                      Encrypted:true
                                      SSDEEP:768:Cbs4z1qFOIN5FJ6d+8l96TAjE0r6vKDqVVsv8C1apIea1SIOYKKZGt5HrNn6:Cbs4z1q3NnJ6dEQruKpv8CqIeRIyMGty
                                      MD5:90B8BC6E5FC159F49B8C440B31B5F355
                                      SHA1:29450A6132EE16EC81FD91033528789088251499
                                      SHA-256:BA98BBF97047C55DE6ADE4C112CAC70E286AF845CE100BB66E5B42F7FF0691E1
                                      SHA-512:BFFE20B3EF21C6513A76C58C7255B37495C5992E43C1036CFAFE964BF570F215C1973F62973310352037CA809818DC6946FE8E666C1481E99CB9D189E51E147A
                                      Malicious:false
                                      Preview:#...~.?.^.h....{....Xu.....!...L..Sv.u.^......3Hj.......k..k.....F.j....;/1.....l`/Q.z|..R.*d...a.r......=D...X.*V%m:`W->.X..."...0..2....).0..f0......%8.bu.*:u......U...Z....m.K.........a...Pc..p&!M......]..C.....aC....d.5F`.... .......j..o..)..0.a8..?u...@.U.+-............,..@.g....z.@.+.....>F..zc.....~..~."...C..8.+W.....]...#.%.V.P..[.&..d...g.].m.....)H.cP.LF.....Z9...w.?.O#\......8..........*r.*....c...WatOO6l...../l....8........._..6U[.S.T...K.'I...n.,.p.....M..R...prp..w.}NL...5....$.k"...1...P.l..@..C$....+...*bv...sa...]..7..\<.).]......AdB..D.B:..[.V>..aPA.F.}.e...^.h.......>"W....XD...B;}b`......j#OO.m.v..]BC`3.[.Xzu.Rv..$C...P.}....#Z..H.....SB-.]x.q....q....s`u.....w,..p.,.;./.......w.aQy..?N..y.K.x.......y",.h..\...p..............+...V...e!K...L.!..I.Oh....j.u..)a<)i..u.._...y.Y.~....r.U.!s..jA..z.....^...c.^^..o|..Y.H,Dm. yG.3..).U.@..........s1>.o.'._/.OKg.UEe...;.....vB..K#@Qq..1....|u...."...%...8...l%..&...8

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\iXDqsq0.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:PGP Secret Sub-key -
                                      Category:dropped
                                      Size (bytes):524885
                                      Entropy (8bit):7.999586488508697
                                      Encrypted:true
                                      SSDEEP:12288:d38UEIg65q09Hn/h0P69dj43dS2BhxPXmN5qhVdeWhjO+HFOM:5/g6U09H/h66j43dXOChOWhVHFOM
                                      MD5:7280616BEC7B213D91C3A4552DD4D407
                                      SHA1:A687BF56BB94CC2D2E0AD935B03B20F66BC05335
                                      SHA-256:304BE6D60B5D7B3963B856C9CAE2682B59660CF8B636EEEC26D543C34679557D
                                      SHA-512:8E17DFD7689E69514E4065B1FB0BC16F978611D49EDEFF80DA35CCF2259C9C2903A01AF76989366BEEA7B714CE24271306674B47B811E39CD861DC65A1FD946B
                                      Malicious:false
                                      Preview:........-.........UI...#+4..E$..).L.or.".........*./.r.#h....d0.t.......~..p*.....3.b..W.W.;.R.Q.....ca(UZ.G...R.[...C.y...V~..7.....a..|Ck...f....$....L....7.iy.>...o..u:.oZq..[.r>.0D.Q.......b....@:&{.H..7...S.,.....CB."J!+..........M...kuD."2/...j=.`M.O..0.....t.....x....E.P.A.bh.o ...:.q*.......E.-2.....^....8..JcQ...vX..... 9.)S.. ........'I.o.x.t-.j[;........ij.....1.[.#.cF..S...T~....YP..v...d@Q. ......kS.`.[.d.r..?P.C..U.aZ.....b....N..J<..0s>6~......X#..t.).....w...-..x.I.{:..h.g.>.u..x.c......./...h..!U.........?../1.8..F..~o9....C.*....0.e.c!...wC.7U..=.....O....._..m...UST.'.8X.pn..{h?m,..Z.z.]".j.Q$}.)..)&{.z...(..aM....h....o....v.+...U&.3..;.X.>..P...R.a........5.q.Pg|.Y.:..}..r...,...\......K...R..Fd.j....U.m./...(.7......y...7l.?.t1.M.rV.....g*....s.w.....d..'e.........|SyC ......Leo.}....:.GT..!&.....&.I..".rR......p,].,.......~...d.L.T......UQ...;.".L...#(a..).~...L.....2.`WeC....2p....7z3.....jO./...N....RfxMEn.).

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\qet80p1.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):270566
                                      Entropy (8bit):7.999346373720653
                                      Encrypted:true
                                      SSDEEP:6144:JOwiRM5c3/XGOwdwc8UmePBGXxYg6cK+U8DNWXs:JniR3/swc3pwxjLKjSD
                                      MD5:B5E60FCEAA89B541E5AC55E77745FA34
                                      SHA1:4513838B2A02F4209CEC71A9FE2111D1AC50FB24
                                      SHA-256:CB9427F225FB5AC372C2ED6C825A1233CFD7833A0E19169B56416FF3447F9F6D
                                      SHA-512:E04430AF1E7622DAD7DEA4CE6420C76E245F6FBD4088651FEE5204844066EBBEAC73B00362D7E2CF3A62646DE98254BFEC6BDBFBCD7EE6B8BF2AB20B74483EA1
                                      Malicious:false
                                      Preview:J2...>.....\..w.ty.]....Q@t.zj..i......r.'.K~........c'......Ns5.3.`L...W^..A...[..g.:...O.HP.\rx..%)...I......)_.D.6.3..|/9.5v......a...17..i..#....r....q...8..../I*.M.mc.S.......r.......wm"H.j..4S....>.Ls..7.5L..4.....70"j.9$.`.....O../.....y.ve:4.....5.h%..(...q;h.Q.....K`L`.W+=6s.d$...UP..r^..k.4.gC.e`.P...........L.~..Y.7s...y.Zp.-..E.+Y.#....i..cbj..V ..._.Y.e...R..5jfT.."....@&...VN.E-P-..Yz.y.$.I.6yn...`.'....k..q..33.\._](...].v%.ymH.x..2iQ.;xw.....D...yn...:.A ...3.........@.}......x.....~..9..Fn.deo..h.A..mN....i.2.I..w.r..t..j...Z.s.I.Kj\v...*I.Sx.I..1u....[........`......>....^-.....BC.S+.y.A.k..(.......<..<....nH.7WN.8.jr..-!.5.4.QRw..PV.....(UG..-.M..._......W....i....i...q].<...u|.c..It.{..k....p..I.......[S.B...v..%......,..&..|..k.>.u...|.r.D....i.v.{.132..;.d........T./@"-.xY.{7AN8q.(s..VHG.c.d$...s.7t....,n.%..kZ..e....V.....l...1C.....(N.s.{.Y.T.A&|..!..A.+K..j..r...>+.....)R@...6A.`.|E^.......K..........~.

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0lYGTO1.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):457
                                      Entropy (8bit):7.5433367479905105
                                      Encrypted:false
                                      SSDEEP:12:s2zTqGeolNItI2a9m/388JmG0Z6A546H/c2J/u:s2vHl2tILsnMG006H9G
                                      MD5:0CDE22420C556CD280B00751656E1950
                                      SHA1:342759D63A5769513724B70CDDEC171E5544545A
                                      SHA-256:C9DB54C3EDD8C11BBA858A9761C7CB510E17903273945F1A6D18F270A9E0A5D8
                                      SHA-512:B93BDF46DC9EBF1372BECC49D82D8994C8149AAB6BE17C22C9C92E29E5B9987AC9C440840E95F79D5215A023FC344D925CB265D5AB9910D951B0E99D4A241F6D
                                      Malicious:false
                                      Preview:B.7...Ks......j...).W...p.L.....FPi>.OG`e.U. ...;0....Zz.~g..i....9\.I.wS.{.....r.......R.^ ......X.5:*.!..i..u.3*f.......hy..fN8R..lq..b.....O.@..Z...).1b.=o........nV..Wd..j-.||...H..]t...8U.. .JP>.,...3.z......M.J.."....9.....S5..K...........#.6%...TJ.P...1.`5...]..1..........p...N..bn..yf.).4.`...q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2h6R5HU.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):456
                                      Entropy (8bit):7.549636972504086
                                      Encrypted:false
                                      SSDEEP:12:NCqTtHb+M/3yFKgwWMGf7TTmG0Z6A546H/c2J/u:hxFfyyWfqG006H9G
                                      MD5:CEE2878EAEC621BF69DFA0EE58E285DC
                                      SHA1:3E038AA708EB03C68A527B29B433727D694ACC97
                                      SHA-256:3ED2433A31CC268AFFB36814A76C8CDAB4FDF4AFF7D6133F5A9EF5EE9A50BE0D
                                      SHA-512:3AB420963CBB90AF6038D6E6A6AB55E325365AA2A63F2F68D020877C209981B470B61825B880825CCCB3672FAEF404DE4015DC9C35870697B9E19433BAB9A699
                                      Malicious:false
                                      Preview:$.=&A"G_.a8....>.Os..O...u.*.C.b..,|/..2....MGN....]O.k..wE$.M./e.D6:.Q.J...[..k..ro...{.~I~...dZ..o 9.&.C..2.8P.;k.k....4m{d. "93...w...7m..(....~v...... ...q...^h...S...%."._.1..*(.l.Q....:..3.U.J.>.-<Q3.....#....Y#..".Y2.9......S5..H........Y......j.+....D.....j+..Z...Ptw..-.67......\.Q..pF.......&'.r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4lNXd9y.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):431
                                      Entropy (8bit):7.494867074300291
                                      Encrypted:false
                                      SSDEEP:12:OocbHLXnpO/6+QWtzHAisdWXmG0Z6A546H/c2J/u:qbHbaHzgisdWWG006H9G
                                      MD5:2A1B8D7F78ED10FF7703A72B6C69CE1A
                                      SHA1:2B92BFE3F546043D87C0BD144BB99D792CC2BB8F
                                      SHA-256:0E49D533B3700959EF9B5471EF74265493F6E4C0ECE8A15FD9C1FCEF1C0AE6BD
                                      SHA-512:C887D6A6DD21C1070458205D1C6B9A66BB57559498B8BF7CC1003406CECF4B3E6898DDACBC40B7671FEF470EEB6B5123CDC39B482C852B8FBC0BA4F674BF7E19
                                      Malicious:false
                                      Preview:.........k..X..F3!X:N]...U.....~7..e...)Q@..j!.EO.......ja.Q.\..#7.5..8.{1.P.zh.y........F..!.....Mp.,.&."..-.S.....pP...0..L>j..|+]..r.."~...5....*.&.X..p......E.]<.Ox..J.>.-n...dg.......Q/..b.v.....?...Sg..H........x.j....b\.U.i..B..C...PT..3/.&P.8...E1..U.J..L$8..-...2.m....t.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6stwbpI.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):456
                                      Entropy (8bit):7.485772587764126
                                      Encrypted:false
                                      SSDEEP:12:Q+1oaIVIjoxJwd8ixoUf2dZfAmG0Z6A546H/c2J/u:QFa0iiUudBfG006H9G
                                      MD5:A7682372EEE4E3A8FE3599FC74745E4F
                                      SHA1:8204AD36AE02CBF13A6B0FC563C38E39F0A5FBD2
                                      SHA-256:B18331433632BE161E974B2AA2DBCABA037C96F90A19181D16457B34B825ACF7
                                      SHA-512:015B07692EA893A968A3C1950761FB9F995309B798E72A2C7AF821F633AC474067B71E3766625DB9FCCBFF22E8BB85ECBF734C2EBB812F5D76E4DB53245C898D
                                      Malicious:false
                                      Preview:.~.Z.J.u.........7..?@....o}\..%..H?R.F..........R....!..J..K.H.[........EP............:....9.`...\....#....E....d.y.^...-0.\ ..+......69....6..Q.....z<.......G.:d...".~nE..!..M.e6xZFV.C`UR.....q(.J.>.-<.T....".f^......Y..;......S5..H........t}f.ou..#...4...6p>.o.. .O....,..rVH....\..o#..4Y.4......,r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7P2j6Hc.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):461
                                      Entropy (8bit):7.5571841143566125
                                      Encrypted:false
                                      SSDEEP:12:koqKEQgmkZFZs3FPD7ZRLChJmG0Z6A546H/c2J/u:nqeF7FFMMG006H9G
                                      MD5:ABD805F71EAB8707D4774B18F311BE3B
                                      SHA1:27AEBF2145392245C8F4D29ECFE80432DA2B9EA3
                                      SHA-256:F2DA61D4F54CCBC509552A8D18F062B5FE6A4B0F7FA132CDF5CA758713CF1431
                                      SHA-512:E142977C9EA2B230D539FA097B76A879A1F73919EC316546DA776D94DF523D5FD0C79CBFE5860C1361FBFFF17063385D2ABCEAE0D56192C3F5B94C6DEA3137B1
                                      Malicious:false
                                      Preview:,...YF.rV.W..e..S-...58^f1".%..'..6v....1.w/}.R...7.)...C...W...T....MQ.....bn.H..T.........B........R>...k..E.R..9.....4(.n.&.8..I.l!s.$!...(..C..2.X........;....e...vO.w"..fP.nG....^..2..z]+c....z~.$.#..JW>.-n.T.....*.K.j.. .M.61.'......S5..H......p.&.....Q}...=.......Q.C...`.7D...o.....(#...[.G..J.S.X.4.a.JMp.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7WCdrR8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):466
                                      Entropy (8bit):7.585018389524041
                                      Encrypted:false
                                      SSDEEP:12:zkQlAMRquC1/8aFVnx0H/rGTN1TYGpTxmG0Z6A546H/c2J/u:zk1p/Xxq6TN1TY+TEG006H9G
                                      MD5:9A3CC5C3C3E1392342B8C8CF8455F801
                                      SHA1:9C680023E43D629F22AA07D71D3FCE509EA595DF
                                      SHA-256:986150E3BE7EE32BB30044871A83CB89DA477E8111C62276E572BA9FA1B7B37C
                                      SHA-512:42B1D4CAA25E8E58E6BD2600CADDBC907B675395836A658A6DF033D658F376FC5AB64D63AA313863C53A29288D0638136815CCAFC1217BDF2123941284BD1851
                                      Malicious:false
                                      Preview:y..HN.....m......X.o[..;|).s.3c...y....Sr...z...H..*...V$...I..v..K.U%...V.......?..(l...Yc..{...k...'/~.."..|g.P..X..v..="..^..iX.h.......D..*...h!..],Xd....a2.L.....~...4U..t/..k.....P...!..NZz..8.........r-..+.J.>.->......*.G..........9.....S6..H.....<.....P.........W..T.P.d..........?R=B....0...p9..q..l....ren.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\9UN9982.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):462
                                      Entropy (8bit):7.493659968128972
                                      Encrypted:false
                                      SSDEEP:12:bJ07wkeKLaTgP5AQNEksAJI58amG0Z6A546H/c2J/u:bJ07wk/ukB9Eks82wG006H9G
                                      MD5:CC57269A8F347A8649454B1F5B5F1F97
                                      SHA1:2EEC6C2522E625AC14F0A4EF816CDABDD274D9D6
                                      SHA-256:9F43772E8F538E9F4367EC0CA9553545724A4774C6A683AD4D04409EFB6DA3A7
                                      SHA-512:FF7637C9E1E9CDB37D3A241B50B55A6253CE8319DC8F266A8821146AA72F071FD239D1196B958F585542EA0CAF7854FF077A0B47403F650E284AC412DABA53CC
                                      Malicious:false
                                      Preview:KqL....i.....bA.....Mq....nT.vEu]kdV...[.8~...u..@....b....EG..:.$g.......]...4.......|(;N.I..r.@........>.9.,.....N,.f...>eNBj.?.e}..t...._..-B=....J.[.s_.@..!....kI..F...[-....Q.'D."....K.P..|.eT...S.q.[%..JR>.,.3L.@9....G...@.M.6..'......S5..H.......$.O.....i.e.7........p...9.../.....37G....D.p..oI+I.......p.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\ANZsCoN.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):463
                                      Entropy (8bit):7.5740443822494035
                                      Encrypted:false
                                      SSDEEP:12:otWjROeRZCixPyHOw8UqL6EKXemG0Z6A546H/c2J/u:H4WZS7qLVKhG006H9G
                                      MD5:7B1877833AB9DA808921CF4338E6970D
                                      SHA1:FE734BF84431D41A51B9E693DE4E9671A6628B21
                                      SHA-256:54B29F75D5B27CFFB3A526A1B2883C2546B6A7610B743100CD69DDCCC8FB4F0E
                                      SHA-512:B514971E5B27D01939AF635D00923A13AE95FAE3846DEF516108D3BAD7680BE43D873FA2CAB5A0FFAFF42955440989376A4CD25898B98400D1FA7C10E960FDBA
                                      Malicious:false
                                      Preview:Cx....J!:....{k<.a,4....5..E.'....@.h.......n..."..zU.{....... ..#.5.y.+u..2,.e..D8.`...Y.UN.o.(:.s&.9.....$(j.=..e.:$......T..h_.....iKF....,....[.=.G?...&SU......=....FD<]..I..X........&.....m..)....>...JV>.-9.....DI".#w...7....i;......S5..H........b....'.S'ao@Aw.....y...!...I.....S.b.....m....H..,.c.}n.Y.r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\AbwIUrW.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.568473092391955
                                      Encrypted:false
                                      SSDEEP:12:wi7E8LIDJ1UdILzkxnlWusUmG0Z6A546H/c2J/u:wi7E8LEJyOkxnlWVDG006H9G
                                      MD5:F7E421879F25FA209EFA0D07EE018E9B
                                      SHA1:3A810CB085866C73000E4014F3A2595AECCA525D
                                      SHA-256:58B24508FEFD742A52F96952269B1DAC872E0F5BC78FEEB014872C3BFD16EF28
                                      SHA-512:AB9BB6350F96E59FA0D1DDDF652C7FC13BF9BB7CDDC26EBB1499450F1347693F998CECA6B2E4E47C2D2C938C33E00DC436C9ACFF7BCB712D48CFAF097CB3FB22
                                      Malicious:false
                                      Preview:G..K.)|[|..I.-[x.)^...'.%(...uW.da....,..e.j.F&..T........z.%jI..c.9.Q...W1s6=.;.{...'&k.w...o#j.D~..&-.....r......H.$......bF..;..../...u...S........G...#%.e2.D<hT/.d...|.)....9D...=.d".6..m.(kk..,L..$<AM..J.>.->.S....:.r..$.:.0.....9......S5..H...............w...P....s.4O|pR6.E....O.e!....(f"...a..j.S..)KE....r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\AtxknkP.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):468
                                      Entropy (8bit):7.561332696444543
                                      Encrypted:false
                                      SSDEEP:12:pgSU6egoJn+XtY4sqiB8RvvmlsmNevnbamG0Z6A546H/c2J/u:o9UXtY4sqo8R2CmNcbdG006H9G
                                      MD5:6C3CD580287DF6153D4051ABE835BEFC
                                      SHA1:C09CDD9D88AFBCCBAB102199A79B7060F65BAD03
                                      SHA-256:76CD91DBC3CA35228BBCC914E086C8F4792E148B03F9BAF5E7B9084A0D64A389
                                      SHA-512:B054F2144D962EDDDDB67DC36C3F0931BA6061B0116AC2B3DC063030CBF150170C57837BEC868E7A325C9945BAAEC56A9911795E4F1915B042ED829B723057ED
                                      Malicious:false
                                      Preview:W_..S@|...Ni.-W....vkB........s.-..y.a[I.l..9....M.........2D.-....}.]..q.9.4gru6.B....A.,`C.,.6..'h.b..1..Z......~..{.../...g.....@.....x.s...J.\.;..j#.P....QS9^_...W.k...g....0.....#.'.F-..z.9..-.....u.q6...JR>.d....9J{....F.....M.6..9.....S5..K............gs..A....g.../c=..i.l..:o..E.l...J...1%.J.^>....I.......o;q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\BzjLujQ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):464
                                      Entropy (8bit):7.597479070684013
                                      Encrypted:false
                                      SSDEEP:12:4lbfFTh++F0c6QWqz4zumG0Z6A546H/c2J/u:4lbfFTh+6g6MNG006H9G
                                      MD5:49F66530712184D01DDD5F7FCC7C2AF5
                                      SHA1:7F94FE383CC948946E6BE6BD67A9A5026B7D53B2
                                      SHA-256:14EA2A789C01BAD62E46365ACD6FB4AB9A92B6E0B5103A413BA280535BCCD52A
                                      SHA-512:D74A133512891D7B981F56A42AE8E057D8867B6F39877F18B4EE0C875EF3F45682C74813CC2AF12D6FD834DA05E45DF9E7689F9C8B6B255A96004A5E90D4640A
                                      Malicious:false
                                      Preview:.y{../..[i.K....S...g.@L...........K.F.S..?-y&F.N[...d..........T....-.Ew.u.\h.zg......k.1T.....^-{......#.N.-...Iuk.....K.....d....Bj....K...;s.c...Fo..h...S4y~.z.`.C.|.a@}....[l.b...5.......;&nw ......l.K...9..1.~.e...ag.....*.>..U.......5..H........x.wrsV.)..d...kv.W.|.3.;.X.3Z.{..Y..4_.&g^.h....*yyb).7M....qt.s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\C5ejnyN.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):458
                                      Entropy (8bit):7.621817655176183
                                      Encrypted:false
                                      SSDEEP:12:X0qumUO65hhjxFCmbKvPuqzJumG0Z6A546H/c2J/u:X0qum56DhTbwLbG006H9G
                                      MD5:10E866BDB5166C712039D3C29A036CAD
                                      SHA1:1EA30FE4C2721E93F63DCD8D069672D8CD1C09DD
                                      SHA-256:2B6CE13D45C66D1A34E874C19AB672808E02D3ED0C3D38A4A308B21B493E81A9
                                      SHA-512:66EC778EEAD2ACE93E60E67C69DFABA57AD4C60DF45290BF7734D6AAB9ECC5281FC80CBED54C92E5AACED7E2B8FD92151B22CA7C879489364B9E417589CC102D
                                      Malicious:false
                                      Preview:.`...'.....].'..KY...p.......Uq..P.1.O<-#_y.k=..R.D.E....Z.%.0.kGf.z7.$....s......mP...[:.E..5.X3.......O.).|'/....x..%...%.J .tA.u.."..6....yEd..{\....]......pf..E..op;..._IV..Ov......H:......L..JS>.-?......M..;O7..\..v...;.......5..H........x.b..^.%!.c65k..}."L.a"..KFD(....9.... 8.(Ri...?X...*.W..w.V...s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\CALAofU.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.549440187888039
                                      Encrypted:false
                                      SSDEEP:12:LwfsIlCjiiYz5k0ismD4z8wQTmG0Z6A546H/c2J/u:GtNkjD4zzRG006H9G
                                      MD5:9F473C6C8CEA3D575E902165C1D96326
                                      SHA1:EAFF37294143A6E9DB9C663EE1C3209C51471392
                                      SHA-256:BBE2EFEFA3C1AA4BE4C168FB65001C268BAE3C79FF28A11510FB3D646B20C570
                                      SHA-512:A036F662E206FDDB6A2F6A74FC580B7B766610D071247AD223F36B257D334AA0B1F36F160A11291A8641CA86722766C824E74B7A04B4E4F653B38307956C08B1
                                      Malicious:false
                                      Preview:.f..+.`. .....ih.zn....@..d>.7Z.u)....q..3i..).rDM<'...N.G....=k.z.].....+O..qs...eH.. ............o..._.P.z.....[..g%c.s.~......n3U.E.W.#...k.^..(.b.:[....uLm$...>...v...%..Ce..FE.px....$W.....Tu^...S..v.J.>.-n.W..@.."..cZ.....M.6o.q9.....S5..K........o.....9...I...q... F..x.@..<.....Y.l..D...&y1.Kc.I.M7.0...q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\Cd2OrX2.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):442
                                      Entropy (8bit):7.506625078721746
                                      Encrypted:false
                                      SSDEEP:12:0LVWocRsmC203d7Eqwwb4OYTXbpdcXomG0Z6A546H/c2J/u:S7c8203dtwU6vCG006H9G
                                      MD5:5CD4A9995707167A96D5F2D04FE4DCCE
                                      SHA1:72087267B42022531F8AC9618A04BDFC5A5BD86E
                                      SHA-256:BCABDDEB50AF9E9DCA519648F1B326AA51F9FB146DDB06E65B8F0D48FB23B95C
                                      SHA-512:55773796FA8CA436DD338B185760AEFE697A28C97D853B85DD233F65A9E7635749796962A234F3EC94B9A95400721892394A72177E0F2E7652E734DBED2EEA3E
                                      Malicious:false
                                      Preview:G2\../Y.j._.~.....%..(..3 ...P..x.G.D.6..&.r|...>.en..T:_..,~U.._]:.@..._&.8.,FMr......K.Rw....(.g.;b?:..._1.U.~.....y..O.,W.>.+.7.gt.4Ce...tl..........=....).*7...[..qL...(...a2...[C.J.?].>............."..M@...'......S5..H.......<.)(]Q..k.R5.. !+/..M.`.C.....{..:.....E....%...}..@.e...^.|ap.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\CiyT3Gh.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):468
                                      Entropy (8bit):7.533037037181341
                                      Encrypted:false
                                      SSDEEP:12:VJe219IrAAQQ7zO0Q1IqbQz4/zYgmCB3mG0Z6A546H/c2J/u:VOUqhQ+qbQGzYs2G006H9G
                                      MD5:B7B62FDE9566EFC46BDEC557D0E1F212
                                      SHA1:2895869EE548418C497FAFE20843FF6A08429C52
                                      SHA-256:CC352FCEB01469C2EFC71ED9BD0534D630750BA0D7F8E799A845ACFA66EE2E42
                                      SHA-512:46D50AE27895FA37A1889A9C1F5F9F9C436A3F62346A253618F1F2BE83AFC68BAA50302805ED1F1014952AA210EC2592F6094DAC651560F27B60812B3047CA67
                                      Malicious:false
                                      Preview:...-..Ah....,......@!d.WP..{..n....H^.z.&..<.>I.O..........c.z.^.*+....'6'.c..6v8..B.3h......R.I.....t.....Q....%.$.{"S.....,...V:..r...T-E.........&M..^.D..V......>".\>B-.i..!..l}4..r ......<Q....s.......o.0.JU>.-:.......6.r..Z7...Y.9.....S5..K.........S.......gt..=..g.N.X.p..cw.u....\xl..o".M..0..^#.I..i...Gq.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\CmlVtoN.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.504447000905384
                                      Encrypted:false
                                      SSDEEP:12:XZ32fGasZ9/UxhTPxWYDBNCImG0Z6A546H/c2J/u:XwfGasv/UPP7C3G006H9G
                                      MD5:46BF49EBBBE2AADC412A575368707FF7
                                      SHA1:F4C9DB0256431E74CBD96D21CAF8EE8050BBB05D
                                      SHA-256:08EC12D2D9058A5404851A84B6A9159C0D89E64C946DD8531D122D3A738C6AB6
                                      SHA-512:6EE4C803436B9B7BE54A0AAC148D350377CB126B34B360F064F3C57E938F3FDC35563D53B1956E380378A6A82038E7E71F42AD5809D0B7B662743896B424C3C8
                                      Malicious:false
                                      Preview:5.xW.9..n.&.7...}.z.2..5.d..Ls6:.C86.1n..8..5...VV..!...y>p.5.2..... z9.........../....k....q6.E..|q....,)]...X...t...j.............-.tw.1.;...f.>..B4.\..@!j".j\...j.FP+.,....w.2*...j1.U.R.f.1....-.XG..:.=W.J^>.-i......"[..k.._...T........S5..H.........gY.=#f.{.-q....X5Cz=.\..-...:.......}.#...A\t,T.nu.mC..?D...Vr.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\DM0X1xc.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):476
                                      Entropy (8bit):7.509533849863658
                                      Encrypted:false
                                      SSDEEP:12:0AnhKSPfjGb8Ea0Ivy3W3ybwRO8YsmG0Z6A546H/c2J/u:HkOfjGw1Na3W35O8+G006H9G
                                      MD5:43CD76A3FB351973B77AC6633042DBBF
                                      SHA1:0CDB82270C4ACBE7195311CBA887FA0E82C62261
                                      SHA-256:CAEC532867601F192BCCAC478F48AC08FE0571CD03F23A546EDE7BC620A989D9
                                      SHA-512:F7E3FE5E0ED1C08DCF5022040118F8982B4BDC2687404797FDBDEF75E1B94F16B6EF5F93966871084C01CC55B60662CCF79C2D73F132025AA01E08672B09B03E
                                      Malicious:false
                                      Preview:..S....I.RP<..!......M..P.....v.L+.....^..........B.u.....r...0C+8i...).Kf.q.6t..L#...Y. ,.......&$.d.z8.dU<..f..r....1U....*.R.?H..jK......p...^-....>A}.=.....qM.`...0d....w`.C.m.X.Us_T...B...}.*.G+.....u...Z.b..J_>.-:.....DM"..................S5V.H........x.}..7....w......H.T.)..1.8.d...z.....4.P..].....G........|[....u.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\DsMP1cL.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):455
                                      Entropy (8bit):7.557694103280126
                                      Encrypted:false
                                      SSDEEP:12:lt/MiaB6OGrcuwN6YBkqfquomG0Z6A546H/c2J/u:78MOGwuwNRBhf1XG006H9G
                                      MD5:D7227D4CB581DF6E213E56616055F050
                                      SHA1:1B37246AABBB20BD0CDB4EE7E0E23B154B1AE6C6
                                      SHA-256:394ACC7A4BC92BB55A00C4DB12B081C641941512FAAFF6651BAB8B5F5B8FF968
                                      SHA-512:43190B754AFC15B3A7B36BF3A5F5975052C1702A73EADE2ED01A40AE49E9CA6EA79CDA42D9EC2C9C7DD2BE078C58D7E867F199094273045E657F97A8B7C14BD3
                                      Malicious:false
                                      Preview:....;..!;..5...X.....m3U..qAhJ.._.M.-..(G..._..:..w...n...LV..u.....U.`..E......>a..:..0=@..7_.s..I..<...Q..q..)....|.\'.k...Fl.....|w.7.K.6..V..,.%3...H.l.R.G. .y"...F.>...A2R.F.y5>.....o..S..q....g.JW>.-;.U...DM...GE.*.}s.cj..,.......5..H........x.;O$K*/ ..5.*....N-I....>.LGP^H7`(.R.@..*.....a.........N.].s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\E71lEr2.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.549285019076377
                                      Encrypted:false
                                      SSDEEP:12:APiDJPLx1j2cVJF+S/vO+2i46N4Voe3yPylmG0Z6A546H/c2J/u:APiVPLv2cTF+S/vO+2nznIG006H9G
                                      MD5:DCD90309A228574DF645F4237302FD30
                                      SHA1:2F3461D452F7C38FA0875D2196BE539D85DF17FF
                                      SHA-256:C1A5B6644EC4D2AC74F6AABC753B681FEA53913E93AE4C160ED2F4DD42510E03
                                      SHA-512:8D2D4E447E9BA8128A378F75B9A96EC63AFB632CAF8E646262DFF91E2848AA119B68EF055436A93598651E5126668163B325B39F8D5284D2E99E1A96E2D7829A
                                      Malicious:false
                                      Preview:.........:...Z.@..amE,.@.*T....7.w..X.1.G..CD6.Q..0...<.2.C(.o.>.T3O..y...!..!.tXy.[.-.N.?...3.Z.f... ..5a.G..o. "..K>...VxB..W.Zl^|!....r..Sk.b`J.%DM...vs..&=....7f....uj.z0V.t8......i..DL..zL....]r.r.~k[...L.B..'.JQ>.-=.U..k.8*..._.V@o....T........S5..H..........M.5.51.+.P.......-...cH..=..E...Cr..8.........L9.^......x..r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\GCIbj2H.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):463
                                      Entropy (8bit):7.530812897346217
                                      Encrypted:false
                                      SSDEEP:12:NE5YaMKmjk2AcbPNqOBsO2SmG0Z6A546H/c2J/u:KyaMW2AcbP4OSG006H9G
                                      MD5:D8DF6BDDC5D20957B01D21CF3A589194
                                      SHA1:EDB408B8ACEEB8C75A6528EFF5B73AEE05B80795
                                      SHA-256:CA0F0A414AB8EAE081DACF0CADDF31463A936ECFC6AEEADE92D14C2E09243F5E
                                      SHA-512:31722074A47C0607965C5E7942269A3E48E858781818E72D39B384B80A971FBB99CF21C468BDE7B234E0FDDE36AD2C2BBC12BA1EA24D9186C11D5C0EFA706DF8
                                      Malicious:false
                                      Preview:*..|.uZ1<..r.....@>U.......H...eSP..?.!&.....-j/...././.\C.....\.=...dx....+T..F.+CC..n..........Te=....%.r...^j.k.I@..D.e./..;'.0.i.p..E.Q..l.-.....e6...@.ZUd...$..E...h.92...~2....TZ.e.==......F.U%-L.J_>.-:.T.....#......(..q.5.........5..H........xph.`...........Y.gB!.......9.IVQ.R.X.1...'.Y....J..f.J.S.6s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\HvrBhJ4.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):463
                                      Entropy (8bit):7.54778544713007
                                      Encrypted:false
                                      SSDEEP:12:zIXoUjxMAZxLUgOUGVqAfa4VPmG0Z6A546H/c2J/u:zI5jmAZxH9GVff9AG006H9G
                                      MD5:DB61DE6DFA5356F92D544D77C27DF974
                                      SHA1:52A559E2B4F5D4A4778EBAA54AFB8D35CA4823AA
                                      SHA-256:FAA6E633424CBCB12D874434143D5129B0E81DF261D7B08D5A9504F80BBA70FB
                                      SHA-512:445F9106F554A05A08901EC538F005B89F41A0C32D47E445A4E375FF4DB14DC47DB57E9AC4A49B742491F631B897A3DFFD35F775441D78A7EC891945CC60AA6F
                                      Malicious:false
                                      Preview:.K.F..A*...|r.Q#...f.........,.........4......nIo%........Q.....T.d.}..>...V....h.._.f..jD.....0.....j.N6.Q-+..(.........T>.....d.L...gO...`.....la.J...Cc.?.P.[n.j..ec.Z#<....\....:m5.O...L....^.0..J.>.,..R4.j..L..;.O.A.......i;......S5..H........<.;..7........&.:@.t,.......|]..;.1..mJ....{..g....T=.;...G..r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\Kr5vmNY.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):468
                                      Entropy (8bit):7.5790591536684095
                                      Encrypted:false
                                      SSDEEP:12:1/V4Yy2mLuoTgx/sUUZzmlTs0m1SEazPpmG0Z6A546H/c2J/u:jqLdg5AY5k1SEazkG006H9G
                                      MD5:9A192F3ACFE560CA3FC8BAD856D10578
                                      SHA1:87C03D4FB966C6EEBFC884624B7812EB1C5E3C62
                                      SHA-256:981ED36D8BE7507092E094F597A2414411178D693CB0596F2152A3B00926155C
                                      SHA-512:91AB3149B00CF63CB819236293C90E09A792D706B3045BF058D8742E4BFFAC2DC4A7A6170A23534EE1AD0D6F28DBC83A9822BC49FFAFB87BDEB42CB27AD6B483
                                      Malicious:false
                                      Preview:.[.2...c.....|..a....yL.e.3...@..Z..d-8c..HC}$..H..hd1..O:=w^21..e..!...b(K.x...J........D._.~.../...Z^.zWT..4~.@........|....05..`...{.s|. /. G...id..d..N..p..+..6^..H8t.%.Z...5...V.9Z..N./....2/....]..cX9A. .@x$.fl.JT>.-oQ;..@..#......&.Y..9.....S5..K........i.SJ.x:..'....t..~P.-$....;.......T..j.m....`(@...?...).v].q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\NiCWDZX.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):432
                                      Entropy (8bit):7.508915939918725
                                      Encrypted:false
                                      SSDEEP:12:ixu0Nql3aiyjKgZ9cJq989rbFv7qmG0Z6A546H/c2J/u:+NqB7wDcE98JbFv7tG006H9G
                                      MD5:003F7C1FCE16D1077DFCDDDAB841632B
                                      SHA1:A8A40045972F72A27E6F6CB7B054978F89A2B25C
                                      SHA-256:1571FE0252C362387D91F2273163954C63BE6B7EC47C1DC0135CB09AEBD69920
                                      SHA-512:567D358D25931C8920EE5B54796F23EE17F75E93A3A06BA204312ADAFF780D57DDA3C3BA25B612086883C7B235040D4DDB44BEFA733DDEA1C252C93C3C1EF990
                                      Malicious:false
                                      Preview:_...J.....X1.uK.R..cm.#...9....M0Wl..!S)..n......{.yu.|..C..2n)s..+.Ug..N....N.@.N.R..qk.)P.f.-.=.)....e@^... Z}...K.{......K....DU..=K.?2F../..-...H,.HGF..k..U....U.;.[r...).J.>.,...4.o..k.r..wD....Yj.7;V......5..H........x!,.B..z3...T..}....*....K.....Jq...Ju.B.0X.GM.g..tsYH...-CY.s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\PQdWTOK.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):462
                                      Entropy (8bit):7.549246397637468
                                      Encrypted:false
                                      SSDEEP:12:E5NCfj5YO7mj8uBFRqcGUgdN4h5Nk0VQRnmG0Z6A546H/c2J/u:EvCfjq/vMcGUgdN4PNk0BG006H9G
                                      MD5:AFE7BAD6690A3A34D30EE2D5B8B82C14
                                      SHA1:5A11C2CE40972A3C646F9F25807B30F35E331AD3
                                      SHA-256:3DFB856AC5A12E252A39E10BF074387EF1213BF709C15E4383BE9AF449C3D717
                                      SHA-512:6942F7F104DF0A8F1ED976AC633B15C61248F7BC172FFC587EB3E4E594DD864EF65D031D065ECD391AB4283093D83865760BB348044C214A3A9D69D9CEE0A9FB
                                      Malicious:false
                                      Preview:.B..@..A.^....6.fA(..X...Z. ..4.v1...P.(..D.K.J...m.....Td......3.f].'..b1..V..!.q....0.......l5.."d1.(....R........Q.....VJ.^.uD.....k)~....!.C......[.0....h......0.9....O.........r!....8.......64r=.....JS>.,...4.o..M.....:.....d.;......S5..H............4......~...1.....s..j.z.Y.5.)...[..m..n............b..r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\PUKYAPA.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.533649168558692
                                      Encrypted:false
                                      SSDEEP:12:mTvIOSqpjXRYkm14gz6temG0Z6A546H/c2J/u:mTvIOSERYt+2CG006H9G
                                      MD5:015D3903C78F16AA766AB7338CC615E8
                                      SHA1:5B75CC2D8BC1C5872D0CAD2E0165768823910666
                                      SHA-256:7F504D8D620AFD5315C71F65AC8E28BD79794CE58DA4E0862C7426B62496A543
                                      SHA-512:A5C2D95FFA359D9298208E56A7718AD9AF85A881F7C1E32259C8D9564AB22B8BDABD90FFBD5EE61C1919FC90EA627BD5EC11824612F5F73CD48DFA3556D2DAFD
                                      Malicious:false
                                      Preview:...t.&.....l...y.b...D.N...\.vz..P.>L{........./q..a!|.s>.".L.....K6.........K.......}.~.lL8..r^...+...... ..$..J.vy;..vB^.........).t..c.i>..w..o!...=....>c....a...%...*...:'a..Z.})T.a...)0t......J^>.-jA3..Ft....h....M.6o.q9.....S5..K.......N........6..T.......|.V.k...,0.6.z%[.5...(....5.<...ow....t.q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\R4YBOwP.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):498
                                      Entropy (8bit):7.605191625190924
                                      Encrypted:false
                                      SSDEEP:12:2Ful2w85KwyQH4+w/WeQXgmIb9WSqumG0Z6A546H/c2J/u:etJ5dBH4//ZOPBG006H9G
                                      MD5:E469B0719A6B9E189E4219ACBDA335B1
                                      SHA1:F355093D9E43B97B808856A6497A35A89984E24C
                                      SHA-256:8BE7CBCDF076574540E0BD83EF0F53AF3A71C3A6595AE15FC1EA3F2DD80B57E3
                                      SHA-512:12A270662933D871D08ED3F22C9264336FE8D4A9139F99B955F28CEF6B765604D2BFAD2FE2F47E75EE5DE982E7A65D6D08C240FC4B8C423D0F406E92B9A1626F
                                      Malicious:false
                                      Preview:Q..IW.n,...1...Q.o.0.!$I...j.@...j..d....e....B..B..g.R.@=......[....z.C_T..sB.....`A.hu.F.`>..X,..B}M..~...|.9........R.b.e.~.....j.......;)7TY{.P.......r3Z@]..:[dy{..<3\../..._.lQ...`..i0H1d.U.hBKm.C...4C".....S.r..j...U...Q.e...."....J_.....8J.@..&.C.r.....#.Y..........S5..H........$..`0. ...;y..AA!`f.o..&...FO&...c..*Ef......i.....;$sN/1.,...r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\SvVsPAI.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):438
                                      Entropy (8bit):7.520474389540796
                                      Encrypted:false
                                      SSDEEP:12:jGOTT3axK6qu2UEvcFwIe9l38mjjQ6c7lmG0Z6A546H/c2J/u:uxK6FR/Je9H/VYIG006H9G
                                      MD5:98A60BF09436F46A8DD79ABB18CE9456
                                      SHA1:1516A883FE5471626B249070FCFE8346003F6831
                                      SHA-256:B5F14BD074ECF30A1417D63A74ED5C752D018C1B6D2268B4A8B6DF480BDBA241
                                      SHA-512:0A317653BF46CB472D0DCE5F7C512D3A7D7843E6313FEFEF43801D0EFF6D6E7BF634216396E6E77108C9F029E1B9277807D9BAC12F0E86236C9263386FC00E53
                                      Malicious:false
                                      Preview:a...f.:H.."....q.eg!......z.1.l.O.........>...~."X....a}M.H..Q. ...o...6...|.)...4.D8....&..u..5.D..u... .2.. X.P.G..N..;.)..........H...tDiuf...2.ue.G...D..B......TO.j.3..B.F.1.JP>.-n.....DM".#{.0..v.Y...9.....S5..K........k.a..C..1...6{t?(..-.`.;.<7.S..U'..;3.24~.....!yy)fP../ S4...6q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\TBhZr8C.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):466
                                      Entropy (8bit):7.515151650200861
                                      Encrypted:false
                                      SSDEEP:12:mU+FAdeeXLJlK+mKehrWnU8G84D250cuLamG0Z6A546H/c2J/u:1e2JM+66U8GRO03G006H9G
                                      MD5:E0EA1C2EBC8FBA46260EE7A55E847908
                                      SHA1:A58B5C841375FDCA3D47BE3A56DD6002ADAF5102
                                      SHA-256:473064224881FBDBC2EFDC0DD490DE0DC55B478C3A7C77692A8ED284BD556CAF
                                      SHA-512:EF9FEFD57ED16993E4F1BD0D894409BE1E599E26697EA0D769D9E9BDE822BDD3A897CFA27413BA676274DECE38C3A881114B4600579D0AA3D2755529D910A0A9
                                      Malicious:false
                                      Preview:_..0?6.. ..2_{\....b.3"j....Y.I.G....st.E.q..o). E...........xk..a5L.YN[.....2...K...-p.W|.N.j.elr.o.a.4E.f.7..<.u.W.I........1.K.j.i..'.`... B._.^......W.;....l..@l..`.X... rt.x..WY...I.t.vSC.i...if.....!...JQ>.-oU3.......r...M@B..'......S5..H......N.N.}.i.....r..c..>.9.....rp?.oW.2>=z@.l.AJ.0..9`.%>.&..w..p.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\VTd6Osg.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.603180834342571
                                      Encrypted:false
                                      SSDEEP:12:kdcNI6tusA7dan/7EHKUUwRae3g/mG0Z6A546H/c2J/u:ksI97danQlfOOG006H9G
                                      MD5:5152FBDA449DDED204307AA1804D4E71
                                      SHA1:A9790F3A2976106AA8A4195CC074E778BE45C195
                                      SHA-256:0692FA10CD8D506CFDCC58AC5AE42AA4537D22B30BF5FD98CDB489E99DF1251E
                                      SHA-512:DCE9496BF3CF490FF62CDFA27F3530647895A9577437733422A0EA47425B1FA24A3F85A3908E68EA036A532D22668886CC7F5F27F09971494326536904A80C00
                                      Malicious:false
                                      Preview:...#.V.&.D.#a..?.(.......q......j40.8...m.\..$....7]Xgt?e..R.G.A.'3I...KR...zN;....T."\..v.K.....l...6y..q.z]@..Thr.H.^W^.(.......:].w..p...Sj.......V=.F...r......J.$...OH<.'...~....j.^..)+#.."...k..!..JP>.->Q?M.k.e...;L7..M#.?j.2...j...S5V.H........x.}..A....p....M..T..mk9...43.|66.f:.)..5.F.....1...m+.b."&....u.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\VZcOmVX.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):464
                                      Entropy (8bit):7.5841524469123645
                                      Encrypted:false
                                      SSDEEP:12:z3S0ZRk87Km0tzVoIm5EjWF0emG0Z6A546H/c2J/u:bSYRL76z85/qxG006H9G
                                      MD5:809A5C5045BF35904AB10884E22B065D
                                      SHA1:114515A6E3F90947355A23B43E459538C7362343
                                      SHA-256:A402A9B74D90FBF95D703B61338AD5FB2DBB28FB25D52B173D089C3CE8C7101A
                                      SHA-512:F84187DED82CDF33F4D80A3AA8C6C119F4442F3A62B6A7B806366193A44E6DBFFAA30C4F71FD6F58F3E62413455E605E22A56B07A501BE071796F656CCD16D7B
                                      Malicious:false
                                      Preview:'X..D.*2WM.C........y.p.cw.7.).=..C5.....4..he........g.._.......]I..m$...|...EM.k..y..ZG."..-...;Z.G.....J.h...U...D.\..)...V?x\.i....... ..Q]0....L....aYrI.8.u.2r~&v.r'..+]....RI......N........9....=..w.JR>.-3~.............+.b.....9.....S5..K.......Q.>....(..suR.bm..............._....ei.h].......U$.A.".rJ.M8.q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\XTnVblc.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):420
                                      Entropy (8bit):7.456815161946334
                                      Encrypted:false
                                      SSDEEP:12:03p4bcbwoyiDf6fGIcTmG0Z6A546H/c2J/u:1Ab9PfbIciG006H9G
                                      MD5:509CEF7DD7421BDBD5ACE597460D4D94
                                      SHA1:C1A85532A28583A61F2C290F2791D59DD25F9538
                                      SHA-256:E59415A74C35084BD4ED763E8B7C311D44E0B68F66797A91BF6A0AC50D031601
                                      SHA-512:F0E00C73A1D26544CACFF4244B15E27A3AC73FD42EA1AE13BCA3A2131DE236EF0BA058CB6CB9D686F7D51E1066521CDA497FF7959000ACA4ED080AB8CE41ED16
                                      Malicious:false
                                      Preview:`..q.....M...~#Uk...S..z$..$.....l1.e.>{.M....Z..$'..-W..`.........h.n1Yv.I...4..=......P..2...)tn......b........?..i.....p....p...u]..3$2P+RxW..E...2@.../.U...P.1...=c.uV./.JQ>.-=~.O.g.......y.......k......S5..H..x..=s;u5..b.M...$h.z6..j.X..G.2.v.. ..I..l.6]iD.u.....\C.f..l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\XWK0eSN.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):465
                                      Entropy (8bit):7.576705355633203
                                      Encrypted:false
                                      SSDEEP:12:0shszdZuuh3s1pQ+stTE1RG9qXYRRKU6bmG0Z6A546H/c2J/u:0Qsauh81mTtgTGYXYRgU6aG006H9G
                                      MD5:31EEC29C452AB528C0C7642460778965
                                      SHA1:BD395DFED896603DEE658B2A07E3EEBC62AB5DDC
                                      SHA-256:75AEA8A94E615C1D5484ABB9F6FBE55D0237588F22E52153D1BB0F88EEBB42BC
                                      SHA-512:2E307E8F38A75B9938EB03A60A278150A0D6AB3C91A1425AD74D72B6F310984F928955AD6DEA801EF0B2045CFEF7CC6599CB54D9C65FB631C50E7D27532D8353
                                      Malicious:false
                                      Preview:..(;..".u.!-.D@..Kx.....ju.-.(..Na.gU.E...H6...c..Gx..}.Rb...}.F...>5:..|sD....../..Z..(..iD.Ki.....U.'....rDL...tQ.X..* L.VZ>....=.\....F.g....w5.....s.......3Z.$.8....~9s[......)K}I.d..Mex.i5@.8.X...|...u.....JT>.........,...{..y_.....9.....S6..H.........g..F.}...........h..Kx.:...OP......>.w...*..9Q.&`..{.g.Xn.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aPLmmUq.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):463
                                      Entropy (8bit):7.590766299246463
                                      Encrypted:false
                                      SSDEEP:12:falGm62AInE3BUKZ5OtkCb44f1WqL4dE+eoprmG0Z6A546H/c2J/u:falGR2A0yBHW44JL4dXeiqG006H9G
                                      MD5:D6872BBF86E1B5F3F30CFA03D6DDF9A1
                                      SHA1:1BFDC4750464B50541DC0E9B776B2182386A184F
                                      SHA-256:360470BD4138DBF63C71BEC11FC33808A5F4F25698A98C16F87C65923E361D53
                                      SHA-512:CA1EB7BD403C69F3AE9040A820A935A6C531B4D56D8D45070682371FD0915EF81CD1658D061752DCA7DF4F71AD7E8878070A7D3A6FCFAF5B7CD8A5DCF0E5699F
                                      Malicious:false
                                      Preview:.)..7q....-..q...e..y.......;....z.4...:7-.>.f..Z".IR...:.#.+......}..V.|Vh....d.......H...9y!..3.).....\.W..^.3.........*.|-*P.Np.a{..SKy....DT....+...=.0.h..(..-...ct.$Ao\}..G..Y.......!]i.....T..?.C.'.t..JT>.-j....&.....M...o..>..U.......5..H........x.'.A..!Z0.\.......,.......]..%....1..cj.M.Ork...G..O.......fBs.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\dUG1yQv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):465
                                      Entropy (8bit):7.549900208435976
                                      Encrypted:false
                                      SSDEEP:12:Wo8Y1MqduABy3oqA4wN0GEBoA/iZrrclEjTmG0Z6A546H/c2J/u:E0dDewL6iAKGnG006H9G
                                      MD5:628831A22E11170404EF8C34CDD19387
                                      SHA1:F6BA34147A5AC39EF5684D6E8F31DF36B6240DBD
                                      SHA-256:2275FCB89B27AAD274667D342F1A36618E05F5C5E721E91542ABBB82A8FD0F21
                                      SHA-512:EF942AC122C7367FB6355E835B5D5D284163FB4E17187BE5002F51E5498D41457FACD18EEEF66D473400678455734CC30B4F0D0704A8211F4BC652C59F361F47
                                      Malicious:false
                                      Preview:......B.E..`QjAh..)...&.`k...N..[)...ry.... H.<J..[.o..{//U..E....s..,.,....a..H..e.E....Py.A.U3.u...u....E=..2rf0._P......FEZ:k...x...5./..o..}..|.w.......W..7....c......l...7....!..0.|...Fq....Q.!...[.u....|...J^>.-mQ3..F..".az.....v.Y..i;......S5..H.........}c... ...O#_...@l...f..Z...:......J[Q.QkK..m.."[..,......+r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\eI5O1aS.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:COM executable for DOS
                                      Category:dropped
                                      Size (bytes):477
                                      Entropy (8bit):7.523587930180436
                                      Encrypted:false
                                      SSDEEP:12:2X2j7ct9MgYQl5hm20MxRuvmb4uQ3t6vK4mG0Z6A546H/c2J/u:LjYt9Mc5hcMxRuupKnG006H9G
                                      MD5:38453F41F97E8AF97B030B8E22A482FF
                                      SHA1:F63CC2F297BDA48B4127F2906382706B4F7183C6
                                      SHA-256:03E72AF305CDE38FB2A693B6748FC22122F2B2A9D556C8F0630E9C7630892835
                                      SHA-512:3D62BC3E7414288A1AF5501AEBE6FBE926B49CFE296E57FEBD895B84C317D592498653AD4D580D7449D234E062B406B24753E477D75ADED341E23F4D15257FF9
                                      Malicious:true
                                      Preview:.5x...h.,>.F'.) xf...F+.../..p).'.m...."IL\..M.d.m.[6....Z...;.@c....a..Yt./"....c.Ee...0..M4.............-.......'..Z.=.a;<]>.Q.J...~..(.......k@..x.H...f..l.]W..J....m........ .o.o...&C..=H....X.@....O.+kI.>,.1n..Z..E...JS>.-;.S..I.&........2.Y..19.....S5..K...............QBl2"..%...V0h.N-.;n...*.xd... c....i...p..1...>i..!q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\gRMFL7k.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):497
                                      Entropy (8bit):7.514992837437753
                                      Encrypted:false
                                      SSDEEP:12:rju6MiH/fl4o5Yq/l8kxNpmG0Z6A546H/c2J/u:fu6Mc+a9XNsG006H9G
                                      MD5:B756CA345B00A90C57C0EAEF35657EE6
                                      SHA1:2248D8EC0C66E7D176A775156079F9832C00E4C6
                                      SHA-256:49FA57900B1592B9A110F5E32EDE4427C8FA52D70D9118F54DE9132B8F8B25A4
                                      SHA-512:37C59865F6BEEFB36712EB26C7E332E95AEE895FADC22A8F2C996C688BA8FF941F576FE3E81B79CC7CA08439D970897D5E177A31950273AB3B17866D0DF7AE01
                                      Malicious:false
                                      Preview:...q...9..Wa].'p..p.U..R....Da.Y.6Ea(K.SW.>....?.m..r..[.w........+m.p..PQ..q.t.E.>.{.8.............#.`.].i2.P.._.zl...'t.648..H.a..?..e.}Sv...dj72LS.....9...I.k.......h..3.......v..5.......|-.....+q..R....._..x.W...01..r.. ..7_9..xz.0..JP>.-?Q?L.A..!...|j.?..pZY(.rY.......5..H........x.0..'..............Q.s._qc.M.F...F8h!.l..B..4."y..b.W...,f.]s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\gcharQR.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):478
                                      Entropy (8bit):7.561363037110404
                                      Encrypted:false
                                      SSDEEP:12:uSclUIFtMLw9Fn05TisG0SgTmG0Z6A546H/c2J/u:AryLD5TFGvvG006H9G
                                      MD5:8E3AB4FCCB107A1429E0574E841FA61A
                                      SHA1:E6902E1096D6D8D26FCBD8DE6B63D413A19881E5
                                      SHA-256:56D4DF7EB0C2CCB78D3B7697295C03B2003D11DA8C8215B782577BDFD9980055
                                      SHA-512:6A9F328A9BAA7971B435B8D63705A520338251833368C91EC6E72D592C40C4F4644CF718469D921DE05D74495C30913C45FA5144739DED63B0D6AD80E0C3458F
                                      Malicious:false
                                      Preview:....3J.E..?./..b>.x...?..tC.<wNC.5..V..3N.N.|f....K.2...1-.E.v....5......}gm.......,.Fk..u>.......,...[.F$.<.7..........1.D1.....o.4...#* ...!...<.H...v.Yf.2..U.t2@/P..4..w.C.>...\..%."....i...|...K..]I.X.......P.JT>.-2.P....6W..z..E..............S5..H........ixB.$o...Z.........5._.-\.T..4.9.J.gHa.V$.D.C-J.^}m.U.q.\..Cr.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\gr4bHB7.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.514219694869451
                                      Encrypted:false
                                      SSDEEP:12:1fh2s6OsaZ0iWU6RnpoJumG0Z6A546H/c2J/u:dgsTsaDv6RnKnG006H9G
                                      MD5:84C6F5AC5F04E3FEC1E2B0D4A3AA3A41
                                      SHA1:096361E60E579E7ED06F7B49EB46524E03DDE066
                                      SHA-256:347D7A87AD4A5566CA26862D43F0BEE5E78EB2AA6DDE8DEA68C82DEE6940EB58
                                      SHA-512:6FB3A1BC14A7E915D89177B67A9851091231A84C732C481FE41C37CAD1DB639D230B13ED1CD3218BB7E38FEA5610826DC14AD2731339D830A6C3C828ED0E4F76
                                      Malicious:false
                                      Preview:G.;....:B.r4K|U.....&..g.%..z.@....U...V...'.W...F>....K....J...p..;..z..s^w.E.,e.....y)..wg..A.....{.'..<"W$....N...M...E1..".}+x..B%}.j..1....[C...h.%c...<........H\...&....N=..`.^..^w.}.l"..}...+#..^.)..G'.JW>........eL^..e.......T........S5..H........!q./...;E&..X.(.6.{..MD..G`.......k.1..)qu.F.{...A.TL...H.r....r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\gt8VsGI.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469
                                      Entropy (8bit):7.507528496847219
                                      Encrypted:false
                                      SSDEEP:12:xMjizQsGE0Q9xXokQQmzFTmG0Z6A546H/c2J/u:EuGE0QskRmz0G006H9G
                                      MD5:8FBDA56351965D2D97505E827C769718
                                      SHA1:00A923563D338766F90295BCBB0BCC140A279901
                                      SHA-256:BB2BBFE5F61B1E35D266852F3A3551720F07157036095FDB3D38E000205E1127
                                      SHA-512:E2CEA456378984B610C8BCFFD6C45276C469AA569744C17A3302D88B74D1EE97EB9DDDB74BBA1E48D247EC4688C932F15E6B9ADC4321B773C47358EB0804BDA6
                                      Malicious:false
                                      Preview:H....E....1..h.......-.....Ef..I...L..R.....D...?b...=.r.....k._..?/...]..e..W@h..+U.W..Sk[..m.h....Yo..I.JNU...P..nE<...YyHab.a...t.y..>....+o#6#.0......$.ye..a.q...g..V.ADy0..B....M.i...-e........5#@.*.~.U#..]k.JW>.-2.S.....!...p....g3.3.d.;......S5..H..........i.~....+..-C.." .-.y.Yv]..U....yE..d I...ym.PTN.#.VA.OjI.9V..r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\2Gasxeu.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1611
                                      Entropy (8bit):7.8900677537664325
                                      Encrypted:false
                                      SSDEEP:24:26IhLQDyv4RVAbUV52rMdwSM1Z6pw5TqYpqgCwTSS60CwcwIHmPEpG006H9G:ohLZMA4QrMwyGq4WS6vwcFHmMX5G
                                      MD5:3C44D91CCAC77DFC2B800C3A6C3F7C98
                                      SHA1:89C41CF59185FF9F45C11345E4A7D80753AA4D94
                                      SHA-256:228EE1C7098797D8F8DA89F99BE698B569ED0F75FABC56674D6CC1296751AD65
                                      SHA-512:0A5D4BDAF6A04BD00F72C56DCDAA48834D97495F466E44C0B436D5C846D8A03BE9FCD92C2086DA33EBB94F078791A52AA83F7D5975F61F73A1DD64130ADABE62
                                      Malicious:false
                                      Preview:O.q....)-zY.5B*r..w....s:E..._.....si.D....l..R...c......Q...2.../Y......].E.sp|.T.{9.P......=.l...O...$...y@..*...?....7..#v.D2f....rp.-;J.....7.0..;..W.V..b...;1.N.y9..e.E}..,..,..__............i^z.>.`........dd.#).....#..e.,..%.N.Dx.g.5...#i..tG.....a.a.#.6[....H....l0.T.<I.Q..cL.].J...s`v.'..'.'...=...i...........q....<..x..y..w.....:...E+........6k.\."Q... zHv.z...c%........Z-.g...p.+_..!.`...v..Z..g.).U..Ro.x.*H.V....:R...#..9.m.uo(u.\3.{..L..F....E.o...c..........%.,.....!...q.:..6q.t<r.T..........U+.cz..5..r.x.%..Xb..L.UU.M.....l..9..8`.p..[/...P@....0.a[.>.J..-...r.....i.5|.6...|....;6..b..&#....<...nE.s.....C.W....zBR.,N...V.F.G<..,.pM.S...h`...C...-......7..g......U.....z"....eD.}.Vg...2...)_.....'h...0.c..v.N(.&.K.....u....).}Rv.f.).B^1...}...YM.].d7R.~.{.Q....|trD...d...z<^..LM.y....W........^g......~./.na..'..aN..yJu.S..7._V.....2.cs...O.".{@..g'S.q...*.*.QP.n..V...#/C.".........%M..?.*#.d.Vi..........!l.;.K...L.K.My...5..W.u....

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\j9Lz1rH.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:COM executable for DOS
                                      Category:dropped
                                      Size (bytes):457
                                      Entropy (8bit):7.590941815907324
                                      Encrypted:false
                                      SSDEEP:12:tY2Ucs+zYqR/pHZkbmGvJxiKA5QQHCMF6eQ63hyWqBmG0Z6A546H/c2J/u:tW+zYqZpmJwKA5QQHCM6eQ6WUG006H9G
                                      MD5:056DA205689028143C03990A80850A9B
                                      SHA1:BCD46F2529B039C11DC5EA27E0CAE605981E6AFF
                                      SHA-256:C252581351DE443B7265A03A5C95394D4C6CC28BDF92AD20B28578013283972B
                                      SHA-512:5E1439091AA9144AB13CF16129BE06A8DF3AC0AAC6BD8B69A57C463BD1AA68EFD3BB39AD06B3810A18975ED91B875E216FB0B32DB54544394A251051CFA59420
                                      Malicious:true
                                      Preview:..D;v...2.c6.d.E.2.7.5.M..iz..:'....P.N#.......E..a....9Z..e.$.....c_.cw..JH.\B...3R3.:....V....!.c.....Z..d........,..z.0i.C...E=....K.a.L..cvC-..4..#m..z..l..3.O...U?.!..{.,_.vL..].LW..X.ep.*...Q...T+.^..8.J.>.-nQ?..C...[.._../..M-/..9......S5..H......C.].*.....T..|%.;7.....P..v..S.p...O..=.~"Y.O.....&......@/o.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\jFPmv4Q.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.5255909903371965
                                      Encrypted:false
                                      SSDEEP:12:SfpkrwsV6P7KVyE8QqQ635UuD0FPWykmG0Z6A546H/c2J/u:Sh/s07KVr8QqQ6JzOPdTG006H9G
                                      MD5:235EB5B9B59BC383BEEE158DCD780644
                                      SHA1:9A7B54CF986D2AC609606FB3415D14E4D3184215
                                      SHA-256:EA11073DAFFA534A89E8519E7ACEAE24A2C216B30E7996D4BD389C5BD8D51CD8
                                      SHA-512:59879E556C87E60C8D5F84CCCDACAE4D4C3A9B068FF71B0138B6E06FBBA5D48494A0D6D9AC321091FD4D148A326F68EDE48CCED2F9763E2C7A4A1D2BC97EA576
                                      Malicious:false
                                      Preview:...4......DW.]`WG/...pF~.....Q8&......Q........}~t.0...c..s:0..g.......n.7....s.U..?@b.OVq...0...,Y/o5.T.../ ...L.=!....?K>`.B.z..@.d@:k.sQx..WA.g.......3...=.U$..E....M..?D....@P.......#@..R...i.2...]...JS?P.n.P=......c.Gu...}"..).9......S5..H.....1..H......i...N@./..].p.a.s..9........4(Xn.s.Y{...)i]X.5E.{..0.Co.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\jNuLWvJ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):475
                                      Entropy (8bit):7.580947218054865
                                      Encrypted:false
                                      SSDEEP:12:QqSfO/F19AX5nyuhHQBYr6ZKmG0Z6A546H/c2J/u:/2EFwX5RBQBG6ZNG006H9G
                                      MD5:83871B1CE77EB9000D7A939F8CC09B03
                                      SHA1:DAA24E58A3EED5FCA6B373EE0E8D696E6237368D
                                      SHA-256:B324148190B233157442D0F0E6C6C7F8047A5FB8155D4C042C6F379BEA486088
                                      SHA-512:1590122B65553A8A478219622B1234EC7763748621409754AE433D2573236C048C292416BA199A38048C554CAA4D7FF43B569B877B6E9A2BB87B7D3F29EA96DC
                                      Malicious:false
                                      Preview:.b........W...U.".....A.._..q ....5.}...F..x4..2..x|LbP...<..*X.`(e.....#N...m..YZ*/.f.....^.<.gF@............<<.Y.FV5.Uh.f......IC..%d.H...........?.N.R....l{<.J.(q.....d.t..C-....R......).1...q...v+.[....7.b.}.JT>.->.....y6.....B....Y..i;......S5..H.............*..J..s......kv..YVd....~...l....i...S...P..Y.....j...pr.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\jaFfGF1.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):461
                                      Entropy (8bit):7.575222311409388
                                      Encrypted:false
                                      SSDEEP:12:FZF7F72R5pSa7CvDeJ00smG0Z6A546H/c2J/u:FZFBSR7luvDeFG006H9G
                                      MD5:7DC42E33D2D7FCE5F43BC30136656038
                                      SHA1:F12F4420B1D7E5AE75A1AA0B4D499E7A5C3073F0
                                      SHA-256:71C0A472B6F118303E11AF389D40C20FCFEFC4401183632C407321A0002AE0A8
                                      SHA-512:C82CBC017361A74F9BAC8F90553C2C64825FEB2152BEB99745DACD83D9C13112C54355B4079A85A16BBB1942D8C5D7E880A0960EB585094DF9B071B8C7D4E266
                                      Malicious:false
                                      Preview:N..$`9.fI.!1..n..1g..+.rK.X>...j.|W........n..2..Q....;r.".R....mv.<........].{@P.:iz..~.....C.Vd.Rl...8.=s$T.v.....o_..tm.k.1Z=.....F8.".Z.Q..6...."vo..cN........G......*.c..6.)m...&...(."-.M.-d1....JQ>.-3......!..s......0.........S5..H........&..c<..A.+.L..."...4...TC...l.C..|.#.a..k.H.$.H..p.A.,.p.o..'.r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\lti8dTX.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):7.569811512924802
                                      Encrypted:false
                                      SSDEEP:12:prpjqB7UDIwDktanC728yM1P9O+aNqm2oqAbSYmG0Z6A546H/c2J/u:Zp2BQD6t2Cijq9O+a4m/qqSHG006H9G
                                      MD5:E73C820190E3DD34B698A0973DA7B4E7
                                      SHA1:8C20AE6BA4B63634F8B74DD7A6B4F6F88A63E15F
                                      SHA-256:3C5A8E504A823E4168971D0376268607DF3F63BDFFE3C957BC74DC19F899C065
                                      SHA-512:980DD75FE320D00FC387CBA7EF600CD01D16BE7572AFFEAACAD47E0BA182FFC2CD3AD0F99F7547EDF705D429EDC7410EE89D56E7CB8F3A1141D09620344A9CDC
                                      Malicious:false
                                      Preview:.=..r.L.".1...o...kZ....MH.#.7...t.n..Y.3..l.@.-...F 1Q....*......~.............+5.r.O.v.[.(.m.)L.G._....{.c..U....RJJ\S.y.......T\./%.7.p{`.k...0_C.....U..b Mm..\(h. .Y.&.vS".j!.6a.|..|.W.....Y0b...JW>.-nQ?..E..*.r..Y?..s.3.........5..H........x ..h.z...f...D4y.\\..g...Q.|..Qi..X....oP.|?.ES..&..EAa...^.s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\nUIQvjq.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):438
                                      Entropy (8bit):7.485696879455824
                                      Encrypted:false
                                      SSDEEP:12:0VUbT9fvRlCaGKbk5QZZ0RbonqmG0Z6A546H/c2J/u:KUbxfLhk5GeRbaG006H9G
                                      MD5:E06B2A69B5576778F58CE6849DBB9576
                                      SHA1:DD4E47E72B0E5B8493795A505F459990AC26B757
                                      SHA-256:1CE336F153FEA1AB15EAD12E77B8F41666835ECAAA0CBACDF4BF5ED6CC0A4D85
                                      SHA-512:8D8645147EF82D54618BEE1C8EEDBD5AB06681FC383379255B5D6155C38EF49B6BB9EF4DCA45476031FAC0AAAE66C4BDDDCA54E737EA5717054970C57306DE6D
                                      Malicious:false
                                      Preview:O.B....t*H.f..~...RMu.5.{/>.....e..<%../....d.-f........~.....n.?.KOuWD4...g.FU..w..).q.9.G.y.w...2vZhJ.qt...b]..[B}#8]../.K.....C......_}..y. u.g..F.:0......9.B.j/J.j.k9YOG...zd....G.J.>.-:....{.eK..;M7....7.&.........S5..H..........E....rY."......)..8..._ p...C~..Ui..j[..b^....A....+A...NG.r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\nVct0xv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):468
                                      Entropy (8bit):7.541961841525549
                                      Encrypted:false
                                      SSDEEP:12:Jjae6Fb0rPdNA8NzmHvwoNYvmdA9PqumG0Z6A546H/c2J/u:JwFb0rT9YNNYuu9POG006H9G
                                      MD5:4434965924E9BAEE8A4E00109B8C1DE5
                                      SHA1:1A971EB00438B82B1E0F77B117F97B079AC49BD0
                                      SHA-256:AFB3B2DE26259D966B4E3DE04DBCACA0394A8C6BE06ECA7DFAC886FF1A8641E6
                                      SHA-512:96A9325A84541643A04ED64910B46DA2BD3CEA9ED97D40DC8D3E1E1137CF3C12916B70B23C0BF52709ED79279BC04F7F84C9555621962D3481060516EEC4673A
                                      Malicious:false
                                      Preview:...t.......P=e.N....).Em.ku..4d.;.X?...\.,.RX.@...w...}..>pn... +..U.....i...q.......<.e....:C1C.n.n8.-..8.vs._I."2.....;|.(c.!..P,2...PPm~....P._..g....X/Aw=.Q......evq.H8....fO\GS.QH.1?.#...U.Zl...~\.P...............J.>.-?......!...k.L..8..Y..19.....S5..K.......<.{.Z....."...>RN.Yt8...Y..T8.~.......Q"g2..A.t.;..8.L..6F...3.q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\oGhtuW1.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):480
                                      Entropy (8bit):7.600145968695182
                                      Encrypted:false
                                      SSDEEP:12:uXpS6t7TtrkUNH7zsBgJmiRCmBCHmG0Z6A546H/c2J/u:gDPtTAqoAx9G006H9G
                                      MD5:691FBF37636E4595DD2DAF789F95325F
                                      SHA1:B4C1FB3DE8BCED9BD82DD8503A2460ABD2C64B92
                                      SHA-256:7845F3BF27A9BD182A590009A891F632FD59A7E518080F5A170150565C695B6A
                                      SHA-512:A36C7854517765A1613C8156C57332C5FB3F1E8C306A99DF85394FF62C038C6497D67EA6F317639CF7BF6C0C6CD8FCB10154884731FF5923D0E6C9EA93456A31
                                      Malicious:false
                                      Preview:d5Kk"..+*,az..}V...EO..Y.'.?....C-W..2.-.L.,O......26........j...~.'.[-...R.. ..4O.^.. ..O` ...&5&..Wp~6.!.9.....[y9..;`F....8.$B..A....K'..X..j..!.kC.=.eB.Y..MSN..R.,..khQ...F.6a..h.H..o....(..L..C......*..Z....=.%.@...L.J.>....8.....>.........Y..i;......S5..H........7....8.J.#Z....Pm...&.A.....rI...I..!p..-.....V.......":......r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\qn7YXsr.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):253
                                      Entropy (8bit):7.149661212888845
                                      Encrypted:false
                                      SSDEEP:6:qsiHa6D7NEBH1kg9cC/6jjEkAY9mxU0ud6687d4046HIhKcQNJ/7pk:q5Ha66BVkgN/sbmG0Z6A546H/c2J/u
                                      MD5:BA50A23F7FA8EAD343E240B4043A6797
                                      SHA1:414F8A0582A50EBE4A23BC79D067C908C89AC4D1
                                      SHA-256:0C628D2B2609547DCC25A315DB7599A5DC973E7AABD4AEF8AAE8B7B5B6C15321
                                      SHA-512:7848204C9493D66DB90BE9A7A12931B7F5731F4ED60C975284CD042E41026D8EB37AC07DE7735A661F494E8E129B502F5CE3FA53FB6797DC0975AB06590694AD
                                      Malicious:false
                                      Preview:........j..}.8.y.a.w....J.>.-n.N.Hq../..~..&.......9.X\b/...O.*..O..N.^.....<.......g....>yf...,......T....N.@.Y._.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\qoPsfmu.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):481
                                      Entropy (8bit):7.575054746999057
                                      Encrypted:false
                                      SSDEEP:12:vrOM97Cl4bYO1ZsvUypS31nvqtbmVphyskqJumG0Z6A546H/c2J/u:DOE+l4kg5gS3JqtK7QOG006H9G
                                      MD5:CFB1FD0774670C9D308617E081084616
                                      SHA1:F6F4319078BC4AC7C8AC44721031A7592DA52C97
                                      SHA-256:9DCAD8894BDDADAAE8C6FA16B400F91C6B86204CCBA781A8404BDD0CF1733EE6
                                      SHA-512:99EC63A87B425BF93764DADB48E1A4CAD160B7225E4567EBA4962CC8DD278C9A41E92C20CEA1F2BF2735571ED340870A044BD74C3EEEEBA46D3A7FC324B3DC72
                                      Malicious:false
                                      Preview:x./l.bW&.P.6.Z......5F.......w...._s.d....5P..v.kV."..y..,...R...F....yp-/.Ta..Pj.;...L.[..R$.L......P.61kO....H...x..7'......o.@..J}.N. W.z..i..Vzfd...;...D.}..7.8..R..5.{C...#W...3*.%..Ir....%%.....n.!`3._...._X"0v.J.?].?.R4.o..N.........$...9.....S5..K............!.b.O.bX...MJ.G...\.$.)..i.W.i*.......:.Yk....`JA..b..Aq.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\rHKkBYM.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):445
                                      Entropy (8bit):7.543892139664288
                                      Encrypted:false
                                      SSDEEP:12:e8+lnhrVKLPEnwkImsihamG0Z6A546H/c2J/u:eRln6L8wkBsibG006H9G
                                      MD5:6A6454CA0A9928FEB5C184E9FB266EE6
                                      SHA1:FD1FBCDBE6A55BDA267454AEEB578E21ABB0D6D9
                                      SHA-256:66B5FE8116D0A19CA3FFE010B4F3C308D53F1E5B69F942E7DF30004B2E884672
                                      SHA-512:8236C6C6EA4898A9B4C8AEB397FBF896E69D27171A945B757274AD8A8F1372EA2D6DFECF96825C50E0044CD5DFE9ACB93681039B4A5051E0534759A390714E7D
                                      Malicious:false
                                      Preview:.....*V.+k.........y.1uw.....Z..}7..H`?tz.EX...(.Rs.T....F.A..|....I.pv/r..".._L.D..sWP...[Z.W.`"..@.1?....)...R..g.g+...8U....#.h....|:@......$<3......kS02(......".|.{Q..U0..$~..p..$q..K1.J.>.-:.S...}>..v.....*...b.9.....S5..K.......7].LA..`q...xp.'.IT..*.(.T....G3kJ.T...L.'.v"..HD....M..64..q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\sPKDWvp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):462
                                      Entropy (8bit):7.544218943099297
                                      Encrypted:false
                                      SSDEEP:12:5yEz/zDl/wH4DsvQEoVqzmNPMwJL1dmG0Z6A546H/c2J/u:5RrzmHJvQEEqiNPMwPwG006H9G
                                      MD5:CAEAE8426F5AB7ABF79704ADFF288521
                                      SHA1:746E37637138FC1531D12D0C7CEA161B933D4F9D
                                      SHA-256:449A4CEA64F603F7D5273A23D8F98C492BFF40EBB002F6126F6DFE720405DFE0
                                      SHA-512:545F05A651B00A75D625D530FD449325E736645F5F921D1DE13E72270D0A2933EFB44680DAB4C911967BF9533C5AA3E6BEDC1D13179A7047322027814BD3DE1A
                                      Malicious:false
                                      Preview:...t..b.)...K.F...p]....c.X...I^..hE.u............f..=.S.W.h...e..:Yt....m4~...Z<..V.....i...j.!..7..E.1........n..x.Z)...x.3...|/.".j.~-....'....U..Hf^.r...E....'d..=.:.I.(.}....y..}.K.....&1.K...J.>.-8Q;J.F..:.X...$>.}M.6o.q9.....S5..K.........F..0.' ..B.Cm^.).....7....^...R.h.j....b).~O;,.t..}8..NL...q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\tEFTxVI.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):455
                                      Entropy (8bit):7.55625449441847
                                      Encrypted:false
                                      SSDEEP:12:Sass8uawHufN1lBJ213OUIhcc7L47umG0Z6A546H/c2J/u:LIf374F/Ihcc7QG006H9G
                                      MD5:243F2AF4775FDBC4AAC30E0097FB8156
                                      SHA1:9A3E77231AE3146636CAFDABD4C92967FA89C8EF
                                      SHA-256:BA47765553E3B21506B4EA52C0CD9232EA963FFA462FBAC621F8EC4DDF6E706A
                                      SHA-512:4E2713E8CE413071F47DD34BC0873E077844455B66015716B1A575BE73B0EFF4674F1C3D1A70A9E65E5ECE215204922361A5881C47FF5399A7A59572C74E7321
                                      Malicious:false
                                      Preview:K....Y...f..q....c...7.a..T..h2.*D=.rQk.#.....&...eZ..||..}..v)J...3......l..iM.^)...g!...]...z.. .tl.Qk.t....I....a.`.N....&.....<Z .&vP9..9$........Eb...6Y...C.}..in..w*ls.....<.t.?....t5E.C.e...{...JV>.,...9.K.........S....9.....P5..K...Y...0..8...mG.i....s...g..C>v.@....q.....to.....$*_....|.b-2Dm.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\uJ6jD8H.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):440
                                      Entropy (8bit):7.538973180762649
                                      Encrypted:false
                                      SSDEEP:12:InLHzMiHe4aDGvh9ArfBXmG0Z6A546H/c2J/u:efmDGvHkQG006H9G
                                      MD5:CEE6D0057878D33DE86F09E5AC4F9BB6
                                      SHA1:BEC2A392722E8B8851C65D105868F7DCF007F3BE
                                      SHA-256:2AF9E9379344AD4E088F3F157CA66964C38C4A5E892A7EF9CA24A57620B75367
                                      SHA-512:6170C1439A12BB20EC5E0FC34F026055F27EB5854A2C01DDA66ACE65897836294F26B24E46464BF917EE38C7D5866D63F0086F59E0CBCE3C81757C866E993891
                                      Malicious:false
                                      Preview:...N...zyB:.,..?....^.I(-o.m...f....}<``..D.......".r...'4.....T..bk......e.A4+..;.-....YV........Ps|......2...../.:...].!..2.l=...R.+?....+....|...?*n..6.P1..wm..VQ..R.B...].r.b....J.?].=..4.o..I.......s.'.........S5..H........C.p[.<.gy)....r.d......J.`..)..Oq.~0.+..l..E..N....a.U<.x..r.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\vmFo30S.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):461
                                      Entropy (8bit):7.547604524173255
                                      Encrypted:false
                                      SSDEEP:12:I6i4upfRPaeneeGfgNPE7Omljf7yyumG0Z6A546H/c2J/u:Ix48RCeeXOPaljf7pBG006H9G
                                      MD5:07F3F331EFDFB9F50A73EF1DAE967B9E
                                      SHA1:7224DA28CEA97670B5FF5631DC1AA5563CF94233
                                      SHA-256:C8AF69FC5BC3E250C13754F14D229CB50CF938DAE8039538581800F9DB910DE6
                                      SHA-512:44DF93F83656B1E8F3FE4D5AEEAD03FF994EAB5EB69343B791DA53F7E882B62BF508C763DFDB15FEED746682FFD8BE91EF275A41D9240A836386B45ECDC5943C
                                      Malicious:false
                                      Preview:.....E2.I.8.RS..@..`..6.Y%...Y.........#.......ix>='T.5F/..jg..xb..e8.....x...C.v'.....G....p....w.N[.09..f.zX.v.X....p.b.....q].K.1..w.o...T....5..3@.....a.....m..-f...^.....]..Qr..|ue..>..-...Nx.....&.J.>.->~.8.o..K..O..D..w.Y..q9.....S5..K......."<.}...K.+.:{...$.tJGs..m..]XO..y....Q..h........F~".US.......q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\x8cDxOV.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):439
                                      Entropy (8bit):7.52463814345395
                                      Encrypted:false
                                      SSDEEP:12:qqe87sZQkOMnYyUG/xln/Imdsy24u3RmG0Z6A546H/c2J/u:q0sZQRbG/P/Bde0G006H9G
                                      MD5:D234B5DDAF9E5183F25548088CD585F0
                                      SHA1:D29F8B1ECC4967D381F7BD98AE77D4798E71B655
                                      SHA-256:351A8BA8F69209A31BCBD68FDAE0AA5899DF1403C43B48E3E088C4CAF5842E57
                                      SHA-512:C90D1176E52B342B2F369F33EFE5A39B94DDB97802EB71F1AD7A456E4FAECA8ED7374881637477C687AE04D72732FC73BB2B8045DC325CDD739459D81EC74771
                                      Malicious:false
                                      Preview:..Xx..K...n....S..8.fn..`..:.6....|.5.}................N.F.o........w.[.".6.6..;..P.^.._..t....<......B..1..k.g......qf.7..6.Y.E....~.54.R..J..wr.8.0.@..l....!...n".......wP.{_.u....JV>.,H......'I...F......Y.b.9.....S5..K.......^.}.q....C.!.J.h4^.n7M.h.T......2..b.UBJ..v...+e~.W.....c.g.q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\yoooq7Q.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):467
                                      Entropy (8bit):7.572013417712198
                                      Encrypted:false
                                      SSDEEP:12:+ipqrYkXTveqNGzCURS8SVjevmQDIY2lmG0Z6A546H/c2J/u:+ZqqxURSCuyIbIG006H9G
                                      MD5:938BB624B305BCE7786BF3634BB341C8
                                      SHA1:41B532EF0AC9340CE2622EC73210FE34A6EE93AF
                                      SHA-256:F19A8B3D416244EEB20B40104AA6020B8A26375EF3B464CCD26F48F526E2571B
                                      SHA-512:76547130AD97AE154E3C788B97A3DD02BD74DC4BF05F6FCD5566A89CD48B8F5C34165ECD2AFB68C9333A29E39D8AFFBE89D56CB0230924B5F1FB23C49ED43187
                                      Malicious:false
                                      Preview:.r..c.$..m....-;.N2b..Y.IO.....d.IEu2.z...a....,.....o...............wT..).6.a1=..8."w..hL.1.JA.2.,....[.me.7......a......U0..jv..^...`s.F......{.b.......!q.0)4.T....@;.uu12...[..u.v~..M:..)(.+?.t.`...A....m.T.Gp.JU>.-n......&...F..D.q.Y..19.....S5..K.......Fr..s..N{.!.Z.{.=P.U.+.Qk......d.@.l.....t.o.9".rA,..!<..U.2.^q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\COJrqAg.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):253
                                      Entropy (8bit):7.1429042723965654
                                      Encrypted:false
                                      SSDEEP:6:od/6hHk7NEy8seGswq2CRvYAY9mxU0ud6687d4046HIhKcQNJ/7pk:oAykamG0Z6A546H/c2J/u
                                      MD5:B55DB97663A66C09247753650E64EC73
                                      SHA1:FFC8C3066F1DFCE93BA8F0F3927BAE4421C5649B
                                      SHA-256:E94B52D8456D1FA45101CAC202EE49E4489EA9947FDAE8F2FAB32DD4925A8B12
                                      SHA-512:4C30E5F278BE8A3EF30D31D3EF6E2A96FC4D9F37940BADD3B3BAA878410C5E96A3F939ABA9A8E3BF6B28B71577A0714C681C5E2F56D14BFF0B2619CA1F3E2718
                                      Malicious:false
                                      Preview:.\.y.ee55WZ...U"ZZ.{-.5..J.>.-n.N.Hq../..~..&.......9Pw....j.Z\k.4+......AM...0..<..Q..<.j.hU@0R..&....ov.........3_.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\L8t4FHs.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):291
                                      Entropy (8bit):7.300900375448885
                                      Encrypted:false
                                      SSDEEP:6:nxIikK3htw3TYcIPITqjDXAY9mxU0ud6687d4046HIhKcQNJ/7pk:xIZktZcIPIGmG0Z6A546H/c2J/u
                                      MD5:D404ED2D88DEB2F3197272DF16A172AD
                                      SHA1:D774D8DBF6AEFF9A6FCB607B0C37B59E2DDEBD76
                                      SHA-256:604219E5E3782CDDE818F816D8822A60B83D5AC00C538C8B7E87116DC35996E6
                                      SHA-512:BB7DE56AE250AF54589A581C6A3B4C07B03AD8BC91D6F37E410A69B4325C9F164F3BCC2D3CE3D6A31CC41B31681371B7469E86395C27BC5AADE2FD6876DEDD3C
                                      Malicious:false
                                      Preview:....G+...o....Z%...P:/...$...,2.x\..|.>)(.....E.J.>.-&.D.....:.r...Y;.......9.....P5..K...=.......k./W{.....S...O~.;\y>!-.T.....j,.V{.. .V..i...TU.o.....m.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\2sRV6ry.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):283
                                      Entropy (8bit):7.186806940731848
                                      Encrypted:false
                                      SSDEEP:6:QaTFk4mbTk/S6surUhiYVtqY297AKKzGPAY9mxU0ud6687d4046HIhKcQNJ/7pk:QiPmvk/1P6BCYasGrmG0Z6A546H/c2JG
                                      MD5:B2F234978C109259AA2C5964EAD3EE59
                                      SHA1:928E7779B0B8EAAC532597DA79446C8E308A9755
                                      SHA-256:AC2B2C6541B172EB3738B5CC263E22CD67BE22D4B29A50113059A3551728B14E
                                      SHA-512:1AC4DF56D1A485CC33B8AD4AE30F379CC54E64E19C11DB273C7B04E18146FE916FAF60C27D7DEF6FE40D8416BE591DA78B158FD33DB06839FC0167C889B28407
                                      Malicious:false
                                      Preview:.Kl]..x...Y,.R..%SN.....2Q. ..C:Vd.}.....J'>.-B.p...D{"..NX.V.&.....k......S5..H....J.....{s54|,....p.tL......9B..&q.g..9....>G.*I...&.B_.|..c..yl.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\JKrR4Od.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):520
                                      Entropy (8bit):7.638796023791725
                                      Encrypted:false
                                      SSDEEP:12:kRcXtj2KZjXGt0nj4cmsYPvQA86AqQomG0Z6A546H/c2J/u:EmtdjRj4Q4AVG006H9G
                                      MD5:FD9E010ED85731A562024EA7231896DC
                                      SHA1:A1CE6C31B6DF3223E9EF0546B01FDE79E03ED5CE
                                      SHA-256:B625DEA65E25F5894B63A6DF488F36AB482C2DDF0FC351F36793ADAA5DBAEB51
                                      SHA-512:178B44B6C8DB8011F07F5E718F11ACAC31990F21A8F937D7167F8790D6829E999D4FAA3BA3C2006C7DC92A930A436226CFF8DEBBA40E4FEF5E22F8235F1BC7BF
                                      Malicious:false
                                      Preview:....*.<.I.k'....HM?...QKDF..J<b...`N...~...5sai.....b...-_.{...C..|......3.E1...1..Y...!........8.`.<.BTtn.[.......d...2M..}'.j*......0.1....Oj..J..L#....7.3B./&G*o.sV.)......a~.FRD.Bn..=."j..*('.f.C.y..g...c%..&...B.(k..B..<.{.B.ol...8..(.....x.Yy...G..k..._...qM....O.8...e9g5...EW..w..J)>.,..6!.s../..~..&.......H..G*D.M....#....&...;.1......z..Z..:.^....D..;....57v....[.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\tzcOGS2.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):248
                                      Entropy (8bit):7.11263425184774
                                      Encrypted:false
                                      SSDEEP:6:+Zqx9+j2/GFXaPhBJaiYAoOr5UAY9mxU0ud6687d4046HIhKcQNJ/7pk:pxR/Z/aiYAoOr4mG0Z6A546H/c2J/u
                                      MD5:85FE8AA615FA78F77898E7DAAA327C7E
                                      SHA1:194CDD5A372F5A72550D6DADB98B860DCB74F9AF
                                      SHA-256:04CA0B3D1AB244AC5D45E507DBCB99B89EB8A86C4E9487FF557E7BBACC2BA6D2
                                      SHA-512:196FCE0EEA771FF05DC0CE300035988F46357E87384BFD62518D96B089ACD3B79767EE32BA043A8DE51B94A541B508DC1D045A6D28E469E0A9FBD4ADC8903956
                                      Malicious:false
                                      Preview:f.....S..SJ.R.J..J3>....8f.'../..~..&.......:...].^sn+F:..I4.'...r.....l$oe.........h.c.u...f.-|...."M....o5..b.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\jPrKgbM.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20712
                                      Entropy (8bit):7.9913487931047404
                                      Encrypted:true
                                      SSDEEP:384:dWs+0tDdxxRkrQRlD8hXlDQt4vEowIFl4nJo3c/xk9CN+VI9GkETm:os+0tlR7z8VNQMpnFOhk9Fqom
                                      MD5:C2278727DED22755D4A7C4B88E801678
                                      SHA1:C1D9C27A6FE874EF88CE1ADC3734BFF799482E72
                                      SHA-256:A0B7BF941280566C874697B511A7184202A03F9007FC8AF6018AA92D91212F7E
                                      SHA-512:2325C45E54969B19E3A1F62C02F4FE8C61C0B8B1FFE21A4F7DD35B05866DA677E508640673A007F305EA85652942C1E7FED1606282F55C15097EBF7E1E8A0EA1
                                      Malicious:false
                                      Preview:..RP.....M..... ...'2.a.u...._...yX.Z$..3...u..p.1^0*.<.~ ...j..D..p.Jbc.);zv.3#[J%.T...zA.gs.g..vrX.0`.JQ%...z.]....L.".6.~..i$).M4.3.......W.UR;..>.9....(K..WQ...]'....O.....v.Z...;o.._..... ....F.!OjcR....A.l..5..4.Bl-.{P.\.....z.r.lLZb. ........ .!i/.-@.Av...t..*...~...F.....j]..n.+j..z.....V.uC.p..-k.H.[Li.k.u.@....8`.@jW.....<.\....A...3)..3!.I.z.~.5.u.i.....79..qS.N..Nj.|. .[.J..4.l.}.B.~.@.Qmq.}H.M.f..D.......Z.............G..8}..M.e...P..,....J .6.l....sD.#....A...;.........2..,..\T2........%n!....<....?e..q`..,......k.....T........7.. \%1.p......u.0..k8.f...'..\#..pkul.....%.......Ic..#xw.......Iz.....N...V5U....!...M.v.z~../.2......%Z.W.3.......55.....^.4.ll.;..........g<..f....5......W....N<tQ../...6........7.N...:.%.Q.X....Qo.a^.U..|..x.Z..r.....G.bfY....a...J....S.|V*Xvz..L.c....|.....D..).f!..+W...-:.@...@...T..K^.P.<p.]......V...[..@..XjQ..:QQ...Wa...I..9$x....G.3c~9.Qs. rZE.W..Zv..3]4.G.C/...n..\.${.8/1.!`.].z...]2...q....v

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\jkBGhsH.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37113
                                      Entropy (8bit):7.99459523058844
                                      Encrypted:true
                                      SSDEEP:768:CeUZo9SrUvdRbkUWc0IZv8eIRplfNLJPqIfVjC:g6SrUvI25BIRpz0Itm
                                      MD5:5B787CC1D5E4C2CEA089426E07804703
                                      SHA1:00B731B891C55C2ED6343B78EC3115B72B3C8FB6
                                      SHA-256:BAF901B460CF69132BD9FC2CEF851AC0F23069732EA566040E7CC3172836E049
                                      SHA-512:9DEC279986CA418E664A04A0068171B9C60D8CCBB617D818F50F64B291D5FCC2BEBBE6A89C4D5B18286D2610B76AFE9A27D08AADCC70A24C28DA9B88176A5848
                                      Malicious:false
                                      Preview:.D<i.]E.Q.~F.u....C...r[....X...H%&j.?..?..........&.?..Vg`.....}.\..=z.a..D....vf.c.7.cj..B..#s4.4..... .ih.b..#....K.XZTS.X.pi.".|.k.y<..H{..j"......q...xF2...h:.}.v.J....S..KM.RW....../={.#6..=].K.<..@C......s'.I.Q../.d....Q....u..\.ZD..o..._.[........m..;.g.....R.P4.u{.. {M..4g...k.....M.>c.....S....e...[..{O.....l.4D.bQs78}.9g....-......X..9...u....Z.Bd.},.k:.hH...t|..T..R.,O).pV3..n.._|"....%...86.....w.9L.5...E.........~...".e...P*...?..-.4$9.........'@..6..i...m..h...;.|......w....ny%.\}).y...#...AB.7..`.......<3n.}lK.....S...s.}.,_.......r.e....-C8....1.....4.+.Q_...4].|50........R.h*.].....K.C.`.......v-.{c.\..(....q}......=#....F..V.Z!6..%....B..8)..!}.b.^h1...8l...4...Ek......H.E..@..H....g.po..e..F8{k ..x..y....T.+.Jp...B......@.Z.Z_.M...JU*....G..Y-C!)[>.%...e..5..].`|.!.....-L...\..,!..|....:^..(.....Jx..Pc....&.b..A{...z...<,..x..w...(q.BB..G.m...K.'u`C....8G....C..X....4......4C.....2...l...=./g~.^..\H{4..Y...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\y4C6OG6.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):657
                                      Entropy (8bit):7.681879201028398
                                      Encrypted:false
                                      SSDEEP:12:InWF9TQkUUh2J8KuL9pHUphzjdTjW2Flk8WAw+erkTEttumG0Z6A546H/c2J/u:5F93kphFTjWN8rwHksG006H9G
                                      MD5:BF4C2CD262541E44159CC0AB8974AEA4
                                      SHA1:2EB79E3FE050DDC6DAC857E3529ACB7EAA342A64
                                      SHA-256:603B78CD5E5B6763BD5A30B833AA6CFDB8E7B0194AE6FA26DCE7B461D4482B8E
                                      SHA-512:48F497E5008507EDAB889A404AFA08FF53B99DFE9869DF92576D4B1029A5626DE8C43B026C156C06203167FD3C1D13672F120F424D0886D210612E65D3AD2B87
                                      Malicious:false
                                      Preview:....Q...M...|=>.L2..`{...i#..K)....&..Oe.%.|.`.....A.....:.........We....J...6s?.j^&V....<..#...?#......J<...M..........c...W.Q.....Z.%.i....o..,Ic..i.<Zc.....f(a..>_....r......."..Sw..m..j..3...5WT...4.%.....3.f.|B.lg.....8..(...HL.e..y2...E;Va....f.........N.InTG.j....AVp..~%a........(..o...g.iEj..I.0..A.).>..c.JR?ce.)w.`....{.-.b..C.. .J.t..O.......T+....(..-R.&,i.9...xG>.J.>.-|.Y...D.".#_...g....a......lQ5#.H.C......x.}......w...........{..i.8...L..............g.q.....x9k1..n.....y.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\1orZcXO.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):283
                                      Entropy (8bit):7.3063562658235774
                                      Encrypted:false
                                      SSDEEP:6:QcFF9ya6surESLoMExQlXf73AY9mxU0ud6687d4046HIhKcQNJ/7pk:JJmP3FEx2vPmG0Z6A546H/c2J/u
                                      MD5:2C3A101A1CBA49CF98EBACA7C1FE4DA8
                                      SHA1:F5B030FDE828D8BC0281059B47E08EB87BAE2560
                                      SHA-256:9B7D7D04AC1A1812E6DCB3121FAEC4A3810C0E1572F590BD701F3E8055B65532
                                      SHA-512:2FB81DC597D91F0BFA6C26FBAF25377437AD0989CA29EA151A87D76BC22D67C88DF269391971C630969E017491E1401DA74AAD59833059218AD8BE53F1B7395F
                                      Malicious:false
                                      Preview:..?...!).bi{.7.....ghW~#.a# .<..6._.....J'>.-B.p...D{"..NX.V.&.....k......S5..H..).w.z8h......Lx..........hgja.....H[2'.n..^..a..f.....a..L.P.l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\56pqryZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):508
                                      Entropy (8bit):7.537848147759561
                                      Encrypted:false
                                      SSDEEP:12:y5UDx4JRPF489GPU88W8IKdAVjxmG0Z6A546H/c2J/u:hN4JY89aX8mEG006H9G
                                      MD5:BCA220DB80C22D9525D6345B49AC8006
                                      SHA1:A0AA93B2A6DB81FB203120CF4019A60D3C0FE5F5
                                      SHA-256:E6130F618743DA73F6C1D9A88387F0F08843603B21C87520EE15CAD7612AA5D9
                                      SHA-512:9B3B9A71240BC160120A00F1868691216414D8B68D0D8843D94D694FD3E56EE45EC5A9DC593CA50CC653EFA8083F33CAF0FE88EA487305C846CEE3FACA7E6910
                                      Malicious:false
                                      Preview:.Q....P..%....../8W...z...Sj...Wd...:f..>.6.\.z.z..R.[O8h)8..0..QeU..)N>.m.X..._{..F.qqX..J.+..nuef.W...........2.QU4..........8.)|....T.D6.Z.d}.}..r%..Y.Ff..).F...ZD..2..X..U.FS"9=_....L.7.........".[..!cx...]g.t)......Ld.h....V..#;+=.n...J$....]...y.B9.[..<.X...1..J)>.,..6!.s../..~..&........(h\.....(...H....a....K.e.......E..d..xAr)....0.qA_.{.87[.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\PhOAJCY.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):248
                                      Entropy (8bit):7.1726901106766965
                                      Encrypted:false
                                      SSDEEP:6:Wy5rj2/GFXaPS1dN8o3gHvAY9mxU0ud6687d4046HIhKcQNJ/7pk:WKc/6NELmG0Z6A546H/c2J/u
                                      MD5:9848C3ADDEC01AE8FB3397597A9FE359
                                      SHA1:5547A8E5564DAC13F9A871D41C3E37C0FD295CA6
                                      SHA-256:BE7C7509B83F55848AB0E191F0083E3A301B84FF1955A32C3C4E648CB768E8C8
                                      SHA-512:95920048311DDDC81C46B8B833DAB0B2F7AF358FA51BD81A296DBD3521D074D34609F2348D79C362B9943A86F28C8EAD4B356D4505D7F214813E8452236DABF8
                                      Malicious:false
                                      Preview:..yb.....]^.P"".J3>....8f.'../..~..&.......:.....h..;..q._.m..\...&*$..=...j..V...g>E..{..L.....}.'...H.b.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\tZBJCOZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1382
                                      Entropy (8bit):7.8655159110720065
                                      Encrypted:false
                                      SSDEEP:24:o2tojfagP1hau5x/OGN5Om5EX2cg8m2zuTNhUabTuw75sTjJEshvZZEICG006H9G:rtafagn95Q85nCXgxhTLJ75s//tnEIys
                                      MD5:60DF5BA8512C06A3168B54571237E2C3
                                      SHA1:39A831FE981EED2DE921423E97209A8FAB803D40
                                      SHA-256:9E488EB090ED0AF22973DF38C3FD31F007B440995A37AEAAA0CA49394A2EA934
                                      SHA-512:D855C66F3FA313BCD160E7180B15EE541E8E1A48488D9E7731146CE883CA88CCA221EDC4B513D9B279AB09DCB3A2F77BAF8DDA967808D2B812F67C5A18741EA3
                                      Malicious:false
                                      Preview:......!H.j...T..W...v.2.:/. ..<J)?p.J..M|....M.F\n...~I.4.=l..'.._.h..J2......!.._.P.B.k#c..I..`X...!.\..h..`..D.......C.......mJ.z....t.}P.f..#.=....D.X7....HL...~._.....6..h..`..N......gB.25....>.C.1.[.b..C..u.Y{..?hx...oo(..........M{....>.j..s...3O.d..~.....;.t.UT.i..oFTLH.Y.-Y.]...g{....}.....N..G.=.SD.7Q......r.H2.U.kF.%.:.n.....N#........X..|....W.._7.m=.ZL.....$.*,.\...`.2..&.z...op..~...?.2.6.08.$.....^[L..,.o..j...k:.A..Hv.JS;>.6..e.oW.t..BGo...J)G..+k7......q...!...b....3yz.o;.p.....j.N.M..9.T$......~.s..>..a#|. L4ClO{Y.7T..,+....].{o...y|........QEQ..2d&D....+.......n.l.v...u..6.+.#....A.{...B.......A#....G.z.C...j.....W....k.D....jUM.x...;....D..q...@.2...;.T.X.....I..)...h.......q..T..!6K....`+.~.5....(.....f..+...N...........g.T..../Cf....L...:.4.w.h\/...q.ZK.Pao.L./|..._j..;..8.>.$.a.c..q.k.m...ajo.A*...S@"...`......3....G@i..KpBD...7d3.x)X....3..%..v.|\i?..dh(.........X.}?.#h..^.!:.7..k..=k.f.l.,rvH...........2

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\ca0de642-e44d-4129-8663-34e9690767af\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\iS857bb.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):283
                                      Entropy (8bit):7.25783120034354
                                      Encrypted:false
                                      SSDEEP:6:/713ovHS6surx5/kDSPXJKvjsi3AY9mxU0ud6687d4046HIhKcQNJ/7pk:/pyH1P0DSPZUsOmG0Z6A546H/c2J/u
                                      MD5:3D373A2C571D934769D748EFB8DACAC9
                                      SHA1:1737FD120A4DB9D79BA25820348BD9B10ECCE367
                                      SHA-256:7D756878371B56ED9D93C733E90518A519E6DACC6E08CDF6CCEFBB5F58FC547D
                                      SHA-512:1B840E8F23A7D36725FEFB82261B2228AAD1B77237E0984F74B3F7F76A7950F6581267984DA04E59133B9769E4FAC9EE6E3FE3DA091D6B46C4EB313DC06CB4B8
                                      Malicious:false
                                      Preview:%...i..+...g.)~V,.T.I..-..C.45..:..B..Y...J'>.-B.p...D{"..NX.V.&.....k......S5..H.....3^...=.!.A-.....eUM..[5....7i,....-6.RB..._.h...f.;#..R.l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\tg6EwR0.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):131313
                                      Entropy (8bit):7.9987457283949315
                                      Encrypted:true
                                      SSDEEP:3072:SaZRdXglBtURw5TvJ0lwmXLTPKGwUZgdu+dnDg8G:bhiykTh0l1LTPtwUXsDgH
                                      MD5:AEB3DD7E59FD9D5489A2D2A8B5ACFCF2
                                      SHA1:918604A89DF6BBC15D8E59FE2A039FFF942A0A13
                                      SHA-256:6E3F21939DF17A201981267B2E1006128AE77AD197AF45846870689AA6ABF7B9
                                      SHA-512:2B4A38DB1C074284FA9627990D8BE64B5BC43773F750CF108F3DF62B33A1F755D63AB20958CBCF10141B52BB31B47EDB2CC3588239C863F542F3B5478C8C1137
                                      Malicious:false
                                      Preview:.(.q..J}....W..;...+..@...T%..B#...f..W...R.l.e.4.c.......!.E.F...%"{.X.$J.....G.q.....0.P...qv.9...=.=.%...FVB.]%.a...... .^...Y....g.....Q...)....)..8Y......W...4..Q4IKY...5.5....d@..^..M.......v.O^.C..x.2..S|QQF..o*......y.......:.}....U..j....^.5.R'^..p..a.J..#...U9...T.?^....]PM.4......,F.%I....J.>....t...>m..C.b..............+./a.!...ZQV.#..y;".(rO1.....O..Jf.....MZ.v.[Z.bI.X.b....)(.....U.._l&p.r.`...W.Z........QZ...>..|..........}.U}b......3 ...t.n(4^z...x..8.P....Q.{.2.,..\....#..p.q.g.s...w(..d.V\!.L..^.vF.h.PU..U9.0...S.g....Py.T1..0..U.$.R..Wj.6.4._"..O] ..|...^..DK`..~..T...SKh@...B.R...8c~I.O..H...Je...@..Q...u...|....K.j5.&...C..n.)\ u^.}.&uM.Fv..B.....q.a.:x....k.]E.!X..(....Nw...F..4=..;.L%.W..2.Ja.!..V..n._.'...{}.%..V.[,.S..+.W.........g......u7..I..@.T....@<..>Z..h0.6.f.H..+.{....q.....+.".#..E....0..C.bIC(.L.....V."1.!...$W..m....d.\Y.b.)..%a..o........<..3.....;v"..%f=C~{.;...U..$kB...`S..Wu..

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\yafG7ow.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Secret Key
                                      Category:dropped
                                      Size (bytes):731
                                      Entropy (8bit):7.718366633778525
                                      Encrypted:false
                                      SSDEEP:12:p5v080Xjm+Ou50oVbBBUONGqQ7UegvHJrRYqQvA9TrExlmFPrMx/AmG0Z6A546Ho:p5vCzmONhBBUOwqqUegfJrKfvSrzJWGH
                                      MD5:6D422CA0A5B99F5DE45F1AAC9BF40AB9
                                      SHA1:78174E61F76D4EAEB218EFACD400EB6F6D5FF148
                                      SHA-256:662E5A0919745F668E91C80A4B1A18B50577E9C4C1C1302E2A812E9ADFC23152
                                      SHA-512:E7597F0F766ED06F3D8018B7334DD47827EF66D274E7759F89DF4B13584897B17A5F87392B6A5DEA211ABA00A8F3852BDC33C1D9E827450D25AF1D20BD9EB23E
                                      Malicious:false
                                      Preview:.9....i...W,<.<...,..e.+".>...y..9...'5>...2.,.M.... y.\.......*@.UB....{XiK..US.....#{...!.n...Z........~. 6v.`......8.-....yP.........L...?@..w.[.....~..g..G5n.../...w..q.1`..Fl...- ..$..U...]..N.M...M.,.\...F.Pm.t...C.o;.s..F..E)]........9v.g....A..b....;.X...."k'.mxr..0....3..\.O...a~........0.6f....#..s...t.3.......o:.M`..UrB.>.B..1.......).r.Z.;.....YB....l..b..5]...%r..'..q...I6....S..A...9X..pPj.....m.^..X.Q.<.N.*.F..6.......]..7."x7...h...-..n.J.>.-j.Z...DJ"......'..h*..9.....S5..K.......k.%...R.UT-L...e.....=........rl.........r.....A:.^h.d@so.C..'q.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\DC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\AcroCef\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\rlE6Ap4.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):11124
                                      Entropy (8bit):7.984952245810167
                                      Encrypted:false
                                      SSDEEP:192:56KBAlXKYUm43Ws0HynD1Du7gfHUj+/Nrt01SHMzKuZOaVs5gFwuiZjLHYX:MOAlXKYUMsdD1Du8+ermSszKBaVs6Fhb
                                      MD5:0E7F4A47B2C7DEBA3FD4CEDE540B7380
                                      SHA1:4714E0C33254B7366AEF66010B1BA6751C7B4E44
                                      SHA-256:009686DF70C220ECF35196654EE84E3D7CB8A3154A2ADD4C8A59A4044212E853
                                      SHA-512:A31F6F2CF4CFE54F76E8C606C2B4FF46A0D6FBB81E10B2E60D827A4563F3DD04AA9C05954C94EBB04E441736C982D31DF762BB1CCA064A1B64C0EE3788146DA1
                                      Malicious:false
                                      Preview:S........ ..8}&..?p..~g.|4a.....1.....&.)>.r.d\@...M....c...Y9...o.^~5..q.8.V...Z,.u.........05]..9.t....7...2.$.0...-..e.f...9r..4O#....\...3L.H..vl.?X.{OPG..HhH ^f..._.R'.:T.'....Y..c,...bj.YL.]..g.]-yW..B+.t'._..(...2.3.o0./....m'.h.5.:V._".....oMw....m....0&...2..F.k7...|.....zh....D.Z...}.q..FK.f..(....W...].D./...N..r..e..v.;x..7c.3q..UOO..:...f..["@q..R.y...U....B......=.4...F6.sM..p#U.:..ZM>....1...r..p.2e...2....u.Hn..3`..n.I..}.vqf.1.Q3..e.'5..W.P.....T.~_..H......G.w.K*..k..s+.6...V...9....O...\.../.Fv8..#l.aW..o...;qw..=.\.n2v.>....aRuc..0_.nU.....2.. b...b..x....._....!).pS....:..'....}./@...~M{|P!L.7.fn.K...S}`....>.).k...d.u..d.M.`........:.!...L..o,W..;9...... J.....e.1u.V....-.0i..*.qjg.....R.B%.\.d1..-.GZ.7.M|.2gw....o.F.'..j..0...rM.cN.^.........jX....k...$1.....<`.0*'e...+6..Z.N.`=.a.s..iI.;.l.3..Y..".NPHb...@:...l....8.../...b=...?.=..b.U....n7..PPG.#...)u..b...%.......u|.}..GS.,.=y-.vPn.YL....`....@.|.dw.:.....:.q.W....

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\3Ih2r8r.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1507
                                      Entropy (8bit):7.866140714796275
                                      Encrypted:false
                                      SSDEEP:24:rhdb1yvmk9fia4E8nzACY8tVf3UkVsbRhvi2VUYFzwPYfLBgZjr0/xCWzqlxG00d:vbEvmYauiBY8tVvUkuhK4UYFzwPYfLCQ
                                      MD5:C01BDE366592150DEF749584BED1C9C9
                                      SHA1:38CE726FBDC905077EE12867FDF594FF8109035F
                                      SHA-256:9EFCF7902AA03938EDDA7CFAFDC33FF4CF20AE47D90611D6333F5D2CF2A2030B
                                      SHA-512:0C4C92E6CBF17AC8F0D91FDB884D1427E575D7BB3E4C61F59D3EDF2E250FB63B4174BD64A6C337BC292CB214463BAF35083667303FE92802BCAD2236AC029B1B
                                      Malicious:false
                                      Preview: .k.Z.@-.\'~..#..M.9...\.R....u._U.k.Z..V..........@..3......wp .m..'t.O4v..&..N.\,.H.....gT.K..w...t....J%...T..T.c..&.S..|.L)C.I.sX.^....vaW. 5x.$..+..z.R...>P.....X"..........l.y.X#..m...k.........N...Ad..^z?........ ... "=...Hz$.*_......S..K.bk...o.x`.w.<....E.!.SX.Y.....Z.j..p2/..Y.F;m..-Z.%.25.t.....xy<o.....V.F...B.f}..U......]..x|...%.=...P.`."....Y5.%..g..?....w.RI...K[/..U.../..qQ..i........W.....1.....z..NWn?......"P.....L2-.yoA.......F..B...(."_..h....)..8<.wC..hA..^...>....!.'.po.7sg@.Y..K6.3<..s)-J....{O$p......tI4.{.5....9#.Y..p..%}.|......\.'F...}.m!.i9..-&m......#YL..6.i...Nc>. b..m.Z.....7GB.M.....`gn...{.B9..@v...o.J]u|..%R... .=.S.w...t.!(...AgN....d..J.+.f.sN.7.....W1.J).{..p.T..-.m.j......G..>.wc..Kw....X.J.a^.['..&.0.JUvYk.]..}...S.e.Bd...^M..K........._.h?..F..ta.;t.|..j....\..j.p.Lrc.&y..o..9.1........\J@..U.*<s~.)a.....>F:oP.....g#..\..Ac..#...l\S..~.G]M...7LN.V..Rz...~..W.,...-.$(..U.>O....e.r..z:.....ls

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\451uCuv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5472
                                      Entropy (8bit):7.963748002309814
                                      Encrypted:false
                                      SSDEEP:96:Ah68kQDTkxlO054qt8ubiWSGzCuWe6pBYaNGSWJiiuRX/W1Vu:axIOm4O8Ys3PYaNtiU/wu
                                      MD5:26B9F9ACC0FB6B6ABFB53345E3E0FF62
                                      SHA1:68EFF4936788D95713EE509A33ECED37E40061BF
                                      SHA-256:119527DF397B5CF4889D425773556D2A9DFD5B3C71D0CDBCBDE64B5A5FC332A3
                                      SHA-512:49A01C2C601482343E2084CB9AD8505FF490EFFA0AE644573139DF80F3219EF72E8A84C596641956E6F034A7E6AFDAEAB59811E4C05D76BF78CEF78E8DBEA972
                                      Malicious:false
                                      Preview:.?..QN...M>...@r..ED..6{B2,...a>...F|w:...~P.{ K..w. .K.j.u&.....!.?.....!...`...QnB...A.W...Y.K.0.8....p...~.f.-.ej...bN'h- .........C..E..2.N+.....5..8...w)....n(LSa.jsk.pm.P.'..........3S...jm).?..w-O..c7x.U..4...<..{~..3 L~B..[z............9.Bn..M#.U.]....A........6..V.h..a@..c;$.^z...I..F..../].A.O]..<.i..%.5X..ub..,..8Ut.y."VK.1)(l...b.t.}..$e....N.I).c.|.o..{43.F...a..lH U.....X.........<..N..Bl.._+\@.G2......|......Y..i.2>d..}:|...~...5......$..D.G...Ou...;%>.0If.....52,...=0...u".../v...K`l8...[.ni#0...K-..g9.M..l'`GW.....h..c8.2.e.B..+....A.....L.~.}S.....L.+..>(#......{%....... 0.{c....B...S<..]..=k..EM...F;-.F..f.b.` i.V...(.AZ.@...#}|&.....lR....1s......BP.@w/.d.IP.Q.1..l..>..W8S...].;.W..;.......'..yNz@@....W.i'.f.\i3~b.....~..kM.....>..t.T.m@...\*..e\....>..L. .X..-...;................H .3R...Fy........O.Qj.t....8...Z.\..LT)......S..X]U.G.2...0..4./.../.WP.56.Zu._......(n=IW....K.D.C.}y`.....R..a.M..<.Z....+%.T>^.)4`.G`R.....~..

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\6kr39ms.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):552
                                      Entropy (8bit):7.604492778565093
                                      Encrypted:false
                                      SSDEEP:12:7tnd6mWTaOgfhJ7iqeVXojQVUyWK/cajXE5TP11yCg4mG0Z6A546H/c2J/u:Rnd6mWeOgff7ToKQt1i1kjnG006H9G
                                      MD5:28966B5CC8B750C5168109C547BF2E79
                                      SHA1:9C8687064801E9E0376256184CD8494331A60C82
                                      SHA-256:C8997E429D2764DACAA9B30219F486BF2E1804F2110D2455067B4C9DF98D17BA
                                      SHA-512:34FCE5450F7874E4E12AA2FE068BCFF1A894ED9928218BE88F15A726CF73D296502F33239BA5563D7281832A7854D83C0F45756D8838358146E6B440DECF7EB7
                                      Malicious:false
                                      Preview:.I1.T.^x.q{r{Q@.F^z.KH.I...o*.W.*].3P1...K.+....3{...`..}W{....K.i.R}(-..i....?...a.`..e.s...<.(.......:..{)Q..>..M|Wq..\..+.g@..U.l..=.w.J..6.E..-*..........$..+y.q6-.z.wy8...<......n.&....=......i....A..........m..t..E..K...K..y....#._.&J...&.p..e.5U|.7...y..s;..E.P".|.`..J%>.-Y.S...i"..fV..U......u..g.....k.(.......x.}....^*.M.:.y..6.........T.._7....#..........I.@3.....F@9....>gu+.j"|~.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\CoHC4qE.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):236
                                      Entropy (8bit):7.118478377577484
                                      Encrypted:false
                                      SSDEEP:6:w5VGFXaP9rbREgOizo71iHI3AY9mxU0ud6687d4046HIhKcQNJ/7pk:aRbCsmcH4mG0Z6A546H/c2J/u
                                      MD5:7F3431BD097138F9C97558CF24DE32E1
                                      SHA1:7F1D8BC6C5B8B3E56B84E11A9CAAD8FA2C51EABB
                                      SHA-256:EC4DA0649D78814E9FCA605EF6EE84F42775088ACBAAB9460FD8DF118B8276F4
                                      SHA-512:7029851FEC77D4BF5C707813AEBF4AD743B7AEB3AD849E7DADE553788FB9F77881A10021ABBD467F65DA292D3BCA6CE38ECA2666C1782E06CCEB0E87A6DDC149
                                      Malicious:false
                                      Preview:C../.J#>.,...4.o..-..~..&.......:.../.T2..!..p..'d.........L......7.s.....){.;..|7.....}U^....%".T.b.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\HUuySTi.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1486
                                      Entropy (8bit):7.876739635099584
                                      Encrypted:false
                                      SSDEEP:24:QnXJZEVrl3EOfzoyAz7yoeCDcFNSiOOQrGJVGYIV6v254G006H9G:Qn/ul3bf7toFDTi6rpcvE05G
                                      MD5:05203229DD71F1717DFE8C435C86E456
                                      SHA1:9C3A3E66A6A70817C672E6EB8F7827E4252DDCBF
                                      SHA-256:163E3CEC305342C83015934885DFC5287915004FDF36673D4B460364E9CA678E
                                      SHA-512:192D59E80045D6800A090BA7B50A1BC3053E4B5044886D14651545A27CF5699219C4593ECEE62EE9110A96F29E9439266B7A3B81D8D6D1FEB8BE6AF7D47A6E06
                                      Malicious:false
                                      Preview:].q.-G@/."......k..:.M.Y6.......!.......}I`.....7c..=.|wfB.*..Xa/}..,{.o..=.e.T........q.Pz.Q.*....L.,.jRN...]Q1...b.@.kr.........H$.t..j....g.iF../..q.o.W...J.C.z$.....(.P....{0@.{....;z.(0.kj.e.k.@.G}eg.8F.g%.....d..i+X.~l..............&.|4...*.7.L..{..p....Qg.Mw_.&.......v.."...X...{.!.........c8..f..".1..{w.L..X.=...Q.>D.}~.nM..6.G.......}..>)......"..Z|xV?.@r8.o!i..y.Y=..^.....g.hoU..f.-:.l.qp..Y3+........r..NE..v.l~..y...J#c...ce=O.-}^..BE...8.....c...h.s.v%...........lRroV........-L..W.r..Ed.;%......I.9.......-.........Y.....z0....Y.......,yN.*4.....J.....3...........&.`..V..pH.(.B..*..1mU...S.\.ve..W#x.R.....-...SJ...^..&..O.....o...s..4.+.f.^..7'..f.9....D..n.B.AY.@....I..k2.....XPpH...ls.jO..gJ f0.......s...N.s.-....U./..V~y.;..).cK..}.Y.p. . D...[.ay.4=.X.3):.....h(..s....f.k7kP.?.*.Y...yRE....S..s.m..8|u....1X.....<...RT..r%V.&..........q..W.a..EV./H.Dt..>.~k..V.w.}..j/...T...3..B..d(...Z....GO..4/.&sP(.V.JkX\.~..e.*

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\JDgz0Rz.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):548
                                      Entropy (8bit):7.627932629310385
                                      Encrypted:false
                                      SSDEEP:12:AYg3TtHdL/hcKmqCAtdxsWEmVTqhn1mG0Z6A546H/c2J/u:w3td9cKmqDtbAmIhnYG006H9G
                                      MD5:1147C7CF16636A03A1699030C60E3B31
                                      SHA1:D9A7672031EB65A5841150159DF9B5500068F97B
                                      SHA-256:4A553FAB5BC9A9F19806C237FB587EDB19B527B551822BCDC0C1A8C0CAABE3BE
                                      SHA-512:FBC7B3C22B22D92CB22C3E3FF8E7248BD7E478C7133907D3D927DB3094344C48D769DEC1999B3BC6F3A147128594D50F643499A1B8501480E3E6CC40B6735947
                                      Malicious:false
                                      Preview:).......Uyx.sd2 ...5N.].......i$#....B..Kqq...y..d.J....QP..G..E......S..#..s....&...I.....r..7..0...v.P..'.b......v..>+{.y..4.dZ.....M.uN-....t.sB.].m0.6.KjH3B.<..T..Px..h....x,..|.)0..k..1m.$.4...v`q9..J.D a..-.......v.N_L......\Jh..eGg....|..&d...F.D...c..fg.X...Bj...MQA..GB..J%>.-Y.S...n"..f6..7.?|ZrK.....G..w...a.......x.}....c...... .6#.O.t.].yK.E.u.{...:.m.n.......H.V0.]..GQ..j....6'...{.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\NzxvjW4.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1031
                                      Entropy (8bit):7.805245103759214
                                      Encrypted:false
                                      SSDEEP:24:yWodFg70PYHfPupGvs3B8/u4oFH08ZrwluiG006H9G:yJFgYPY/2pGe8G/FHXGuS5G
                                      MD5:CF47E653E8FB13C7037716B939FCAC62
                                      SHA1:82A2041B661AB20CF5747F070C1E5CD2015A8586
                                      SHA-256:762F12CB1CAC36C1926AE77992DAA850C73550B64F030AC18B61D6F40B03A4A7
                                      SHA-512:D8CF50A7F84A0F98F45D889B7584827DD58AEA0A6D1E6CF79A11045F43E47F37DDA8CE7338049A529E473E5FC3BC10FE6E28C24725974689453936BBD0481D7A
                                      Malicious:false
                                      Preview:...A.(b...5...{..I.z..l....J...O.7..t._n..5&..U.-...NE...0..6..xP...!..[........e'...g.Q...=.....o.*.F$y.....t@..h.K..@E.r...k...c............z..j...%.n..../5W.X8...7.x.Jli.U...........}...-+...e.6.TS.]P$u...b...i.`.....&.......3..q.....q..%...b2.2....(9....lP)N^....=......x.f.3Y...../...C....cW&.~V..,.H..D..z.q..D^.1.4.8A.P.G.../...v.x.....Y;..Y.`.k../..AV.[.|R.I.:8.!..,....Q>....Q4....e_.O..@f.@..A=(....;5..<J..^|.t........Ye.!w...u..M...W.......>(w....m....^...J8.=W$.....m...)...V...lo..'.[6.2...,_P.bP............C..4)....R.5.>$L"80Q..A&..O....[.._..d.....h....RP.7+4....h...&W....._..<...X.e.o<2...t@..M....w..Q..w..c.Q..+.2D..!.a%..5`."@G.....,.S.....I.._e...(.....T...3...._..OI..bGv.........C..5...f8h.}..B]....Mq...l..M....#{...3..J.>.-..i...Dn".%{.S_.......;.......5..H........x.X.Z.Is...vFQ">o..L....@..@].....%Cb..p...u....J..S_y.E`Y..e.s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Xjlfsts.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):545
                                      Entropy (8bit):7.622904188780425
                                      Encrypted:false
                                      SSDEEP:12:sFfxn/HDlN+lHWdlxe+gYErNya2DTw4mG0Z6A546H/c2J/u:sBx/H5N+lH8xerM/+G006H9G
                                      MD5:F2EBC7F684E09DCC7DEC8AB70DDB7010
                                      SHA1:C8A49C1CDD9502F5D71595806F29F856D4528F47
                                      SHA-256:186CF7F0A8507CFD50CF548B02603DA1EEFA223591A596DC172DE6906755F5E3
                                      SHA-512:58E6F413B6A89B2EBA346C6E08CB659C6AF7E312199BCEEA5CC2CA24B450627564805A2E4F1EE1DD4D65652A1C3073CF8F6994D0CCA0179C2ED856ECE5F9DBA8
                                      Malicious:false
                                      Preview:..{.>..`...]..z.+.2..1..[....g..+wf;.uS..E.......J.w...~..8_.[;...O..".....d..O~.SOX.z.j.Rv[...,.n.x.?i..{.~......{.l.Qd...vk...p`e_..`0A.:.h...j......C..b...!..>....1.#.(....sX.S....6dx...[....9rq.p..WO...8B.=..|.......E9.(.....5 L..4.8...w1T....|..c.....k_..\L..."......L...>5...J%>.-Y.S...h".....H7..^.Nj..(.....7.=H........{.}.....=.../.....uoA/.....k."..i.L...0......b.G...{.#.......J..FW1.gz.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\YKzaR6n.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1643
                                      Entropy (8bit):7.879878960046425
                                      Encrypted:false
                                      SSDEEP:24:hpC1mRA8h9SOdHjcZfSKIrknrCV97uSYHUJOcpWYUku+IYg5hgZKoaD2xG006H9G:uUyOBefBnrCV97aUJfQvv5hODaD2/5G
                                      MD5:B3768B9560FDDDD038EDB20467A25238
                                      SHA1:925A81E50C02D3A5A7CCD5E30DFAA302B662B79D
                                      SHA-256:6FDEA3DF3A341628B03C064508D5EABE008D6FF8C2B6D90C1169CC31F696407E
                                      SHA-512:7DA1FA0359CADCD7DDFEF9338C7E359254ABF62439FF58472ADA0E7CBBBCCE5CD65DC4C4DF95BD833FEABE222FD5FC7CA7AC89095EDBD30652BC1B50FB605422
                                      Malicious:false
                                      Preview:B...s...x....]D.1.........^ ../\q..o.;3.=F....@....W...U.Ss....Uh.W..[_-.....5!...l7..n..m-..#..~.^......g+..f.5..Z\.w....)...FSh.(./......2'8Q<.Y..z..:.....^WY@...K!6..g......?!..y.......#_R.[5..]......O.x..du..(..j.rt{....n.rH...3....x.2$[.../C.f..U@(..2.......V......S.e...>.<..1}.. .w...S.L.....d;>.g......f.;.;.71(.....T..-D.=.,~.1H..f........8..`.g]Zm..M.T.J8X.7G...0\..q . J.D..#.8....e.qC.....2.6s.k)..`..<.L...:.....L.hrEE..P7...e....+..F..G`j........q9PT....C.c.)T..d........b..T.....b....M..&...w..4..N...../.k.2..f....f..Q....Z%..g&fZ.....nS)0.a..|.+.).S.*'.....T-im...A..$..Z:{}J.v..X..`aL4/..^V<[.?*.......^................]/S.tArB.........%uv=......J..1...........g........A..Ee..'...4L. C;:....T..........{h%.ermT.1../+..?I.B2..Pf......>....O..i..|.ox0R........,.....>.".}V.. R..r......._.GA.........8{$..=.j.....*.....?.m..]8D...c......$F......U.L.o.78.....O@.a.E......a.g..C..K.S..J.........?N......e..(..L.e...........n.`..

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ZGTJvcM.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):538
                                      Entropy (8bit):7.639392115669154
                                      Encrypted:false
                                      SSDEEP:12:Sb60i/l4n+OXRygclm1r0VSwRytDmG0Z6A546H/c2J/u:SbE/2+OHcl8sBSSG006H9G
                                      MD5:9D3E8A734E7C0C304AC1BB3B9B7EC72F
                                      SHA1:E313516A72C467F1ADB89EEB74FA7C90387B4075
                                      SHA-256:C46F75AE65331253A67E9D466F3BDFF811F1D70A796135914A5E8C87242AED8C
                                      SHA-512:A0173CE13B8A69C335B57C4C69468E88DB5FEE6997EC32ADDDB5E2307574B14AF92F7FE25ADBE69FE2A5D8FED101A065DBA91C336858F24B90DD448136DFB106
                                      Malicious:false
                                      Preview:.S'p.5.....xMs.>o6 ......i..\.0..1.......&&....).5..c..<R.U-.....(.({...]..{f.N...e(/.#&..ol..n..u5n...."^...<A.z<k=d......p.py.C ~..6+.nZ..).\....O$.ae.AN.|AHo..d......a..W......'&e..2.`...................+:J..;L.I..T[.Ej3......<.G./.Q....h..89 ..q.e....-|[..J.K.....8.J%>.-Y.S...n"..f6..0......V......S5V.H........x.}.-..)..z...o@&.2P-q...[)..@KK..#.>.W4...b...G.S......5..>...vj..u.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\aIdec3e.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):534
                                      Entropy (8bit):7.618870103376378
                                      Encrypted:false
                                      SSDEEP:12:qSB9OTwDPyadfE1+fStrwF/nQ8FqilOaOpmG0Z6A546H/c2J/u:qQO0DPvBO9tr6fQ8A9a/G006H9G
                                      MD5:F2964EF3CCD67BAD177295F19C2AF7F2
                                      SHA1:E658A688CECE7CB61F3B9808DE50CA5358DA1B7D
                                      SHA-256:FC41288DBA14CA55E5D3FF27669E54CF174E2BFC13AE282D6B1EF4CDA2C7DD28
                                      SHA-512:A06664EF78C631630B391AD8C631DA76428A397606E3A964AD0C42805F333E87A088CF96A05A482F35963D9956AA2A408C7457A1F04375A7248F388F33781AB4
                                      Malicious:false
                                      Preview:~...+?...u.G...\...V~..o..I...!.Q.....n...N#.w.....1..../.m.v/...Q..'.|. h|r....XL.../.Z0..}p./x)w..Cf.....V. ..>..9.O.0..).'Q.C.s\V..qt..1G..Q,....r..............\i..`..]..a....AD..F.....\.l.8.?...m..o...?."Y.T....".....=i..........;.NxP....[.`...k.....4N.P.~..`uT.jj.J%>.-Y.s..I."...g.wh..Z..........5..H........x.&5m...HZ.w.{qy.6&......y[,....| ..O....t.v..a........B..cx.E.s.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ajaO5zH.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):560
                                      Entropy (8bit):7.598097858381871
                                      Encrypted:false
                                      SSDEEP:12:7VIwb7uFXHT0CWX2eMSmCKqhGEGvE6mG0Z6A546H/c2J/u:5IwWOKKGEeE9G006H9G
                                      MD5:A5EC33A5007755A1D4AF8284BBE3D9B7
                                      SHA1:9D99E04918FF2D8A99B2AAC2354037AC34383AAE
                                      SHA-256:B7424CCE9031EE5B0A7879708D5E127627798A2806A24D304BB1420953D30543
                                      SHA-512:01169497B81A26DB29E06952ECA42CFD600D201B855983DA234F1728C2181FBE7B021077A22B9A8D0512622FDD8BF0A329800ECE5345068C29A0D8D7F117153F
                                      Malicious:false
                                      Preview:..c}.._..Ms?.D.....E.rR.|...l.Kg.`>...A^.b..S.<.J.d..P/.R.X..".%..(.w%.G...@.E$)',.G.!....)@S..n_hVx[.r[.k..L.<...zGa.@vp<.M....|.....Bjn.....:DuM.JY.b..D:C...t|.=.V..$..u.I!Sr..F.t3DT.r.?+~?.!..VK.v.......*#..-8.c5)U.j.PwIL.3K..*>....~.>8}.`..v.O......+9..v..`.h....D.q5o.....tI.J%>.-M._...D[".4k..C.....{.o%.......qD.Jpm....J.}.....]*m.PV...M;.....l..G...Ic*D....UK,...K.y.L.,....H.T.M..B............vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\bZieg5B.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):556
                                      Entropy (8bit):7.651281278915451
                                      Encrypted:false
                                      SSDEEP:12:sHBMPz+/BDWqOlL1I0I4Xdt5qrala6v++0t2LxamG0Z6A546H/c2J/u:shkABDIlJI0I4n5qD6v66xdG006H9G
                                      MD5:1D928F672D4E21C1E31587AB14ABB4A9
                                      SHA1:04AA9A64C58FFB2D772E8C80755E897B03C712F5
                                      SHA-256:8550EC9938E42D34B4A90B8E0B281B10A74292206E3ED42384079B5255BD2DE4
                                      SHA-512:53D04FADCD8D665A4B95EBD8123E5C60100A7DCA190F0D922140AEE5F2FDDB008B287EF2D92684910B95EAEA72CE6D4569EA1A2A0F7BBAAF070E3D05A4B48E37
                                      Malicious:false
                                      Preview:.....|.....z}....yJ.D>.....F..J.>".....J.....!...o.s-=R.....}.n..0.....zE..b.K.<Gs..$.*..$..%.eF..'.#3.O.\.o6...n....5...z!8...P..!.p&......d..b.V...s.xy.`.[.I...a.....Gk...o..\ 0X..~..&.....E^.k{...b.$...........^~.1......R.*...=2?..t...w. .bMWd......U0.T..V........`b.lO...@.J%>.-D.t.dg.p..fk..cE._.UH......g. \.........x.}....^*m.....~...O;7f.@.......8D.P.b..-..v.X.8c3.l..XX..+W`..:..a.$o.L..vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\hIISqpz.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1508
                                      Entropy (8bit):7.856834168375248
                                      Encrypted:false
                                      SSDEEP:24:b2litOdrMR6QC9iJtdlZ4Gno5vzbZ1mZ7nI3zY6PlUUXGNCtQ4WatQgpG006H9G:xKM0QCUxD4GozbZw8DY69FG8Q4rGgX5G
                                      MD5:F7294083CA156CD2E9F009B62E88AD8D
                                      SHA1:A1124014A88F4E025361B1BBA1F68D3DB34AD89D
                                      SHA-256:276C894CCB1D661C1A41D26142FDD19DDEF8DBFAFDFB2729B3611EC3A87472E8
                                      SHA-512:1C48C3099B60D52F80A364A003CF89FB045E47AA583442DD3191B3C372B6773E8812AFE74856DA5657AC6EE5FF589E092B9D5363C202A751247821213DAB7547
                                      Malicious:false
                                      Preview:r.s...o.)h.UY...h..^a..U...n.]Gej.2..G...5...s.bg..?..}..<...s.Cw....K.ngEg........u.%7?.b.+.0v.A..f".f.....x......wk.....;R/.i..`...J.../..C`....h".GW@ .d..TQyt....T.HHq..._7..:.h... .....a..-Z..E.v..&-...z.x-S$....0p:.g...A.r.......r....V..........h....O.!]V...|?.2......:Jw1AQ..9Z....l.8..d}._.%..b...C..{c..........m..c%./w.y.(..:C/.}..Mg3_..@).H3.Y.A.j.."=E.....xs.].>..ks.....f.......1}c.L..Q\..,...@..3...v.e.=..]cP.JK...y.......C.R]W.6N7i'.........W..H...QW......W.b..w(..8..{.....we..%9n.k7R,=..qR=...q].f..D.e..i...\..|.k.A0O..,S....Hkx..J........_.@.@.J..N..g..N..ncf.e..Z.I..H..[......O..[S.i......K..v.1..M.&..8..7...Z:....NX....A..'...kL.yc.:t.r. ......[.-b..k...F..p..(.i.F..n.;UKyS..J..s...;..1H....d......Z..(.....o.>!y.E$.t/...x.....).....<.w..G.^#.}.\..15T.7.#(l.b.c...j.......Zv8..,.`.X(.q.@.?..5...@..&' JR.[.RmsdzD?....t..J.U4` ..6}%Ppwx.0...\e..a.$.c.@..A..'|y..($...$(..z..%.,......^h..@LF_.-..b.@.O.A.B...9....A.O..6.|^uD4..&#..

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\lZsceYP.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):557
                                      Entropy (8bit):7.602899472265043
                                      Encrypted:false
                                      SSDEEP:12:csicMjm8wBULkJY8rVV9dI+8WBP5MJRrr2DTudmG0Z6A546H/c2J/u:FicMjW2kJsjAq7OPLG006H9G
                                      MD5:30D5C3CDA291F9CA88C55814D1F15893
                                      SHA1:318A8B806BC7C8C10436BF980DBEB3AB8ABC8AFB
                                      SHA-256:BBAE8CD05DDA8732C6786624DBD5B032445883D23A5AB45390365CEA006D51EC
                                      SHA-512:B2EF8004E5B969CDC6F4605CF3EE7387167D5C088603A68F43CA7807F7ADFB502A0DC75D5BB6CAFCB6DA8438470E4850FB03A71A0F78E28F2611E779B8AE7FE2
                                      Malicious:false
                                      Preview:.?].].....D....H..8...Z....#.2"6.+.O.J...u.0{QM......W....*.+.N...U...V.B.E..f...c...D...?.muY.a..l.5..0.......qo>k.T.......2.O.*Q.....{..zp.."1.....b.[...#|.[N.<..E7./........`..|.*.%.T|..\..ah.Q..q>.#.......&.}#.t..H...I..2j..IQ.'....+...D.).|..e#.....c.n.xO_.b5....|Z.{.G.J%>.-M._...D[".4k..C......\.....S.t..5.....x.}....^)m.s..q...J.....U.;..~Y.w.<....\.d.N... ....n#..c..Z@....f;s..vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\oC6FQyd.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):558
                                      Entropy (8bit):7.624238939459408
                                      Encrypted:false
                                      SSDEEP:12:CYEGRDwnBPmMLtDlG+ZBnK1hpNutFZXwy2EHs1F5pYbmG0Z6A546H/c2J/u:lRwnZm6t5G+ZFeDChZ2EHs1bG006H9G
                                      MD5:DB38B2F1F5CE9F16F363BED3854891D8
                                      SHA1:B7BA5EEFE5DC9B4A801A8B4896C6A77BC785B30B
                                      SHA-256:018BF1F52372EE0EC7610E82F93E0168E2E4A462B276D7EF580747C25F1E4CA4
                                      SHA-512:5B21C7ADC582056729D28467A50B0D8E6713BBD04EE27A0C27285562B95683D80410D5C7FDC581AC25287F945F15C5549E25ED5F3E54782806C4035EC20F9C64
                                      Malicious:false
                                      Preview:|.O.k.c/.$I.u.RQ.d...p.....HR(......BV.v...r.M.x.....7=...y.._.ZB.m...nUz%.vt...!?...._h.C..._..\<....U.....EY..*j.h...,.=..C..k....X.8......7..}8.%......J..A.uS..L.Z..1b@.n...!.h..8s.xP..4..@..V....k.t.I..L...e......s.ol..l..^.!.q......Sr..A...H....L..J..F...Z0..?..j..O....P?7..V....J%>.-Y.S...h".....wK.......m....-Jw.{..=6....x.}....^)m.A.!.0.R.N.Q...)]l.eYf...4.n.....'K,s6.4....Di..1Y.j.Cb`.O{.n..vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\s4QZ0fT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1514
                                      Entropy (8bit):7.863686543674038
                                      Encrypted:false
                                      SSDEEP:24:xNPFxMXCzTIjdSmp6DbccSyKxdCVdgw0a5Gq3z6u7nyG006H9G:DFIWTIjdSmhoKOPb7mu7ni5G
                                      MD5:789DDA64CEC257C5E84AFBF6506666D6
                                      SHA1:E17AEC5CF97BFC46C5A8D4B6E552671CDFC84BD0
                                      SHA-256:A661D2927C4D14A5621108F0A76E65B9687BFD118BD284B91E4A228BEB97237A
                                      SHA-512:9AD2CC21C04F194BB7E3F623F0578301C8948ADAAC2952A82A44567349EB0FE81695177F168D27D85A1813CF2DE4ABF2F73C826F8F525A03E35C1B17FAADD7A0
                                      Malicious:false
                                      Preview:........i...7~d-.g.\.U6..0.....ZU.rV.$..so....v.UGs..K....iq....C....a..N..M.N....._.~cNU...(.@p..._:v.i,......81"-^.`.[.)4n...Nn.C.(..!...2.+..r....UkK>..7..K..._........B`..Z.Zl.<...Jn.....cZ.I._..ZBV.O.E..U....D/.. k..fy$.0.%...<3...6q..2C..T..N...(j.o.BU&...L..b....w..k)../9..Rn...G."c.y.0].Dt=p./..l?Y....:G.D,nr..Z.j...x.`...*.L.\..w...@.g).Z.t.-.^O...c..E.k.1.O.+G..........1)K]q.wZ~H ..J..h.1q=2z..b.u?.o$.(.*.U....%..I..........5..m.ao........j...0....]..G@;.T.....JX..\W.b....*...F?.h....!...D5.........uU...:...&.V.e..........].#..t....(.7..a[..%`..]a..8..f.9...s..Aq,]TD..G:..V...Ak...m.}..@.....5..8.T..(....ih.p.|."V4..B...P_......;....mvZ.J..x.[rr.L...#.u.(~...C).w.U..w....9..R....._.....e.3..cC..,..k.......*..K.2L...m...3.G}I.n...c.Rr....J..~v..'*J.E..._.....@.&......cT..hF..w\.Z.+...<O....P..Q.....,..WO.G...;..u..1s..A..SY.... .X".Q{.^H.V..q...6.?..T.....c.hc...C...[O...:..L.J.....8D..D...>..djP...c%.:r..._.u.G.(.y...+.?.)....

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\o4nXa7L.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3059
                                      Entropy (8bit):7.942357110096064
                                      Encrypted:false
                                      SSDEEP:48:2tkQ6vulCmiBPVF/gUEFK1MqVQVVudqXlTKdRmXmA0FlOyLuPqKq+eOpbVzO55G:2G3ssPVF2PqVvMXZKOW1SP+gzOW
                                      MD5:9873F95A1A0D8340ED430588A19F7E8E
                                      SHA1:DA79BFDE74C66C7528AED67F1AC38AA4ED3A2756
                                      SHA-256:BB0F233BE5BC40DBC59CC2F99763DFAD39399BF389A799F5587292A6FD872AD8
                                      SHA-512:D72A30A6CD2C67CF4E83CDD84508971135E5A9048F33249717707DB9F827A75A3BD77C045A8004907826CCF3E91B065C8837915D8BCB7A8796F0BB6CC0624ED5
                                      Malicious:false
                                      Preview:..T.S..?....o`.~0.k...0r.}.....B<..-o.'.N8.:........q.(.5+......[.6.K...4.....~....3......#G2}$...1nFL..b.....$9.k.+f..k9..W..j.Yd....74../..q.../..i.dK1ygDq.Di.\.Emr..:#...'..*..[<.0....x...^'t~..[yF.T......x$PN...)...8..>....q.H}......d;.E65X.=.L.....Q....b.....~v.g...lv.J.b{_.9?....ngc......=..\I..+....(..:.s.>.@..9...2ya...8%W.....u./4U..c.T.1.A].tMe|.......'}/.<y'G..*....@<;.../.R...p.7`.z.$......2).VcCu..(.&2}..P..K.&;y......~....`0.3...o...+@....LP.d. 2.....u.o..moR..#*1..C......`..^.j.R...5. N./b...V&^.G....K!.......,...X..`MV.....Q9.x%uh...."...,.`..xd...dxD.?>M.3.f..\.r../...r]...g ]..CK.)W.g.!b..G.\.UL..C./.^.".....).;}C.B.I...X*.T".1EN....?....S...57.4....\..yvB..44.?...|......7..6.@...SH.8a.l...X...fg.fn%1MIc..*..N.pr....{.'...@.....d.$.........t.!.}...0h..V.../,..Q1.h.R.H........E6.0<..K......S1.J.. w.f.......&..,.f.(.A.....y..W...a..xv..|.T*.1s....u6....U0.*.a/=.......Fp.{P.d...........60?...I ..>_..,..7JAu...]u.....z

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\XWguEz9.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):185350
                                      Entropy (8bit):7.9990808036638645
                                      Encrypted:true
                                      SSDEEP:3072:3BKNu3y2T9QkDeZyLOD5ti2+ZaOL9BmtXH/WwxD798WNAmd8vgz2sT9YuwkROl0s:3BWwyi9QkjLEviTZzmuKVkmmvgz2auuK
                                      MD5:9D820E6D918E3FCAAB3E64FF850BC75E
                                      SHA1:23A9576BBA505EECE5ED8071FFE45ADA86B367BE
                                      SHA-256:AFDB6EE5A7329FEA2B9EF3CF0CE969255F08C86F8AB95CE0AE75C0033ADF1CE1
                                      SHA-512:6FE602089B3003C896D0233FD17ACA5784704448346AABB40E3407BB9EF584F9234F807239FA44B9C4CABB00EBAB20F71AD0A86983B6778475CE720F7914505E
                                      Malicious:true
                                      Preview:.M;.T"...l..=........tFc....cHCE*.......q@*.g..w..gm...#. o...s.........|....zp.y...Y.........`H&...m..W?..{..Y.I....-...Q,.FM.)k..mY|...o'l...$......I..^aR..~....D.X.j..=.....7f........n.......[n...vy....!.wbG*|i..s...L........4...."ol....Y...2.M..+.X..^.{.............; <X.d_..P(.....%R^...[L..M]o. ....!.s.G...OU....L.*cZ.R....j...l.....DL.N...h..x.x.....4...V.......IJ..v"<:... .0/.3.....>l.P._..mqh...9.k1....c.(!..h.}B..4&A...N..r&.m.g...P.+.bN..2.^............b=....h.@.l.R..CUi.^.....i.m...x<..;.F..).z..L-1a4..[..g.. ..dG..`...'.%.{*...7.,s.K{...K..=/<hTl...K.-A..u.Y0Q.+R.8...@.C.......C....G.<..oq..=.;..?#*..T..w.%.....S......0..\....^.....o@......1...pv...CgN+.?.P..p..`SJ.S...;...2E4.Z.).E..(.j...p..]..>r.........U..q.....q...`..*X...T.Y}....q.2e....4....8......Q....]l....^ZaSQ...e.<Kt'm.!.Ma.......]:]....Z.T.....Q.Y%.....Q.....z5.#.#..7.3.....e...y.U..7TA.d....7...._?.j>g=.j....).L....)ZR.m..[....T....m.j.|r...h{..%..%...t7..K-g9.4Ox..

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\iHPd1jv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1487
                                      Entropy (8bit):7.8701437367750255
                                      Encrypted:false
                                      SSDEEP:24:RRsLVePZ7H54RInMw+JnMbtIbDzTXqG9sRSE6xYjBtgV/NiET0ntyq87iG006H9G:ILVylZ4WYAtIeG9sRBgVVy0L7S5G
                                      MD5:95EDD715932CC1628176053B4D97ECBE
                                      SHA1:A6DB7A40867DDBD7DC8E97967B24780B531C8960
                                      SHA-256:4D5500EE2E674B343C849DC3DE5050E22C25FFCD50B57C05C791CA72B749C5C0
                                      SHA-512:DBF7ACC2B4F47C348551CAF4E6BF98577A9D87AE1C1BD34FB03868BB735353E108454A145B5755D760389559224BFD9F22C00C68CBDFE578AF23CA1B33CB57CE
                                      Malicious:false
                                      Preview:.....-q..H...a.-zB..{$.k........m..-B...C...2.uP...........>.....a{..^8..\..f...b..%.N.M.{\.\E...~....l.v.uu.#.'. .6.@.Wc..jN..$....H....]tr.P.*..fg......'.^.]B.C..J..'..L.!.Q..uz.....BH.`...c.C..O...jb...a..7...&.N...y..&../4...TGa.".7M%..\1WhT.(........Gq.ern......].RQ.}..h....u;..|7..)...[.....6s....x.....':.O.z...+.=.,h|^y@#.....h.q.[...ab.}.4Q...:.c..F?..}.hBkzeOh...[{.@..8%.-..!%........#...-......\.......p.|G.ZVp..SU..eg.sP.^{.`.fv.O.@....#.JUv.gl...x..P.w.7|.6.....>...9....t..hlZ....,1..(..)..p...LD..;..A.K.....G.45s....h3..&ko.S..l....u"S.....;..@.......p..t3Zl?#P.ato[8.4.3..+5.....G.B.^B.6.1#....M.Y...B..&...5;}....L...qV.^.Cs.70.A.....]H.Us...v..2.G^.q..%.c...M...H0'...gv0.06K.'Q$..q;W.%...,......j..XD...i.Is.W..(......a..].......Hrt....|.....i.....x.d.:..`7P...|..........{).Gg.....O.o.l..L.u..LZ.K#7|...>.,u.T,_....3.....B...#........?.q.R.B|.a;..x....Q..U.......u..Kc..|hi?...g.._.E.R.....5...&9G.DO,...4=..hi.Y.u...x.....

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\xcYbgjA.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:DOS executable (COM, 0x8C-variant)
                                      Category:dropped
                                      Size (bytes):227256
                                      Entropy (8bit):7.999211629194928
                                      Encrypted:true
                                      SSDEEP:6144:gr7epRPRtgvh2NMvrINXMORMvHBj01jT8A5L/5fDxsp:KiRUh2N6qc6jBL/5Lxsp
                                      MD5:09CA6F60959A0A502BC9FC93BECC7859
                                      SHA1:BA0456B530D7E77B8D165404D4BE0B7C88338F3C
                                      SHA-256:3AD982C3CE0AE265E13240027A48460C768C97591A5FC1FE32D6493BA3E483E1
                                      SHA-512:9E46181751A2A09CACC870B6CE69174DD27A5EF7CE277C2C274ADB818FD77AF7C4BAEEF56C3E01A92EB93296FED73E72363671EB210501312328C36E65C87173
                                      Malicious:true
                                      Preview:....sv..s......[%D.....p..e.%....{:cU.5,P......>j...S.p......P....!.JD'5..w.#.7].s...DI$.&.w...*..3.I:bl..{.....PT..s....S..p.%.Wsp.m....WB..~..........0{...a...,\@[&....G...0......}.u.g..+7.?.:J.i.Qfq7.c..B............$x..|.a..j.yJ.N?..x.@,....\Z(.~/..[.I..h.J...C....~U.[Qk.r.>.J^kR...y..Y6.....D..O.g..ZM[.d...hF~....4.GO\..|..CM...b..p..KWp..+..j...#.....}.9U.nT$\w.B....GY.W.U}.).....{a.....+......=*.at....-e..J...%...=....[E.Gb....n......Y..}.q$.....9.~....i.R.....P....Q.f.$cU...0..HC7I3.....8.M......M..$_k-Y.....2sl..%f.p....y7 .%....... ..v..M\S./C.9.Zk..].A.dZ.\O....G...C...X..6...,.U.]..{v.......3....7.1...YQ...02..U..#d.'O.S.oG.u.r...C;S..A.?Z.s.+>!3.a.zI...2.[. ....f.....O[.Z}..\..".po..2.....S....T..;.....|O5..#|9...NR.[.i...v..K..(.ZN,...>9E[5.\..#..+.Y...P'c.X.E.....^.gmZN....\W.....p...1~....B.....cr....&.=._.fY-.iU<7..c...NC4.^r`.*$......a.h..F..Pm..Z0.B..-..Z..X..*..<..$n....t.*.A.Z.........Y......l.G..G.h.Q..QW.s.d.c.C...O..

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\yUwgSKW.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12533
                                      Entropy (8bit):7.985717705677835
                                      Encrypted:false
                                      SSDEEP:384:qw5Fc5qOlKY99ucnHHfZzPajV1SEkn/AWgRb:qwaBgK/x8Hwn/AWgRb
                                      MD5:26020E0F8AD4B0621C6DC62DFD633F35
                                      SHA1:6A583908162F979529FBA194CD6C7C7446215058
                                      SHA-256:ED94A8BFD4011194CC3D78D2E3308E3BED20994CD3B1D4FEB74D05CB8C9B0C07
                                      SHA-512:ED595BDCF76267BB0A48F886EBEB4A0BD0BDBAF42EFBED7AC145827EF44FEA4BBCD256CD3D150F24FB781D6BC2CDE253EDBD5C72A6BC922E0C78676D869A9E16
                                      Malicious:false
                                      Preview:....L.......&??.]N$..*A.!............u.Cp{W.o.~.o.....9.........I...3.+..@..).....)\IvX. .q..}....f.....h...^.H,.p.;..]ZK."1....O.B......YT..Q..&.9+....j.aE.L...n.^.k....L.....Tg.`.....I.o...c.t[."'D.&*. .}.T..B..7.5/2DD..g...........I.D.....R>T.8c}[...Th......x..E.........{..(.g".2#.......!!l~\.....].......S..Ga.....o....._..,..Kd.R....7..>..u......e.......l..........3.R......`.uN.|.I.T.7../^...q..&..!..| H...I....$J....o?"2.o.3.e2h3..a._...$...+....yj..-.9q...=.T).K7]....g.o>.....]....`RW@;...X.#A99..B.....".Rg/9...G...3.Rx.x;.y.Z....Oa..o...y/....s..T..xC....S.'.Q.u...m..)...%.........e...V?.j.~.4.n.q.....A...^!......){...#.b.....>^.\j`v.j..W..... ;N[.)&?WB...$..8wy%.j7{.e....o....C..(o...f..j..U............'.......k.24.AU...0..9...v....y`C.>.#..5......K.j.n..W.=.x3..!&.^Am...ep.U....M.?...G.sN.h{g...%.O.pl..K....%.......:}...6#..j..CW_{...R..R... .......tP5.......}.)..d....t/.*...d!..K......[.....HI..V..~p&..

                                      C:\Users\user\AppData\Local\Adobe\Acrobat\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\Color\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\Color\Profiles\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Adobe\Color\UTfxHWm.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):842
                                      Entropy (8bit):7.7926464080782045
                                      Encrypted:false
                                      SSDEEP:24:WsoVZhQ2/ahoYPJFynfO1eZ9ehUr2F5D54DsYXG006H9G:lgZhnKg2aeDyDsO5G
                                      MD5:4C7FA977C15E7B214EB833B30520DBF6
                                      SHA1:C041439545695F0FA3BC9FEA599F80F608E4891F
                                      SHA-256:D05B6EA69071F44BA7D33AC9698EC581A6B2C0D4796EF9D7A75732687D44AECF
                                      SHA-512:F41B2E8DE1895C8D8D25B7A2A344151F7EEA5F3191F3770C7CEC36E9618FF2CAC581B812B5B577A46AB7F7F860ABAC8F8A5077E75911A8274262080A1DB41B0B
                                      Malicious:false
                                      Preview:,..T.x..q*..6.?rv.n..9.@La......t.....08.._......(....>.@..OG._.[.B....gl..T....d.a...b..KD..(.6..]6....>.VT....?..'45.....O}.4yE...zt.2r......?G....!..T..d..i.W.....@I.;....?O.>....>.8.zn1.5...VjF.%..p...........0r..6d...[C...e.H8.....*mg....].}h.z......DJ..Z..zR...P..t....LE...i@K..<.J..W..m..vb......U.y.}S...=7.\r..5.........`..>.%e.././O............x......s!..q..A>.c<V....v.bi._.YX....."..{zy.{....^~.KM.N?.i.~ .......JIN.``.&.<.O...K.....o...c......G..7.....=.1..1..*.q.p.i.=*....)...W$..w...:cX../..^b..Dk"..-....X...e..C1.'R..N.g.o.S.L.?.....|(e;}O.a...B........J%>....8K....#...wU<..+...9.....S6..H.....)...........8..d3.;.2^K.8..L..1...=.P..KR...z..`..C..[t.....n.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Adobe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\CEF\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\CEF\User Data\Dictionaries\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\CEF\User Data\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Comms\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Comms\UnistoreDB\0wmGJ82.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3145968
                                      Entropy (8bit):1.9763011416138174
                                      Encrypted:false
                                      SSDEEP:12288:AImE/pTLOOXoVgiVR3NuIuQLG+rcgplxoyZ7MmbuP5Ke0BWqCh7:A7+XOJdueKclXMeLCp
                                      MD5:A4C521DBF5E4844B3A9D865B76B950BB
                                      SHA1:F6FCE77C5F7A936E69DDCFB658FB014F55EAF25F
                                      SHA-256:48E3E76111BE4DDB5ABB08B03626094E225D729290887F3C038F3922FE07966D
                                      SHA-512:E21D5870C7FFE211D887525E435BE038531BC583E474A0C9D8BD899A7EF454679EC094A305FDAA2357E86B78B3C00299962E2EC90EC6B9330F0FB425B797F218
                                      Malicious:false
                                      Preview:u...v..>..-2.QY..n..4..)D..S.n....H_0.IuSs.....C\.+~.h...>..E.5..(...h.;N.ZS..J._.Nb.>.!/.F<..gJ^...8......Nc.!....>.l.......t.......$...y~..J.....i.].l57..."r.YdFU....a....P..|."...m..........S...m..P...B6..q&.5.YY} ....?..@.ZMv!.T...+...7I.\aoXx...Lx.b+\..h.ez0.^...o}..K[.x.#.I.Y.y....J9.......A...l..%0....b..V..`..!^+...........!G.....6...0!..M.......M...\}.......Xm/.a..n....o.v.6..!.ezz.e$2.._U.b.T.Oz6.|...L.A...`..7.$..U..Qqlo..B..ei?.m.7_1.7l...-..0.bj...b.x..m.AA.&..C..q<.....'.,.>....M7H."..V..^.2.P,..z..XoSz|....h..#...a.G....>~..my.P.^-#..~=e..-l.....p...h.G.X..!..]K%..7.i..'OV......b..A.uY.1.\.[.Y../.^F..`.(...-..8...V&.4R..*K.&lN.`Ud.S.8-qj#......r.yq.{...&.&.&..Z.!...b...13.+M...Wv.=.[..V.e.p...$.......tl<......?M.S{..Um.b....\h..?3z..r4t5.....s..H..h...vu..K..2`....w.U.U...w+E/.....@..q...7..A3"..m....V...).nf..7.....%gRE..PB.W...:...h.f=Ty02........v..T....U....4'...3..n..t.eJ....8..([.7.....#k.B.e.?.z..(..k..8..).. ..9R.Y|.\=.Y,

                                      C:\Users\user\AppData\Local\Comms\UnistoreDB\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Comms\UnistoreDB\NNR9KXl.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5767404
                                      Entropy (8bit):1.3964558715966884
                                      Encrypted:false
                                      SSDEEP:12288:L0ceIgIuZK5h143A/ksCEwideZZadXL/nGjkAcRRb0n:L0TIeZ2Qw8pid+a9/nTPRC
                                      MD5:0538182AD7BB565F7C6EB0384F575DEB
                                      SHA1:9FA5E144EE26AFF8EE9EC5EDF28A224984606941
                                      SHA-256:FFD57E79AD5C98A49B6E1FC9EDE8456F9C78EFED26036D91D6315A0DC8E8F298
                                      SHA-512:3A7F97E443D3756258D2108675D20513458D8A9D029C25E6D701676E8C31A9F601F793265CF32F9F09631FAE3EE5A3E84E84EEBFF9F5CE5BAAA4C0899492F103
                                      Malicious:false
                                      Preview:.L.%....+.B..$A...YF.V*.x..r....v{..V...V.?.5.<;....(.....$..7m....,0%T...r kBG..i.o..k.e..:U7.;............w...........>.U.1.C....7>N%.8>....dfGE...L.lfU)........K.Y.g.P...>...t...........N^..".g..........y.L......Zv....k..w..-.pwH..er'...p....8...I~..v.&3..-..?....."...o..'6...>l.^.|[!T+J..Oz'$uI.N?.F..f.=Fo4.s..O.to._`...g.......nd.;.ey.b..).....4.u.....a.8.evE.V_C.!.Lf..bnN#oc..:..4....4z.yxM^..s..Pv.B.&.......2..,h?..&..a...Z .j..@...70.lNJ\.!&.A.V..U.b....,..G......N.P.............$.....L.Y.1."...............6..t..)^..I....Yq7.. %..(."..5.T.......2Ds~..v.t..#K.r......C." ...l&<....c..*R+...(j0.,.2S.v...m..W.a.\. ..F.d.6.....m.?..Qv...,=...)&.F2.=.......~.?.v.||5j.-..B_Y.FV...%W..4w....).........y..W.D&8P....0.j..E/..1..:+.*.........$DJ..fz..q..`.c...{.f9B.=.....c.X.b.vkSX.......lFP..M.M..m.\......l.!.:.r....C]q.d..v!.x2...c..j..6.6.Fl....r.6v....O{W...~.$,..F..iW..........2...].Q~......ZoZ8..GJ6..d...@..I.G'|\^.........A.3..[A....

                                      C:\Users\user\AppData\Local\Comms\UnistoreDB\at2YRol.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3145964
                                      Entropy (8bit):1.976323302533598
                                      Encrypted:false
                                      SSDEEP:12288:XdSStcs8xEueeOxYhfD2B3hTy9gev1k7uXYO1C:8StcLxE9+hfDOyWfuoL
                                      MD5:07F816DC390650DD423682EA23A7EFFE
                                      SHA1:F75C752928046102973A0CB047BFB847F1B9C4A5
                                      SHA-256:669499DEF7163708F9D60FCF24E6F323223408CA9EA9C30EE5FE10E0B9991E5F
                                      SHA-512:B5CE504BF346A0F342A28BB9FCDA09E469E75F2417A01B51389B6553D4AA5CE2D93B76241E562D4C26443157B9F96F9F8AA354AF5EA32B64B8458691A8A19F8A
                                      Malicious:false
                                      Preview:......Y..B...&.l..i..3...D....L..C:pY.#qZ.9c...@ .Z*.2........... ..;...W.......&...3......`tF......w.....u......$..P...Q.a.L.g A...N ..o.......n..........+...Cw.....K~..J._.d....Z..;bwaa..6....@>....f0R..4*Y..j....../A.2.qV..h...{..,m.F...VE.lY.n...Z.......eT..VI.^d..UiC.'.ix.?^......J:....7...e.?...9.......W.......2.L.u.......1s9.`g&.....57..I..X.....p.i...q.o..ax..[q.fuH.s....J..:|...?..Z.`}.'.6+(.:......\...n_t...H.Mg...v.jh.#....4.G......;.......O. ..(....~...;.m.`.9v..a....I..TRc..kz./.,.........I.[..0.....U.l{..5 0k.4.\. ....x..~.....h..E._F..=2..,.:..m9.)...m...`;/N.D.O.......i.lB*^..(h.w..t-|.r.E...&.W..B~...a.`6h)(......O...nlp2).r.I....[82G.$.y/..<.v"N.k...2.V.....].... .....T#.f.'..k_D....BN.....}..O.5.nb...{...%hJ.....^?uX.ZI}.x{.8.ob.o0b=...r....b.2:..Sz-.(........BU.B....h\H..R].!..0...M7..|.....+.........+u:.7......r.^e...l.....|q.].L...9.....2.b.,./..Y.W.......P(&....a...E.v.t.3.].~.H..'...!....a.:....q1.Bw|......k

                                      C:\Users\user\AppData\Local\Comms\UnistoreDB\dTJ1gdm.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8424
                                      Entropy (8bit):7.975097242303846
                                      Encrypted:false
                                      SSDEEP:192:IsiNLUkwFwSb9emnS5K1kNjdnCOcU19NN931QI3KgNI:IszFwC7aK1GCOcs9DQI3Kb
                                      MD5:D3F21FECD6929193F5CD49CA0B8D5771
                                      SHA1:4C0CC1369F75477FC9D1BB198255E36746604074
                                      SHA-256:11B241A3ED91D6B34AAC403D7A7603CBA163BCDF68AE792135553D0E7FF6A663
                                      SHA-512:E17EB098CDB004B6EB3BAAADF79F620D9333B7C7BEAF8DB3A68E485C85A95A85257E420117B9636C73E2FE07E87DB349C013F9E5D2C73189DCD277F4123FEC03
                                      Malicious:false
                                      Preview:...C...{MF...k....c..y>.E.^.T..eF.`DY.."..n......*..G....y. .rG.~f....Y.......0.l.....l.M.S...Y.o.i...5...q$........*..#\..YFb.._U.,....7?.P_I....?.<Lp.E.%.h..>.......5.)...~..s........D...'.I{.GW@_....3....F..p..;SK....|...W3B...3..T.B4..;..M...*.>&..(T.T.....v>m-&jA...Q...h.`SL.....vS...@x....1...JE..k....o.y.....4.H..y.&.pj.p'pv.....ne.i..|ym.v...gJ.....D|...9..8.<.~.o}..uU.h.......;..5.`..T...[V.}i3..b.q..u.7v...5..F..By.)K..:.N......Dz............r.I...I:.K...1t?d...W\.6..?.b.....FG.E...^ZZ.....8}.i.:^.q.d...p...u..lJ%..c....YgY...f..Gf.. V.. ..w[.!....!_q.N...`.dQ..........#.G3........._.W`.:l...K......_H.......S......%5..c\..^I. ..6....~n3m.>...R..$.................q..a....v..`.okmF...H.......1..6.|..!)H,.J.I.bL.K...u.....1Xn...0v.'..... .Q...p.o89.C}.....a.1.p#..<[.{,.OC.k^.w...>F....xz...a.R.M.B5.!~..:.3qZPd.}.M.-..B0.\.).....Ua@q.2.....?.....T.M.../^..b........;..:..&.IA.....B<.2....E.F5.........H.5.B.....5 |J....^...}x...

                                      C:\Users\user\AppData\Local\Comms\UnistoreDB\m5YjU9w.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3145968
                                      Entropy (8bit):1.976313875613823
                                      Encrypted:false
                                      SSDEEP:12288:KmJ36uRHfUsXK/itEIyYxEKemRZzewpfndD2tXb8:tJqyHt6/imVME27CqfnZ2tw
                                      MD5:C395BE26950BADB7F28075EBB767F1DE
                                      SHA1:6B119F819B299013D24AAFE8F88ECDED6C855FBC
                                      SHA-256:2E3BE6516484F3DADB0B5468BF74C2E4E45B39E7FEBF3F7C17CF03E21069D5FD
                                      SHA-512:7CF1D7F2E4882FB6EE396CA3A96051B56B75D67E0E5263994551B43A5F038186766AC3722F578A1F95769479FADCE6F0E5526F1DED4AF318ABC0AABB9ED7842F
                                      Malicious:false
                                      Preview:.....' .Q.....w...n...y{...T .!..I.............^.._..V..^..hL..u.pSBo\..-.......4..0...Q....v.uo.i..oBg....b.p_....\..&...|..r.........'.......T...P..@/j.....v../(....d|Fl.1.G2...*..-..+.n...........vy....).......&..t...........A.f....<.g..P.r...5M..H9....+...>/.p.Y.<R.qe*?.F........Rlr.R...R.......... ...}......%.T.....ky.....T......YD...&...m..[..W..}..P./.k.U,ng.O.C..WD.-.@D.Q.z...I.^V..8.|.aA..!&W2."j.I#......B........8.r.,.g...=v.......#..,..:>.v..!.O.B...,.+.n.4....Ne..O:..%-....g3O.n...,..3.J.......T.....3..tN|aiv...a...|.d5"9c.|&...7....nvs....iE..XH..iZ.E..6p2.(?"..^...wP..:?h0.......+u...p^av....,qt.hKj.Oh.....'....Qw.....TUvB...86(p!{..i.t.......C.../.Z#G.. h.....o...^.(.....lL....).. y:.)T....-.v/..q.D#;R.t...G..bGDZE"...H...w.r......R......S.S.......H...f..H._oBC.sZ2...NS.......i......D..FGgj.w......b..z.........$..$.;.d..'.)L?..E.0t.........o..GPw...3h`..?U.?'..P..7...m.....,.)...L...3E.tXJ&..Y...4..P...0...#oA.3V

                                      C:\Users\user\AppData\Local\Comms\UnistoreDB\pJcRM2b.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16621
                                      Entropy (8bit):7.989402432314054
                                      Encrypted:false
                                      SSDEEP:192:kK7OifTpmKWEy6e3MciTtDC7AEBmcCKQzm+uR77vJdIKSd8dqd/UjuENQQciPw2b:kUONurlKAE6K57IqdqdUH1mJAMVO
                                      MD5:36D894A92F84E9F9D1638452CB6CE0A3
                                      SHA1:FAD7D981E93A16676FCFACFE51F38787EDF2C6E0
                                      SHA-256:A10DADE0672A9445A1A97448BC4ECFEE7196E21C49AB20359CF94245C58DC4D5
                                      SHA-512:FE17F3BB39F591B3B1890564D8179B4C9785C6552706F9E593C48FC27E16E8DDFAD26ABA7FF987A76A1C29B42CD562D7C5C3D15E108EEC476F1C0B13D8FC93A8
                                      Malicious:false
                                      Preview:..#.G.......f..;.E..2.Ch.....s.....||Z%.....@......@...{..=..3<<Y.X.j..`...`....c..n..7..D.i..l.P.s_[......=..Z..i.E.#9.Za.g....'..gT......-_?....D.....C9..3.....>..Q~..e#.+...YeGHa......q......Ul....W.Ai..A(.%[..P..J.1...E..a.OC..Y-^..0 ..O.:....J..Z.x..HK.F.T.O.]K.%....U.D....|....T..{....u.Nbm.......Fw:H..:......V...z]cf?A.......g.Kb.A....$.J....>......{..=...p9.........0c.m...9af...0......X2cS.......p.."4wB..e...gu....a.....p......].6.._Y...)j........0..Sz.Q([X_qR.....H,.....30t..P.#o_aE.}..A<\q.J..0...Ue...|.^.a:.%|).-.[....(`.....@...b.U....3..w\> T....k..1.w.....|Ms.0`n...^...{`......1.P<+D.5...X*_C6.#.~.a.....'.6DL...v.....`...e.r.F&.........F....)...j.?.G.S0o..a.}...r...{+.z..M.b.`.2gtY..E0..]j...LIpm).AhS..E..Z19...q.-.f..c.......?.{T..'.t..K...Z.....(....%A.{.g`.....u.rE.n.......~m.r...j.!3wK.....Hm......T......:.....P.../9.Tj...BN.V722..ci....f8?..L.....39..#<b.b..[.{..tk..e.b..D.4......._..}P.5..-z:]....k.58.%..w..Z ..t......;

                                      C:\Users\user\AppData\Local\Comms\UnistoreDB\qmzcYeu.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:DOS executable (COM, 0x8C-variant)
                                      Category:dropped
                                      Size (bytes):3145960
                                      Entropy (8bit):2.450242556097346
                                      Encrypted:false
                                      SSDEEP:12288:yKOxZP5LomWRknYZN/1EVfP4sNKOZV/gGG8:yKOvPRL4Y2t1eTjZZgGG8
                                      MD5:93CA02CF05FDF61789ABBDF2031DFD3D
                                      SHA1:BB07AEEE452DF8C9C31C375213C6763C0A362301
                                      SHA-256:80D1EDDA0A50A1AF671DC4AAF8133CEE8E852DBF90EACEE4206C96AB069D72B8
                                      SHA-512:3B4BE0316F84EE3841CE792C55A1EFAE988D548ED65BDBCA5F5886353E37443746C0FA8890BE7278AF7232A2409153E12AE891F42C7B446AEA991B87AEE63FEC
                                      Malicious:true
                                      Preview:...>Wh.H........q. ..3ox.?.!+$N..u.9.....m..U...(...$../{.W.`...(..+..}..y}`b.../.....q.V..z...[..... .d(.H.~qD......qNn.3...{.z....&9\i...Jt...u.....1[......VN*...S.N..Avu..-..\..K."(.nI...a.......Q..M..%...g.2..a.....* ..-6.....P.4.o....tZI.....F...-!..EP[..yH...\.......W....r.'....3..r......~.:(..@ci....L\av.<.ie..x.........30....R..(.,a.B.9..q....sHm....z...?.?.}N!...Fg. ..6...PXSEp.?O.>.'....9./.....u...V#...&.x.k..ri.6.E.|.5E...BC.....Y....E...%.X...\...G...p...F,.8..[..E"o5.....m...y......B^....nNr.i.C..G.2.P=c..`.3..Pm.L..`.i@....[..~R"..x........V..Ld...X..B....~...q^...&..|.x...lP"h..o0M..k.L.Q.....)..W.V8H....x.g$...]...V......5.u...|..G..|...../.6..@a....oN...d..R+K..$...0.- ......I......9&..weM~..$..X.5..x ..`.Ao..Ht.3.LG..0.~u.a@...#...B.B...%s.W.....#..6.l.W.....[lQ..o.....|O.+.l*...K.t.Z.V..]~&.........%..$XD...&.<.M.......h....._...H.....@.o,....95...B...*.4:........>'sCD..j#(T.[.h..v..$.<.......m.....<...C.2.#...t..#.J.V..O.

                                      C:\Users\user\AppData\Local\Comms\Unistore\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Comms\Unistore\data\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Comms\Unistore\data\PSJi1EO.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):248
                                      Entropy (8bit):7.121259112684097
                                      Encrypted:false
                                      SSDEEP:6:qAsQJEYoKutMC2fu9DQ6c3AY9mxU0ud6687d4046HIhKcQNJ/7pk:1s0EYoN+CKwD6TmG0Z6A546H/c2J/u
                                      MD5:DAA00A355E9DBD2E2F959A6E3F84985B
                                      SHA1:B42F17BC67FCB65DEAC9A368463A3FDCB7ABB956
                                      SHA-256:F8A2C7B5CFAA85BC517C6A7410A4B1F0D0CB41812DAF8C1E261EFE425E832897
                                      SHA-512:8ED2574E6A2A1747AA9BE7CDCBD13706B2ED8AA2F65136E96815C26801660D0176D67ED5CAC691ECB1D11137E8AF4AC5310740BFA89D35E4242C0F9782DF03DE
                                      Malicious:false
                                      Preview:p3...J.....;I..r.l^.......C...9.....S6..H......`.<f.z.mj..:.^./.4m........H.c-.H.X..-...*....3....B..yn.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\4FSzcnb.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1213
                                      Entropy (8bit):7.846897631860047
                                      Encrypted:false
                                      SSDEEP:24:OQE2ChzbC7ugmLQaXjhJmiLaqEwZRp1Dfcb8uFWmEfjWiG006H9G:DIzzgmLrdzdRptkYuo9fjr5G
                                      MD5:F2C7633D5D69DEB8AAAA8B4EA046C931
                                      SHA1:B379355B2CC0253D61CDBE64DE761ABE39E5467A
                                      SHA-256:67A86EFD2F25B03D86C18A8279FE4B82329E226CBEED1C03516257159104C5A6
                                      SHA-512:1DD7727F80E4566ED39947559A7A3B0B27EA99861F48855DD5820B1CD337389E6A4F71F3FDD013D83747F6973A6D9653DA05B3890A731C889C8F460C103C46F6
                                      Malicious:false
                                      Preview:_SU.e.G,j.F.\62H....o5'.*.......K.....h.d.......k{.`......v....G.....r...m.j...n.>...lv..l...'2....|..qz4......S......`.x. .Y ..`J.-M..>.......8. k0D].V.......\..?...w..L..,..c..t4.v=.p.`.....[].+..<.6D..}8w....|..ih&..M.=.......o$..Z.'.F...ZM.l.&....O.0..5..X..3u...;..hm.......{.h.w@.;........s._..M.Z2h.....%x..-`4H..*.E.a.....c...|..7.8B....uy..W..2".......&f.A./.....0....q..6?<EP9B..."....2.'...4A3..S..;....wm......4.l>{{?.V....jk.W.;.2/..Js...FK..F.R9.o4....rP.ev..f.....S.S.*i... kE&F%.G.....3.#.P=V....=.{.y.niV..sS.P,...T.h.....6.&.E..R./...au........\>`...s..7;e..y<..<.,...KR?.....V.I.y.n.....O..(x.9.....u.WP.'.G`..o:..%..ZX....l......Y=M...q.BXl.;QX.e.B...4..........PVD.'%........].[.A..v..c|".Diz...F...U...[@).....R.j.E..X...h..M.h0OP....J....X5.9-...E.^.`..)....#r..$Zh.x...=.a...;...6I_.......3.&3~#.?..|.@....6.8.H.|}.X..m..6.K.......iT....gw3PFbQ.c.Mx..1.^Me|..[.........iS.&8.b.D...{..e....\Z.I.bN(......-...JH>.-e.Q....*..............

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\5ds6vUT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):307
                                      Entropy (8bit):7.3150378729434165
                                      Encrypted:false
                                      SSDEEP:6:CqzjaZFidtQhk/4V2lphkHj+AJNINQiyrAY9mxU0ud6687d4046HIhKcQNJ/7pk:3zWZFgtQhk/LlphkNJCN7yfmG0Z6A54d
                                      MD5:FB9DA86F8049CE5FBD67D234326327F8
                                      SHA1:994F965E21E6B5BE1E72F43B763182EB0F5D4D91
                                      SHA-256:BD8966A0494E05B2A14D490FE5AFF232FA94197DEBA9955A9EF90C58D0326C06
                                      SHA-512:B96D54DCE3819F4FEB53487A90CFDB288F4E9DC88A47B3489F8FF436B3750FCF8D5992FA7DAF1422A3583DE5F4E5FD311A0367E26E4E66D077567DFC511B0984
                                      Malicious:false
                                      Preview:..P`w.......g.!...cY. .....r.L.9wx..8.......G..!.|.JH>.-e.Q....*...........u...L..!..v5...........x.}.m.lx...6<.Y."...[./..N..Y..g.Q...1=.'o[.[.:h.v.W.u..O...<A4.w.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\PkPC0aD.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):255
                                      Entropy (8bit):7.180282946510074
                                      Encrypted:false
                                      SSDEEP:6:PZpv0DtvOneNhFxlN2+QatxAY9mxU0ud6687d4046HIhKcQNJ/7pk:hpMJ2efFx6smG0Z6A546H/c2J/u
                                      MD5:F99F3977D9952F37592FAAA06AC89645
                                      SHA1:E3A73B4EA6AD33CBE288909ECDB1961B48107240
                                      SHA-256:68E587552A951DEFD8BBC7F3D9FBD5ABDACEE31021AC2497B1FA510BEB6F661E
                                      SHA-512:DA96B5E06A7645EB19CEBDBE7B780BC5C973A560E4698ECE262E436BD2C31691ED4C3543D419D931EC2011D358674694D88DF9E6D6FBB09F234FFDA3F28FFF61
                                      Malicious:false
                                      Preview:.J.>.-b.@..{......M..N..<.b.........5#.H.C......x.}..."..m...q.v..~..{j.\...0.r..q.t..yC......u..\!.!ol.....oKYs._..y.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\iuDWUtG.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):33022
                                      Entropy (8bit):7.993880420929518
                                      Encrypted:true
                                      SSDEEP:768:kjAUl0omvi2TIlqTRtaaPaLIjPLDwINyJkK6bM2oqsP3:q6o+i2TG23PaLEFcJkPAn
                                      MD5:2A40C4DA5C818A939FC8C520C5CC1A96
                                      SHA1:8A4F329ADCAEDDEA67132BC193FA2792C5C5746E
                                      SHA-256:5B2D8976CF4B38E021A4D625EE246FF4846FFAE7FF80765960E14E0DDE1F89B4
                                      SHA-512:8003B419C2E7B7CC1CF9014FA02ED2215D85BFB8D718214C83B2B150445C808B19E385023F97505FA323134F3B52A51EF1B15BC21A30DB085B45219DE90719D2
                                      Malicious:true
                                      Preview:94..fa........^},<XB\..B.7..YNw..n$qVX.....1.....bW....4#.JQ.D_.2....\.&x.8g..Fw...Np._..f..pX.$.WL......F..Nh...j0....w&.(..>.<..S0.O^8..N.8.I#......\b..E.2.... ./:C.I.6..[.bJ.F..b......Hk.....T02u...1...CH.W....5..ut..z..a.....?..k[...R..].[....GL..t.,...r...0..]=.|K.z`.J.q...#.I.)(^..p.Q.~).....K(e..!...2.H.........(5...d..h..&..(..8W..c.W...3..R...g.. |..".....9..C.=.....V}...?.5...Z.X.0.Ec6.+.K....8.5......MX.-xb......#.(Hcs'...N.&.w:+..2.{.........^q.K....!p-X.9...'.S..h...L..>..>.....2..$D.._.{...<..D..=...J...'&.t.........D...8..z...`..d9.....F.Ey....7..n.c..P.ws..c.4jO.....*t.L......^--...K...P..WvF5.|....)..V..m.*B].zA.6y.....I."...#.@1..R...n..+.ST...\........F...3.V..".1.U..)./.+vr..H.A....gf5..t...^.4..\M.D0......*.fI.[.....GJ..EmN... A.2......f.....^(..+T^.&.1.M....\M./u<...' ...&..$,..ni.#..qN...D..(.....l6.Q*....M.z[a....S..d.).3..Wj.D0miT..Q...>...[.=.H.T..$.>z..V:..KD.N.}.wQ)=..o.....0G......3.w.7G...c..l....N.....k>.*.

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\lr7qvyV.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1048824
                                      Entropy (8bit):4.9820903555084355
                                      Encrypted:false
                                      SSDEEP:12288:KEHeJjsXb6H/2yOIdxspJkvbpv+ZZkOq0hE33idPeY2QjWVZnHCE:AJC6ZOGxsjkDpv+ucE33QGj3ZHCE
                                      MD5:6F7681EF4A5E5B9A849F4F83C8048130
                                      SHA1:3344BE7D2BD23392FB35DECA40CFA9F48578ED53
                                      SHA-256:49E7751B5B5038E5D2D0C890F597AAFE3A45CE58AF5020EA1CEB6A2A6AF12600
                                      SHA-512:D08F406DAD0E5E8370FF23D4C2A8F70A3CEE458EB57E102841A8ADBEC6E73F046A61BCB01370229217D702EBFCA88330AB4CD988885017F6AE964A9F044DC7EC
                                      Malicious:false
                                      Preview:.2.Z.Rw.,.P..O8.......E.P..,./.!......\...^.....=.....P.b4+..*..<gA"...7.~j....0..0S.!.x........].[...B..'.....@$......A...T.....Pc..@.U';.I.....H..*...2]j....w.>a.c=y..L..R.....y..w...JM=B.V..9.~...mzDdy<.r./JiD.v.:9....(.H@....|2.YoY.W.....+..P5).d...d...dEOW.....4..htx)...:..{Z.-...........SSk..@....BY...1.^.>....x....Or..h..(.p.z!0...].G...?nI.P.B.M.f.....^...3?..R.^-....I#[.EO.#..."..l/..z...x...[.V.&.5....0i..O...........A...F.....,HF...Y.5..{N....v..KF..o..!#.Ic..h......J..?.K...O. ....C\....(s.....h{.tf./A\8K..n.........hS......(+....!......{S......Z........c.C.....\U.sFd.}A..N....3....}.......o.....T..cB|..z..q3.r..4]]:....;.f.!T.......|........?.}.._...&K(..F..i.4...C.q7/)..^\&u.|Q.Py).q...kPg'5..v...e.!.SKo......]C.&#...,...Z.....X.........S.w.oGhe$S.FN..yM+.e.........C*.....E.u..ad. .>V......5.X..E.]........k.r.C...w...m.uQ..b.n%.i..%..q..j..p..u....e.1..f...#.?..R8\..=......|/.V.FJ.O..!..=7.G*`..;c...L,...u....R.6.........

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\TbgLkRn.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):5123
                                      Entropy (8bit):7.960995638896216
                                      Encrypted:false
                                      SSDEEP:96:5r98jt57F8t/5HbIoxDpqSkk8DyfB0dONAeinNbgoawJmYT3x2uJcHc+F2da:YjtbC58yDsq8WfyeinNbcmdBhIcM2da
                                      MD5:514F260AAAA9A0D92039B2BAA0ED011D
                                      SHA1:02FFC0B8BF83DD550D56402DAC271051620B0B5B
                                      SHA-256:514C2DE88B0B9EAF3983EAB9D19D7732FF98835C94061E755A062121D724627D
                                      SHA-512:CAC52BD9C2E1FE2300AA93D997E47867E9EBF68F37086A7C39AC98D595940EC177E02CA2A741E040921CD45B464FC182AAC5CA4D6F5DF8FD8249B86C10D1E3D0
                                      Malicious:false
                                      Preview:.v..YB.d....h'.x.j+x.~.7WK......~=%jLo..;...2.;.....$.%]E..i1.0...5t0.=I...\.k.z../.F.r..z...c96.......A.L.R..2)j>.%...c..D.R4a.Q.x....}P.....eV5Nk.i...}T.|.......EFp....Oq..e&7..l.}#j...!......}.".PH.U.......8..7!..)..y=.{8......'nA.1y..*.D..7.}.B.....x...T4...-C.9.V2..q.l@.i./....`PR...?...REZ...S.n.C$.l.[}E.F.o........N..s.r*?...gqG......h..!._._........jk.....YO.^.........Y.;9#.fe.>M?H....G....=Q:9..5,.H....Wh..l.Y.[}.....4...j4.3../<...M.)..cP......xX!Q...i.8".z...............ZT0a...3 ./..O.b@..U........`W..u....$`...0..M..S.../...NPv.X>...J.".w.l`..m>..]H..s..r.I.l..5F......&.?.[..p..B....{. .4..(I..M.s.....]..vn.0GT..b..V!.0M._.`......?..j&...P'......aN^%.."u)...$.7....0.Ra..o....b-G.tA>W..>5.......Cl...=!."..w..-57x....5..3...<.......@...<k..e.!......w...f4..,..v....A.....5t..b........*...U........:K.E..F..t.9b>...%.*o7N.....ZK...e....qaR...q@..1gRJVgX..2.....pe...P.|J.W.}.0NC.T...P.(..&....Mm..\;....Fd..../.....C...

                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\mCAs6vp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):931
                                      Entropy (8bit):7.781280020646428
                                      Encrypted:false
                                      SSDEEP:24:nYT4hmYNlVS3dsFrxnd+YIcmkXMhkMVEAzen0G006H9G:YT4Z5S3Orxn8JkXMyMqAH5G
                                      MD5:522C5D07FB92507F7ACC49634567F4D6
                                      SHA1:E9C004CE353DAAE76BFE51650B6E874FBA7FE027
                                      SHA-256:E0F3F2AFAC4E5509228E12F9A747931C009BDA97ED7032C676F47B1E41303FBF
                                      SHA-512:BF6D0E5D862020059D3C4FF1964E69BBC5379CDD5B7602D83C4F36814A7F8102464FB7563A9FF796BBF9A114435EE00AAC565F9E3399ECCB1A442B1C95CCF7A7
                                      Malicious:false
                                      Preview:#.......Gx.*.%...!m......X}<d..v_..(..g...l$.>..t#..C......DK..3...DL.^ ...8V.<].....Ss...5.;X.C....Z$....,.iJ.DZ.M.(H+..S*.....@...G.q-.+O.......g%~...Nb..].d...L^D..e.C!.i!Z.$,.}.......s..L....q.......0p.....*.G7....Qw..W.]...n.:.C.6.i{...m.e..3..#'7.z...Z3.{..d;...&#....[.B....~.l[..v.3k.u:^c'gv}...x..}..J....a..1y.....,{.x./*.g.J...ZZn.C..B..[\.....D..v.wo.1......n.Fc.....B.[TQ...........1..<..<O....^M....?..X.....s.N "...U7...(^..XE......O.U.^0.HOYO..i..]....F......c....F:.e!(.~3..y.s.......C.Q.A1 ev))....C..@,.y!.._`.SA..u....m...K.e.@...a...$.......U|A.I=_:Ws.......t.YAI.U...JpbN...(..#[q{.02...e.593.Hs0x.k.REhd.J.>....8K......r....+...u.pUW.3...!.i.l..\.......A........*S.P...]..p...J..;....}.h..u...@.13.%e?.<..G....Il...........p...T$.....Y.B@k..vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\D3DSCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\7kVI7ej.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):65536
                                      Entropy (8bit):0.2918700342598498
                                      Encrypted:false
                                      SSDEEP:24:FfQ/JTvpTBKdtqXC98PfVBQgFFOKLZK/bUVMYbyZy4ZtG006H92:NQ/l5BKTn6VBLFOKL8/bUeRwwr52
                                      MD5:D740FCEAB3709FC2B43C35318E5A1491
                                      SHA1:A3DC24A379D2248C2B5FEAE312058F27E4FAEF91
                                      SHA-256:3813CB2B447DDC47B1A5F0DE3648AF5E6B07BC67FFF6054702E4084B1BF71694
                                      SHA-512:3C1869496E629DA87EC011B7210645BDA7A343C9031D12908AEF84EFE638B93110750ABFD5ADC708CA5160137824981917D6B6407691B9406592985DD14DB4FF
                                      Malicious:false
                                      Preview:.e.L|\(.W...<...UUX).Q..I.[.....~Z.|qd4....".......F.o...DW?A..V.V.f....._.}eI..P...{.T....!Cr..%./x....\.....6......9{..V"......+.......W./5",...k-..6OI..4..4.hp......]...0.b...0a.5j.5ICA..b.....O...{...@u..Y.Y..2k...)2..w48R.).d..l.J..>^..,k......u.0..A"BFr8...j..n.\..%...R..pzi....L.|O.@.H.5.w.u#mv\`.....$.+....c+.K...E...@Ti...8[n'.Z.&......RQ.2....u&#q{L8...|{........6"...Ob.(..H;K.......!.s..k.>./}..uX..T..6h.T?.n.+...W....+ff..r.8C.{ .;.........Z.........?.v..T.....h..(2C.@...F.GY$....Y..H..D%`.....v......./.m.[.X.OmZ...ZE...X....v..._.K.{Eo.b.~Rg.u,....4.vD...84.o....]k5.YZ.r.#h.7.T..9...1..\...+Fm_6_&WA.2....BK4...|J...+....mo.EA..P7..Y.4@.E...I.O..b.n...'.{xf.........#.j."....O....!.(.d..'.{...#].=:.B:...p.|....jz2.-.g9...U.) .....P.(g*s.fv+.U.....m.U04._-.&d.hb..7.>.S..+k.....S."bt+.q..h.zG..n.^V>..~2/...:...8k..*E...k.{I..q..X., .*/...s...U.V.9..F....?H..vB,...8.qsC.Uv7m.<./....q....}.{....].....vc?.m.k5.*.1."a...4..7.........^.....l/.

                                      C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Av021Zp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4194575
                                      Entropy (8bit):1.5380572456141646
                                      Encrypted:false
                                      SSDEEP:12288:6J/mulgaq8v/O1KNefh7HxdHs+ULXQvcRjw0OSA47:6Jhg7m/ZyvHsFXpsP47
                                      MD5:40163CD457968BD3EE504E554A414BCA
                                      SHA1:C49D5B856A916B177CA3ABB0E05C58C449D20219
                                      SHA-256:7869D4F8E38D04D2C2CB1F887B1EDB20FA4D566FCDDC5CD9CA6FDEC06BD1364E
                                      SHA-512:4D05ACDB72CF97A649D823A06030024A83559E30B693EC43320270FC334BBF356E84D57DAD7413F0D789153B358C7A233890B0F9D6ECF904CE00874D0906C849
                                      Malicious:false
                                      Preview:.4...l.P...5.;.F.P.~.^......^...Z...mv.;.t@o.....{#..U..i..{...Wd....yf......a..b\-...#...JO..e......j.5.... .. ...%..im..Q...v....(.T..mB.5..i....Y+.....:..M......p....>.g..j.N.k8\.k....9........]5....^..z.pM.Hp^R..$....l.K.qd.z.dG..`k`...S....n_.:.G..3....>.5..R..$=k,/.(O .,..Vc{M...;..rZ..(..`..lL.}s.3#...A.q.q....l@..,u..Aa/o..(,[V.M.f....... .*yl.-.....||.w.....7.LyX.J. ....5V.&.ZG.t......?.b....$?G..T...I...&FHX.....&h..o...5...4-.;.....;...<.P...As../..f.1..pC~..q..G7...g..........#..7jF(2....o..E....kH(4w...K..E.....M.$iPS.I+...T......."....@.tX..@...y.q....:..b<..Y..K.!.{.S.,..]..N...m|...S.$k.b....}.JV..Y._.(.x."...#.?..2)SP.....]>.JZW..|.b....hR..h..[.@..$7.....*..0.......O....].8.s.'i.(.e..]R...e..@.X uw.'.(.S....@..6...9K.G3.........E.9W;.X{.....xV....o......\.[Z...D.c..Q.?..)Z..ajm.^........C7.G....~..6...X..5.t.?@+REc7vT#.?t[M-.@V..+..++=....}..$...{$..!;FN+.....DL.+M..E../a-..L.5... `.....q*.z.bw...@z....rL..a.-.O.k.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\CRq2ioZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4194575
                                      Entropy (8bit):1.5381959168052664
                                      Encrypted:false
                                      SSDEEP:12288:uqMrvyoVftS8BWZsc/NVNWiFsojHA6sEzST9:up2WtS8BKs4sojfsEeh
                                      MD5:CF2DBC51E8436E0C5C0CC5D0809565E4
                                      SHA1:5BA51E6A83588EEECACF9D925D68CE650D735433
                                      SHA-256:120B9ECFCEE1725048097B76469193AECEEADBEFE6CE1387A10C07D702C73EA5
                                      SHA-512:3B1E4F14B9F70DD2AAE125594D471A084090EDA7F4FD6C7FC6B2993FFA4401885098D81EFAAF8F93FA772C4550F05DDDFCF181F5ECCC091E184CCA689D00363C
                                      Malicious:false
                                      Preview:.....HV....`.pxMb..(.......!..;c....KQ.aK.z.>fn)..k2... ...7K^.".0=3R8...^.z....#....0.Vt".....m`Pe.......j.......X....B.<.".b.v...3@.hP..i..n>+c.G.-..1B8........]&.I(.r..4.~.#....^..Sp........?.....#..|..W6L........~....rc).D.C08.(..&.R.B.2....b.a>!h.K.u'.h6.......Kp...#.eZl6.(r...T.v^Ac.o>s.-.N.k9i$@..$.~)Y..V.|..F.Vsf....?../........j.^......?1.8L[K2.ZG......U:i~Dk9~...I....s9.\?..."^>1N..?.C...#.Ho._.\....?w..F{F...KA..7B.3.Q..S.*m..PT.&Td......V.r..'....]...)........ZZf.+.=..._g.2.$.9.[<.pu...j..;..u&.....)V.T....../.....}V.. ..i./.+...6....#..|..c....C.-...~........O.6.'.'.AT..._..:..7O.?..1......S....K...........a.).H......e...y.....a.b...X..%7.;{...-..z.k....T.N.+....8R....o.'.SD.......W......B..<f..s1D.<RD..m.......d.w.#...5 ..k..e...J.......`..4..$!..).g.o.<kq..Y7....[.(..qW.._@..>.BC...l..}20J..@.N...?e..R......~/..H....NW./CJ?9.....+....n....e.i.....-.G.].....F.@L.. {0.p....U..g.6_.$.........o..h...;.n...v'.|...>N..&..<.+.,...."$Yy.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\IRlPAqf.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:DOS executable (COM)
                                      Category:dropped
                                      Size (bytes):4194574
                                      Entropy (8bit):1.5381576685419536
                                      Encrypted:false
                                      SSDEEP:12288:5KOE6nn+cXeLwp0mlpZd7ZVuEX8+PLfa/jgy05oH8R25A/d:5hE2nXeky4fHVuEX88fQjOCHv5Kd
                                      MD5:28E753567BD4814F2F6559D8F962F229
                                      SHA1:F79F6E0901679B4ACFC2D6B5A657B1E6458DFF09
                                      SHA-256:341654B6A0D755F7736E332BFF464E9683F5260375AFF668BAC6BFF725EBE561
                                      SHA-512:05ACC5B80CA67F39C508670DEB5A64B808C017A073160EFE7A05B8EAA65627A2E98C7B80A053FEB0CA89484191B4D6E3AB76904E76C68B581AA62A406131FF66
                                      Malicious:true
                                      Preview:.<3,.6..Ie.........'..<W...YU@b.T.t..e.)!..w....}..T.4..!HV.@Sp+{:...~.....O..T..6..|..[Lr............Y....i.{g.)(.u..33.....y..Hz..rN..o.....F.v..P..Ax......XZ>..|.Bx......)Ge.0....?k...H..@.-d.b..t.!..|l~..v..........(.w]w.......`._fN...S!....#W......`u1?..\.P.MTn...Ic.S$.*..:...s..Q...x.....r D.N~......HW.dS....X....WH...W.4-,.n.q.....)O.D...V.e=....n......T.AW.=...4......g..l...S.o'.......E.vFn..X.y.+m^.!...,.....wT..@.}x..v....-Y.`._.[...... .v._.....7..{B..\.......@.69W."...Zi.1.X.4.....lWV......&).......k..........T}..X.7\0.bX..44.._...k......8-....m...Y..'g..4.;.;.u.f...-U....S..@..*..6..z5.=...1]S.).1/....}G.Ga_pG........C.-f........#k^VK..5..T.....'....8..B..l..D..K(.P...;Y.......x..m.eq5....Y.tk...................@.9.N....X..8..V.P..{...W.&....S.<...B.G...!..L..?....:d1z...u....@`..P....%[.d..,...t.P.S..X..4.....Y...in.X....2...s..*....O...^SPA.-]."..h..n...9.....UP.G.(.(?...X^...`.1.bI..Z..O!....5Cs.+T.?v,...".L;p..

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\anKD6mJ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4194574
                                      Entropy (8bit):1.537991395754472
                                      Encrypted:false
                                      SSDEEP:12288:LiS7TyU2IyfXkNJg3wFLCkxqkMKlpiBurdawakEGa5awhuo:WSqU2TIxTMKlp24d0w1wL
                                      MD5:2877150CC51C801139BD6DE0F97AFB61
                                      SHA1:21EC7C40DD0D1578F539EFE8B16E24C2E8864E27
                                      SHA-256:B1BC8454D0ED20E10DE27EA887F525FCBE1D20F16295102ED1E94953BF2F45A5
                                      SHA-512:4D3B24C92388E35CEDDACAB15EF4C9891D9667979D4FA699E44B11D7778CA089A44898EBBA0064F394B6851B92E6AD91D6826805DEB909DED39EAC319B47949E
                                      Malicious:false
                                      Preview:f".......H.|..?..jC...I.*0..N%.....Z..y....r....Gp0.4..C....Bn.\..@.WS.).Gy...{..g.f...l..a..e.3..W.I.b.T.77..&........;.'...%h.D..i3...}..-..~.c.+%[...nx.....1G..<e ...U...A.....h.[._..?F..t=.]...Y*[F....T..VVH.']....p....(.v.gn`l..B..2..R..y..../r{...x.=.e>.a..Y......a... ..>;..f.r.. R...b..1.......6q...E...1....}.)O...nl4..Wy..J......T"&%4\...-.].T...A.m.0:g.'..j._Y...g&.....6t._2..~.....`.|%i..Q6d!<.)o0T.....'F....w.R..{..".=..p..j..I...<+.O.... P....'a,.<...AX...1...."..(..KS;.V.....[.W.).IB5.Z.B.Ve.P...:.FV....xi..9.....K...^.T......uz.T/...b..t....."X[.....'.8.S.>...3.\.v.h..6l....o9.]../z%.D......RB.F.V.@>.....G........n..e.2....S.z.9n...=..F.{.Z.9..8=!PVq...q?.>.,_...e..V.7./g..8...Df.....#.l.+/....p..P...l...v.9...{..+*.....@,.!.$.0.$/.....>?D.....LU..;V.qF,OM.W...*.\g.V..~5...u......U..1.3.y.....E........84/...H-...o.4.iM.#(./..0U'8....L.t<.....w.1o..'..~........r..k/9..................f..s+.h...X.........'...WG?..."./....e.......&>c.p

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\iSnTquv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4194575
                                      Entropy (8bit):1.5378707297664067
                                      Encrypted:false
                                      SSDEEP:12288:UuW3k30ULgZPT/mEtasJ4CbTtp7n3mL4DQ/M/uNwbxPiIae:UuW+P8lT/mIHVp7Q48/haFPije
                                      MD5:2D96ED6C71F562E22290B81CEFCE9E30
                                      SHA1:0DD0489FA38D0273A3DBB823E1298E4D24AE5A03
                                      SHA-256:D231860810BE291D9BACB50456158C29D55A741267E20421DEC238037CBBD4AE
                                      SHA-512:7FDAD53AAF1B26E68FA681348224BA932E5293DA785289B169ECD80DA31605B5285B3F55B4696CFBE8FBE029383D4E0255750C132BDCEF4836076D5A32032AA6
                                      Malicious:false
                                      Preview:M...A........ ....g....q.Tp...q.]..+....$..y.M..j|..`.B........-3..@...A}</.}e..(..........9..m(.t.yk....`. r[.#0.'.._..yM1..f.\W%....o.E...b.;.D~...l...*..jL.#.y..F.!.>.X...;>3..M...js.m/.j.a..Z.s.......xhQ.l.M...a..z.E.N..-....eKG.|.,!<.dl...\6|.....qX..x.A+......rH.#...".Q\R;4...!..G..%....W..R.2.2......ghV..N..3t......c.t..M..:s..1."n...D....D....G.. *.>.u3.....^%.E&1...RW.~jfu.V......4.p<...0.....;.-.%......T.Q9...Q.5..l.$..W.>c.._q.[.c.^..p.0.tl...m...s.i.........B.a1.lY..js.l......k...1.;....'..[..E.P=W0.O...*..:....w ;!Vn.h.....@9.*..)..;....F...,..|D#....j .....3.dl..T.W.....p..x.....oI......"K...[......._.;t.Y.^..>oM./.;O..@.......J.t.....|.#.L..../...A.ZB.V..F.kC..........hM....g...q.../....Y..!...E...'.f.M._ }!\...N.*.q.an........A%............rc.b.$..=.u.$..5L..j..G.....E.......!. ...qv2.U. .<..]?.}z.l.]u..M.^.2^...o... ...C..e.z..~..I.R.C0..S%.L)....._...1..._.T.g....:..8...x..s....^~.c|..9.....JX.P.f...MbH.....J...K@Y

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\pKGqz3D.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4194575
                                      Entropy (8bit):1.5381756680717824
                                      Encrypted:false
                                      SSDEEP:12288:MGx07zuv0SHyK7AVeUBSu/J/qg221i6tLB4WbO4WIvKd9u:hOXup3EeG/Ig7/NOUoc
                                      MD5:5F1987477C02EF5D78EAC465521097A8
                                      SHA1:B5C85A429A1D700AAD603FEA7437290F7371D93E
                                      SHA-256:7DC96B5DF623E32E888DB73E0449255AA1E10F7AFFFBC0869FE02B7C1DB5377B
                                      SHA-512:4F674ACD16879B8213B7C03BA7E86DEC71D7F4DE0F9FC05EC0DA2F4B3F4C6135ED38D227507FB794BD4F5576AFD223A298CB4AB3F904F44FB513CFD7D555105B
                                      Malicious:false
                                      Preview:C...+.].>...6...............f&...........K..;..4;.>...a..>.r..2$2v1....&.`".D?...6w,G..S?..b...G.}.....SB|._.5....e.cD+.F.]...?..|.AX:...Ne.xa...^...5..\..w.:"..R.o,...C.77.....X....{..6lyb.........e...w._".OxN..uI.Z.r..H.kW.N.{...........y..<2 ...=.@...~).....|...r5~.K...e..r..6..q'...A_.h....=.4...(..U...........yg.kLu.4..../k.:"j4.z.J/......=(cU...w.mV_YHn..v..+..Eu._..j...}z#.Q.XUO.....aD.....VI.B...=..j.8.i.....FL.C==..N...}..."..y.#q.R...!|.b...1.fl....K.N..@....E0..K..?p"..I..{.........C.9...M9.........1n..ZVc.Y.ek......A.;q...,!u....0..G..<k...w..&Db]...E4..Y/._.p.....(..5K.ag....Y.F.w..g].3$...)U.T..?y.WpR.m....jF.).h=|.;aa!.~....vm.E......qWUk.....>..[.v....n.S....2...../L......P.<.......R2.A;5..t....>.....U.\..y.....d..x......1. C.,CP.|.....2R.\..YN`11.....f.V..w.FS..p..Y.......Wr.k....rZ......f7....wbu@t.X0S.glC..i......$.%pK..O..\..i5.o..'...D......).f....'...=}/..`....)6..G.`.....6...eJ...}....*`.C$VDT......V:...........`X.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\sMXFYxr.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4194574
                                      Entropy (8bit):1.5381608383766017
                                      Encrypted:false
                                      SSDEEP:12288:flCB/NuB1WeD0J8mHMeGhKpz3S2THgBvT2gai6l7c8:f6/EMeD0vsjhK1VkvE7n
                                      MD5:0E0D25855E6384523C45C96317027DC5
                                      SHA1:782DDEFC52A68BA8FC133FFD0070115529FF048E
                                      SHA-256:D15982C1EE7FB0C822DC6BBE7D18FD6C9B07E3721CA64636C74E15CCAC1FF832
                                      SHA-512:14F369E8210D7633D226740D73D4CB2CF3B53A02B1A57F41AAD0D7A2C8B1CBB7D8FEEF5843AFF3589E07376C6D8A4C61092785C1BA4075A92C3F6AC374A6EC38
                                      Malicious:false
                                      Preview:.... .O}.....2O&2.V.....G..~..k.u.......=........`.....[L..X...Ku.....#..0._[m6...vI..../.N..`d......a..}.-...8.0..Wo.T...e}.x{.+......1l.(?!......b...np...9....?B.OT.............0...L.....w..wZ......5.}.N.....K6.@QB.[......YC...H][o.%..:..im..c..!..^..z|T./...P.Lu...;.}.%.srV.%.X.o...x...K.J...m.o.W>I.........4.=....|y......).f.!......:%..]wN.L..~.n(c..y d..\....E9...h....'v..D.C..3..p4.#9.w..XM:6..4..*k.$E...{(....o...<J...Q.?.v.....7WB....k.L. .Q..6..q...2[R..;...\...4LR.`.......x.....?qV..O...G..G*.r...v....M....H...w.....L..0...W...|....Z....y....L.D!V.tD.z..>.@.$!.d...Y:........V..._.......m.:G.[....Y@.&..@...5_./........s....M...{..t...S&9.n.i..;a.Y/......q.30[x...P .w.4...w..W..xG.`.k..h`u.E.w...._.>.Or.+.{<.Y.G....U..h....nix.Uri._......$....>...r`3...K....}.q...ZmAMb...`...z......a..P..D.,....O{..1.+.n.f*d..N[..y.h...a.....9.L$.{&..9...n_.~...5...e..^8.!vM.T..=.y...v.....F.)d\l..C.G....[^....7...."a.97bk.....N.X.....<..J...|...?.c.Zu..&.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\NBI1dCg.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):279
                                      Entropy (8bit):7.270794429984686
                                      Encrypted:false
                                      SSDEEP:6:geF/czCDRoRu+ikCadJLWzvNUTEJkAY9mxU0ud6687d4046HIhKcQNJ/7pk:ZcWDuRuMP+1UTEJumG0Z6A546H/c2J/u
                                      MD5:589334819771B4DE24BF64140BE25DDF
                                      SHA1:2605B2074B700F1FF3CBAD5F254A845B5B960C3F
                                      SHA-256:EA7E5887ADC5CF1CB3836D99F872D50114662A687658287EDEBECB62B3AD2786
                                      SHA-512:A18702E9994501BD24B2701611ABF853963E956983A8B9453D15F17E6B17D6FCEFD17EB0D2B323096995D46CA258EF9208BFF713D86505EE6EDE2E27F203262B
                                      Malicious:false
                                      Preview:,g....|3.o...;m..,..=......?=i..(..Q..J.>....8F.......;.@.$.......9......P5.....4.d.^5./~C.....*....1..$\.n...|..q..d.V....#...KU4O..J...'Ei.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\Ah9bDsZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8422
                                      Entropy (8bit):7.977358890494424
                                      Encrypted:false
                                      SSDEEP:192:Y8ck8hARlZ3WiIn8N4kD4zv5r3dHQcIr/RtvzrakJeRiwP:YLARlZG/8mkg5rt9IrZpGR
                                      MD5:B1BA276A8AEE8FFF7BE70A6CB109E38E
                                      SHA1:701E5CFCBD07CAEA8E508727CFF7EE7FFDD27ACF
                                      SHA-256:FAD36FB0834EE059D675947EDACCBA0C5EFB9884400E163E97F242DDFF447ADC
                                      SHA-512:D41A761D50EC1324ED0C3DFB7A66F0C681FEBC428A6C6BEB11A12BFB56AC5057444BA641A5EB386288EDD714C259D7A89EC12526F15902BFE86ACA6E4172162C
                                      Malicious:false
                                      Preview:.=.3....3.......8.+*D .!}.. .....7... .?..=.x.........{.l...O.^..J.75....<.O..VE3....vh.....K7U.$>mQ..zG.._...M..zw.)....-..b|....b.1&.3.b1..9-..!b...+.mW#..u.....&...B...O>.Z1).`.-'.{..G#..4T...D.=.L.j....}......9.....ud......U..+...=...W7..e..eZuV{v..(.N.q......W.<^...h.....(Wc...1-b_A./..S.....6....TU.5j. ...#.XmT~ZRDi.K..s....5y8l..5eX._...2.d.SR.^.M9....:.z.2.\....B..f*ja..J...$R.eM. I...........C!YC..|..+...}...1..G......z.R5.R..c.....&.-...ZJZ.)............,f~..w.7|.. .<....7..7.@...M.O]xuo.a......,........*.r....l.g....ak.J...ylG1......xq.x..../.zv.....L>X.Ws...y..#..B.y..|K|.k.4....j...yX.\.{.(iNo...$..........g...4oY..R..7...I.........:c^.F@.0b6@7....Lb...4.#.%H..c.k...`....(.....U...&.-$M..~.&:....qx.J{'.)&@..V.....e...."9.U?...94.kD......2..O..E)2<.M.?~....E..$..%............xl.>.W..... ~..?....V.!.J...)S..52.D.g...kbrB....ZP:.....N../..d.t.W.(r9....t .t..J.e.....)..n|..2.;..#.3h.!!.....5....J....2c.`:C...9...

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\oxsITlT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):262741
                                      Entropy (8bit):7.99917760356156
                                      Encrypted:true
                                      SSDEEP:6144:+C6Xz3tC0V0ym2DGJZ1K+x+sJ2UBblyvRn3VnKiNrsc0qOX0+8p:+C8zLat2DGJZE8fJ2ulIRnFTxsDX0r
                                      MD5:62FA6A2EE03249D3EF7BD5B68561A5C5
                                      SHA1:91FD54CB074AE29E51B54EF041D03762FAEB046B
                                      SHA-256:CC92B9480D5D119E084707C9F900E306FEBC3138121CDF656871DBBE8247825D
                                      SHA-512:27926B8311026525AB1A6CE5EF5105C2E04019A516F191A77C11A446364BBD9D621C500DA2E257BA3D1C0EE89F06910CE49586FAA3AA33DF737D80E1110E7187
                                      Malicious:true
                                      Preview:,...5j..;2...@Es......X-.r..SrM...2..J^...do..4..S_..*a)sht.{.._.4\.7.OJK.w9y.rM.aq.&...A....~jX_.z.f....z.....X..f....A....j....@..CpS....\....V?.T.v..:$A..:*..YZ.a.]..\s..b..UJ.Cj.W...c...g.6ge.s@~.........V.+.B3.VL$.`4..!.#Is..[&.U.....{d<..*M.3...a.vW.c.....f.......7Z.....c...S...Q.#x.h_....D.y.j\Ah.~/%w..l..C..E ,.d...............XCY..[\..i..."=.F=_..!U..v3.|]....m.%.F.u.."....-./JE.O....~C..PZ....B..{t?Fo,.........A......8L..E.. 2 .I.8....`.l.Q.>..&.......Of.A......8PN..w.I4..>Y.@..[..s.X9.....U^X.........=`.J).E.Y&M.....".2.e.......C4...]S.N.h...........&.].........BT..j..=..Q....K<..,3#c.I.ws.........w.WJ..\....aO....6.M..j..yl....uB|~.=7.9.4.&V..oa.T;-..a....L{.$cqE.0.)..}.,....../j.I@...)....C9.c.*}G.\....4.1A.QI.>G..scz...8tV....9.w~.qx9...6......O.,...M.y2.(.h.<.N......kNY}..... .).......8.4W.j.Qzw...N/H.1,)...2|.7...C..F.P}`.....7...$.%8C..{.&..$'y$yM..k.w..2..7..`..<..F...........d.. 5"_31...-..p.B..i...x=...-..'/#.

                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):0.09216609452072291
                                      Encrypted:false
                                      SSDEEP:3:lSWFN3l/klslpF/4llfll:l9F8E0/
                                      MD5:F138A66469C10D5761C6CBB36F2163C3
                                      SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
                                      SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
                                      SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
                                      Malicious:false
                                      Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-journal

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:SQLite Rollback Journal
                                      Category:dropped
                                      Size (bytes):4616
                                      Entropy (8bit):0.13673511612852962
                                      Encrypted:false
                                      SSDEEP:3:7FEG2l+660H/FllkpMRgSWbNFl/sl+ltlslVlllfll7:7+/lFnBg9bNFlEs1EP/r
                                      MD5:D88C0A41F511B4C85819758410D20BDF
                                      SHA1:23312E9041647A87C255A5BDB0A7056B215ECE3A
                                      SHA-256:781789C6C6F5F4F06408EF13A6ABBD17ACB935F362FC312FA8627E8E836DB3E0
                                      SHA-512:4EE68315FEEE7E0BDD2B0890E1336FE42D3A736F9115EE228F131E2365DD0E825D7B65853512D4DD7FB96C148E95819359E6D9BB6CD7F991D1AA3F6A864EE709
                                      Malicious:false
                                      Preview:.... .c.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-shm

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):32768
                                      Entropy (8bit):0.04445419730877624
                                      Encrypted:false
                                      SSDEEP:3:G4l2Gw3MdpU9ol4l2Gw3MdpUlslL9//Xlvlll1lllwlvlllglbXdbllAlldl+l:G4l2Gw3cl4l2Gw3gL9XXPH4l942U
                                      MD5:95632AE3CEFD3C8C3B73FDD1586737F9
                                      SHA1:77B9978C4DB0537E03EE5607A0E016229EE5CE57
                                      SHA-256:732AC79C47C2469FF751734ADDFD66C363D3CF0FC57CA7BAACB4DEEE4656044B
                                      SHA-512:CD76DAB3E774A7C46E6C4EE87DFE34D975F7E29AACF625F83F1DFF2E1E996A7918D43371296591081B8E7A8F878D8694249BA108AC9C1B152EA2D980662C58FD
                                      Malicious:false
                                      Preview:..-.....................H....]|.ii..q....7......-.....................H....]|.ii..q....7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-wal

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:SQLite Write-Ahead Log, version 3007000
                                      Category:dropped
                                      Size (bytes):45352
                                      Entropy (8bit):0.3931158633576983
                                      Encrypted:false
                                      SSDEEP:24:KrVq+Q3zRDE6Ull7DBtDi4kZERDTwfyzqt8VtbDBtDi4kZERD6:qVq+Q1o6Ull7DYMOyzO8VFDYMG
                                      MD5:7D96D826234BBC80436D7BCEEC5C4C4E
                                      SHA1:4A8DE4D63894469B6198EAE15B95407522ED174F
                                      SHA-256:1C615440F6551656A580558D3B7598D4D334D84900B11DBCA44A2B64AE8CA138
                                      SHA-512:B9032F8481221F5A0044034D60C5DD59197A5FF061EE29C03D8912222FDFE4F582676C3AD7918B8960BBBCE5B5102F26EE9299198BA78423B345AC9E4A069E9E
                                      Malicious:false
                                      Preview:7....-...........ii..q..Pl..K..........ii..q..S...S/SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000000.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Sony PlayStation PSX image, 4-Bit, Pixel at (2952,0) Size=4x0
                                      Category:dropped
                                      Size (bytes):49152
                                      Entropy (8bit):4.858267943485038
                                      Encrypted:false
                                      SSDEEP:768:RbwZ2Zex9TG3o9DOSSwMYjI3/1JiMJTaAXu9pkvVkvaWGZ3j0y7Dk:RbwZ2KG4ZBU3/7vJzXoaVa
                                      MD5:AA1AB34693FE0DC8F7F1C5BC4D6B75CC
                                      SHA1:B0C1D6DCF919BCDD53E1962D3D181B6CA2154EDA
                                      SHA-256:4ED3E091913F3D6A70ACFC684E1F34F3AA8DE8CDCF11A154D220ADEDE2EA94CF
                                      SHA-512:CBF0F07DCB4B150F179AFA3145F7A14AB2EE1A42204F866304FDC03E70C9BADB93317EF39CAF53CB89D9AAAE11BF8798BC54AC79B1ED99A6D4E5383F0E156710
                                      Malicious:false
                                      Preview:............................7...P...............P.......X..Z.......................................@...@....)..$..F....X..Z....o...).S...k>S.g|........8............'..P.......t..@L..@....)..$..F....X..Z....J..@...@....)..$..F....P............'..P....................3..H`...d...*..V..@.....V...5....qKK5........................... ..............................................................?........................................................?.............@T........x....:.1.j'm5......U.....v*X.SW.........(............................/...L..hA..H................................................?..................?........................................................?..........................p................................?..........................................................................................Z........x....:.1.n.........U.....v*X.SW.....:.1.j'm5....................P........#.@.......@..p.."..0uI.......o...).S...k>S.g|................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000001.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):0.04401584019170665
                                      Encrypted:false
                                      SSDEEP:3:RRk//:Lk
                                      MD5:CD74ABACE8A00B17BD8107BC5982C21E
                                      SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                                      SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                                      SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                                      Malicious:false
                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000002.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):0.4902311391318697
                                      Encrypted:false
                                      SSDEEP:3:vldawlAuil8xt/l2lLa/npd1GjFP/tljFPpnllOkdnrKd1t+Xl2hliJw5YCnk/x5:NTcm/pUhTu3M1GwJIk/xPmw1EVzB0
                                      MD5:5F2C27DA0D53D37BCBF45BB22FB695D9
                                      SHA1:5BA522412EA2361D01E585B71DE2931B7E02F60D
                                      SHA-256:9ACABD31F13C5AA2EC17DC4B33381AA7B5CF5EECF155D26E70BF5019A030B8A5
                                      SHA-512:D9A019CE22ACDB93BB6122BA621E74B8929B9A4ECEF6082AAEB8012464B1AB697551AD2CC2636FC2AE8B54FB268A6A12A3F3BE8214A98C76181707741C0CA298
                                      Malicious:false
                                      Preview:2...>...........~.........................................................................................................................................................................................x.......x...F..H....T..........................x...F..H....T..x....................................................x...........................................................xP..............................................................................5........m;.H....7.5N........6.#..:........aI.7YH.L.r.^.v......N...^...........................................................................................................aI.7YH.L.r.^.v..............................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000003.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):2.86185007641594
                                      Encrypted:false
                                      SSDEEP:48:e23EdVxz3LPExyw0LQOd6m4Blkw0LbuY0ksCLYwEwLr0VWdWVuFSm:edxjzExyLE/m4gLH7wCREwUVPVsV
                                      MD5:285BF5FDAD2E46A859600A70FB0B8F24
                                      SHA1:885AFD14A2445C0DCA822417CC3CA6D0E2333161
                                      SHA-256:4696FED04FACFA52EBAF7E3B8E127A28EB456A380CE1D572CAA8C461E3FE3BE2
                                      SHA-512:AAC8586E68C37DDB9BC6AAA508EA512445697D761074008611B6BE9FB760C7A18A6A31B6A5F221086969CF173D7448CCC084438362C2F60732D7E39BDAAA9A0D
                                      Malicious:false
                                      Preview:0...`...................................................................................................................................................0...`...........................................[.......[.....}..d.3...~a.......a.....w.....sC..[.....}..d.3...~[........92."...D.C`....a.....w.....sC..a............a.......a...................................................5......5.c..L.......ba.......a.....w.....sC..2...^...........,...............[....5...9.-.Q.zNX..p..jP........5T%t....9T.N..-.QT&...zNXT$...jP.T.:..a....5..a...."..a....o......jP......[....c..,0...e...B4.$..........C@RQ.H..B......Y......................9.......9eu{.N.}.w4.. .p.......p..c$'...&y....-.Q....@...c..v.-.Q.jP...7.C.p......jP....9eu{.N.}.w4.. ..9.....>....................92."...D.C`a.....w.....sC..jP...7.C.p......jP......jP...7.C.p......a.......a.....w.....sC........5......p...c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):4.707720551893674
                                      Encrypted:false
                                      SSDEEP:192:ns/u67k5IqPXmoxRieS7bMpkgLtAZ9IjM9:s4WqfbxRiB0tKIjM
                                      MD5:F792B799F0E1D7E392C441A90479BC99
                                      SHA1:787D2671C67F2680ABC98D6C0204B03EFB7C210A
                                      SHA-256:569D1B28A43CC8DA34BDAF7BBBFD089FB36379C5B29CE6339804C5D50F26BDDD
                                      SHA-512:C8E2A19C2447EBAB2F75D78FDC4E61601D1D985C92E0F840C5BDB6BA8E6754960F545C0F6AA262ED237BFC7B8FD71D524AE446E600D013FB91154B1CE0D99BB7
                                      Malicious:false
                                      Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ..b.4.....b..Zj.&....^....b..Zj.&....^....b..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............V..n..r...g..;.#....N...^...............l.~:..A..}).wg.............>...............................$....I.qk..B.....LZ............V..n..r...g..;.#........V..n..r...g..;.#...........b.......b.......b...........................................bj......bT%;....b.......b..W....bH......b..+....b..S....b..........Z4...........................................4../4......p...............C.a.l.i.b.r.i....................b:..bk..b..z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):40884
                                      Entropy (8bit):7.545929039957292
                                      Encrypted:false
                                      SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                      MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                      SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                      SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                      SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):4.432689836058189
                                      Encrypted:false
                                      SSDEEP:192:vsKPC658l7cIXGfkiw8LW8X9bq8wk9NNSRpmD1DN7QX6lALRkDauL+1ANKVsXr9i:kKq6mlII0kp4W8X0vk9NWpmBDs6lALR7
                                      MD5:89E5036D979C415416F19FBACEE12DFA
                                      SHA1:BB4E117A2ED73EEB94553B05FE2B1CA7C323E3BF
                                      SHA-256:8540533F847C367755915603B8B6DA57D52EEAF88209CD66B3F2050AA5D385BD
                                      SHA-512:3F3F3928EF7D550CC9F15881079502E411506D518FECAD411301B30A859AB043D7691CED6DFAC9868E2DB793F978BBDA14423500330FC322D33286009C025E4B
                                      Malicious:false
                                      Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZM.i.H...M.i......V%..[..M.i......V%..[..M.i..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............y..`S....*P..D....N...^................{QqO.)O....ojk............................................"....I.qk..B.....LZ.............y..`S....*P..D.................................M.i.....M.i.....M.i.........................................M.ij."..M.iT....M.i.....M.i..T..M.i.....M.i .A..M.i.....M.i ........M.i3M.i:M.i8M.i..z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                      Category:dropped
                                      Size (bytes):24268
                                      Entropy (8bit):6.946124661664625
                                      Encrypted:false
                                      SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                      MD5:3CD906D179F59DDFA112510C7E996351
                                      SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                      SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                      SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):4.6519821082642645
                                      Encrypted:false
                                      SSDEEP:192:7XbsZwILpdWs1yq/uaGhjbDCgRJ8vH6z+nNKLX+df3RpwLdX8HdtSrAygdL9WdQU:7XA26pdWOGaEjagcvH7No+df3RpXdt43
                                      MD5:130301DED4FC1FB28384840F5EC26A8C
                                      SHA1:E4D21035AB0053BAC8FB1065128C3E51468A98DA
                                      SHA-256:6A8861C55E6B35D657F5FFB111C54EE48802EFA56B053001006AEC8039532A87
                                      SHA-512:99575ECA2EB2C4494FACBD2E398365778E1D1F5E6010E1D03C2162B4F3079B3CCDD40900D4D12E21960F55A814F44538FCCDE460B3AB290D050EAE86C9B04F31
                                      Malicious:false
                                      Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZR...N...R..<.(.....p|~b3R..<.(.....p|~b3R....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................v...,.G..a......N...^...................T.C..-..d..............P....................................I.qk..B.....LZ................v...,.G..a...................................R.......R.......R...........................................R..j.9..R..T....R.......R...s..R..H....R....0..R....`.&R..........R..3R..:R..AR..8R....z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):39010
                                      Entropy (8bit):7.362726513389497
                                      Encrypted:false
                                      SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                      MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                      SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                      SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                      SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000A.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.9063481379379024
                                      Encrypted:false
                                      SSDEEP:192:osia9vk0MKeZ0C0T8b0W8XRertK/0H/o00mrX4PKB883wRZKi0J11KYxKz0H870R:dPv7eJ04GXReoc74SGWwRgNsjlyp
                                      MD5:84E9EB24FAED1F52FF513D3D54881130
                                      SHA1:CC3C46B4204CABDCA60C5B57B0B8D9AB98EB1E6B
                                      SHA-256:6D7B3D25533667D3A24BED45E349764352F91F4922F200B2940D0229AFCDEA5C
                                      SHA-512:C0904B60F62CF24A324F6BAB3667E98FD388B1A5943DD00E494287752091A9035FD51691BB482651B0997203D3F9960288AA98C3FD4BEE1F63E86BDC1FDDCD31
                                      Malicious:false
                                      Preview:....>......."...v.......8 ..."......>.......r...v...>...@....!...........................................................................................................................................I.......I.qk..B.....LZZ.......Z.....z.5Z.....Z.....z.5Z....~Z.....*.7.K.....m..i..*..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'............."..M.C.."..U. (.....N...^................[.s...M......,z............(...............................z....I.qk..B.....LZ............"..M.C.."..U. (..................................Z.......Z.......Z............................................*.8.....*.7.K.....m..iZ.......Z.....z.5Z....~2................................I.................................*H......*.......*..d....*.......* ......*$.7....*.......* ..........*!..*..z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000B.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):59707
                                      Entropy (8bit):7.858445368171059
                                      Encrypted:false
                                      SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                      MD5:47ADB0DF6FDA756920225A099B722322
                                      SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                      SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                      SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.8793747150527826
                                      Encrypted:false
                                      SSDEEP:192:SDQ0sfUWnxUXPmOmaGkZqXs9osRlHbACxaA69m+0ukjQ/t:SDQJfUjX/tGkZks9osRlUCdCm+n/t
                                      MD5:ED92E99E0188FF7924899FF5F999C1BA
                                      SHA1:46D1124F6289D9F77D7CA79080B6D280E0442EA3
                                      SHA-256:CDC98524F37036735AA8D8F0F9E17CEFC20C4C8F45CA0BE6EE5E4B5FF465FB2B
                                      SHA-512:1AF740BF89AAF8BC748D438CEBDB4178DE4074F23094622CF1B74B6AE663FB5B607E6832586ABD588D980DA4873E3FD0C911C2F69FFBE119B0C3E25520BBD2BD
                                      Malicious:false
                                      Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZS...<...S....DO.-#x.(..S....DO.-#x.(..S....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............._.po.}......F.....N...^...............<.].k.[O..:.................................................D....I.qk..B.....LZ............._.po.}......F..................................S.......S.......S...........................................S..j....S..T.T..S.......S..|..S....;..S....h..S.......S.. .W.....'S..2S....z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y........................S..3S..8S....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9.............S..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                      Category:dropped
                                      Size (bytes):27862
                                      Entropy (8bit):7.238903610770013
                                      Encrypted:false
                                      SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                      MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                      SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                      SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                      SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000E.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):5.339973297113939
                                      Encrypted:false
                                      SSDEEP:384:bBf67tNOQzbibfxMdY4YFAyb0fLAF8YewSSIgkw8dDPAdSFK9uydDPygXXg:bY7VuV9QWPjKLw9Bj
                                      MD5:07737C967DDC70DA4C7C4EDA4FF3CFD7
                                      SHA1:BB7DCE5DC219502D8E15B5F409015164C1CF2F01
                                      SHA-256:DD3588D427B5004CAE0B2558598C96E01C4D2D3F098E29DB67AABB2CF85D3289
                                      SHA-512:3E05B15DC8301A6624804C451DD54AB8F1B3844E4ABB2D93779437FB2697817FC2FD895D849E4BEDEB6914D7CCC93F7CEC5D6764E09195F9B472E7B34B5103E3
                                      Malicious:false
                                      Preview:...@...@L...........d....@..H ...L.........@...@.................J..H ..pK.................................................................................@...@................PK..H ...K..........................'.K.]..../.........(.u...o({.%.....7.......7..j.....k..TW....G...%..k...nK.u.q.7s......nK.......................................................................T.......T._.....T......#T....^~*T....d.3T....i-8T!d..Z.T!............0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.................D..p.....n.......n..Z.F....e..2................................................x........n...............0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0933683691430485
                                      Encrypted:false
                                      SSDEEP:96:0sNLkyO/dXmL8EauSXi9ehpT8n9RLg8ikR9JbC:0s2FXWZauSXi92I9RLn
                                      MD5:12C5031DB6CD9068C851D67282DEEE0B
                                      SHA1:98A99D8EAD8E0221CF5F94B87E8E1E3826B70AD7
                                      SHA-256:4A028AB71234DDC35B1AB432D2680A84ADBB9531DFA93DFCCC6A1274C900BC9D
                                      SHA-512:2264D0654B20B8CFD5C68B43FD80560DC8721DF10BA4CBE2D4C934135FE46F2ED18DBAFA36DE898959DAF9CC248185AD0496148691551655F5449EB511F96771
                                      Malicious:false
                                      Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZJ.?.....J.?Ngz......T.2J.?Ngz......T.2J.?..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................|.-...#.Y.......N...^................|.A...F.p>t.m.]........f........................................I.qk..B.....LZ................|.-...#.Y...............|.-...#.Y............J.?.....J.?.....J.?.........................................J.?j....J.?T.]..J.?.....J.?..B..J.?H....J.?..B..J.?..>.)J.?..J...................;........4...4...4.."..............J.?.J.?.J.?..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........J.?.....J.?....#J.?............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.097094343767551
                                      Encrypted:false
                                      SSDEEP:48:BsZHSZ+la0g7tRtMEfmh7uKXs7uK9CAdUCToJxJrdqreI50dX2OkHzQa:BsU0g7ZMEAuKXsuK9CuUCT2JRyJ07uQ
                                      MD5:D7EAF00193FADE6505F5BC91452AF066
                                      SHA1:FEB530131B50A536511E2DFC90465D3B7C628777
                                      SHA-256:02E63205AF42AADBEAD9A8E34560C4EE6A389E56FCEE8238FE2C4CE123CE693D
                                      SHA-512:1E6E5DAA74F9A010D8D74CBA452CB4D9374BFDA969D4F32EF4E78E712AAFA4CFBB7A4B6E9902B46D39C2CA64724A9148C83050D39EC48A58AC2B92A3764B52A8
                                      Malicious:false
                                      Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ............[j..!....BV.....[j..!....BV......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............j.o.............N...^.................M..iSG.f..FF.........f........................................I.qk..B.....LZ..............j.o...................j.o.................................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.067579286322266
                                      Encrypted:false
                                      SSDEEP:48:Ns6r6vLogxMU/tcB30E3piXk9idWTofJrd6rTIKdXijIbi8L9GZ2sQg:NsoAoc/2iE38Xk9kWTURi9KgH9GzQ
                                      MD5:D898B750EE9F963F0AC5E688CDFF908B
                                      SHA1:50CCD8E5CD75CADDC42D70BAE5033A41E308B80A
                                      SHA-256:80F2E47E63F1862A17439A74B2A10ED074DA027A347D5B5C99EA37200BB47A7E
                                      SHA-512:4124A2DAD45F86757EA32FE08D145A2A8E5EE1DEE2470E12D75FA7819B3EA0325CBCDD7B4AE2224DCDB7AB67B96C8F46D334DDAEDB654BBF79D357275E2A6B6B
                                      Malicious:false
                                      Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ.........t@..%...S..5..t@..%...S..5....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............yo......)=1..Q....N...^...............G.XR.E.I.,..'.S.........f........................................I.qk..B.....LZ..............yo......)=1..Q..........yo......)=1..Q....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0438260489296285
                                      Encrypted:false
                                      SSDEEP:48:tskdC516/tiTdTAElBXw908ToTrdnrOhI4dX6bPyS1qg:tsr16/yuEDXw908T6RrO1q4
                                      MD5:495C6FD087D0B3180CEFB968E34EA77D
                                      SHA1:8378DEFB758089A3424602322D30A148ED30CFFC
                                      SHA-256:493CF51ABF729B0716B250D56963AAA930ECAD6BBF60BAC7CB5878B052484117
                                      SHA-512:4653C997563EA0460225E811462A19A81424C344C490C59355C96C9DA3C81875247C1B69A9EA141F62B65185DCDFDBBC7BFFF4CE5978FDF55665CF21A14CD3BF
                                      Malicious:false
                                      Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZt.s.....t.s.{.L.>#O+.0..t.s.{.L.>#O+.0..t.s..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................M........A4c.....N...^...................Ob.B..v..h).........f........................................I.qk..B.....LZ...............M........A4c............M........A4c..........t.s.....t.s.....t.s.........................................t.sj....t.sT.]..t.s.....t.s..B..t.sH....t.s..B..t.s..>.)t.s..J...................;........4...4...4.."..............t.s.t.s.t.s..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........t.s.....t.s....#t.s............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0673653226209705
                                      Encrypted:false
                                      SSDEEP:48:lskxMEmNF/TtIlZIEHhgXE91lLoxTou9rdqrCU/IldXm0vyqIg:ls/F/TmiEHmXE9vLoxTH9RyCUm8II
                                      MD5:41D59648BF184EFC7205DBA73FAD881A
                                      SHA1:65F5F893BE62A5FB82F6F7675EC5C9C25EBC11F7
                                      SHA-256:45E4D3679541A1C55EDC4F6B99C9DF93CA23C2107427FA7E2FA622783C058667
                                      SHA-512:2D1586E7B4CD5981E0F45875A1F2EB1999109AC4BEA05059F37A481F2E52D72C29519826090921505090FF0F2CFECB877ABA38F5574F8F797839162AC19175B7
                                      Malicious:false
                                      Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ...........r.j..-....l.....r.j..-....l.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............5.......$.gpcL......N...^...............Kz....E.4l<..%........f........................................I.qk..B.....LZ............5.......$.gpcL..........5.......$.gpcL..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000K.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.094731626644193
                                      Encrypted:false
                                      SSDEEP:96:KsG8WscTEvWXlW9RfTDRPHdFom2YFnOS:KsG8WsLvWXlW9RfnRPHdFom2YFOS
                                      MD5:3522F5BF10A60E72A467A96C2980DB04
                                      SHA1:0225E69254118141922F3047D47B10D64F64A133
                                      SHA-256:92FFC287E2A4306A4EF326548D55E4849A84041C99649EC070744563AF7423D6
                                      SHA-512:A522C50A277E1E917E3C42B84CAFD0B282E2F19DA39AEEFB8FB444DF8C20F6F4AB1513035B152C4E45D6A9CFBB6E3FE3DDC4FCBF1C5A8C5F67F9BF569C2944E1
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.N.......N.O..{.....F...N.O..{.....F...N...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............j..*J..5...k.......N...^.................@.,.?@.V..Q.8.........f........................................I.qk..B.....LZ.............j..*J..5...k............j..*J..5...k.............N.......N.......N...........................................N.j.....N.T.]...N.......N..B...N.H.....N...B...N...>.).N...J...................;........4...4...4.."...............N...N...N...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........N.......N.....#.N.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.072688909438785
                                      Encrypted:false
                                      SSDEEP:96:Cs2nbcgDIEZ3GsEYvXA9D0suTcR2xbC1Rl:Cs2bcgDIEVIYvXA9osugR2xbCr
                                      MD5:991AB058B8BA8F02E7F15C81E78FD1E6
                                      SHA1:4E160F2251BF894ED8C30F2E53CA0EB35331681D
                                      SHA-256:8ACA05C6574993999C68D20EBE1C309885B6F31830D3A42818D7C71E41ADE0E4
                                      SHA-512:CEB7204E7EF264F1EAB447BD2B886F3A0AF68A582FB52B1AAF833FD8CD2ABB959C5C8AC1DEB7F44A8CD35D931A3C724D98ADFFF0631E17EFFCC77820BE92B873
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ"3......"3..... .6..{."3..... .6..{."3...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............'..q.v..B...$'....N...^...............i...O..A................f........................................I.qk..B.....LZ.............'..q.v..B...$'.........'..q.v..B...$'........."3......"3......"3.........................................."3.j...."3.T.].."3......"3...B.."3.H...."3...B.."3...>.)"3...J...................;........4...4...4..".............."3.."3.."3...z...y.. x.. ...........$........4......7...7........................;........4...4...4........."3......"3.....#"3.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0740166617002815
                                      Encrypted:false
                                      SSDEEP:96:YNlsRKzsktrRMTEwXTY9dHTbRHJFz0SwO9:ysRKzsMRLwXTY9dHfRHJFz0SwO
                                      MD5:F9FDE6636D571F52329E54A3A178F20B
                                      SHA1:2FF602414E4279ED921966D4D67A5D34BFB3CE88
                                      SHA-256:3D7E0F51D883B7A6B77FB0E29F95B7ED5199513541DC1301BD886DF2E75B7808
                                      SHA-512:DE1906DB20A6456A5861F6003D22BC508FE1C3E5DF66B8CFEFB5C2E85EC8DA3DAEECEDC70E570D2C07B6C958B6EECD2F29CC4EC941679C2ED7998F9AB3363300
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.............Y1."..WY........Y1."..WY........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............h\.....+....B.....N...^...............%#...a.K..2............f........................................I.qk..B.....LZ.............h\.....+....B..........h\.....+....B.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.075007617230232
                                      Encrypted:false
                                      SSDEEP:48:YxsqtYeK9KaOzRtGuEXgZRKXZK9CMpjToF0rdPrN3IRxdXZZRBKSIAlV:6sq2KaqRLEXgfKXZK9CyjTPRjAxQA
                                      MD5:5895239036BBEDF5F66D275E40297129
                                      SHA1:7BC88348D68B2284A88425DA873493F8BA4EDA4E
                                      SHA-256:F5CCBBBD661CD924B0F7AF9A0F746E5C6B8F18F0C0B4AD8E95E3857F6E2FDAB2
                                      SHA-512:0C2694004200991A0B1DC38D6CA820947CC2C573B3138CD60C582BC14E33914B8A3B2BF54024711065FCCE5138247A2E34DDE10FD108AE977E5D649C9CD68E0A
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.............P'...1.b."......P'...1.b."......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............g.......?..Q!/......N...^...............%.+k.)@..q.K.i5........f........................................I.qk..B.....LZ............g.......?..Q!/..........g.......?..Q!/..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.100726938407111
                                      Encrypted:false
                                      SSDEEP:48:YfOksd4tOlcCtbVrI6ttbKGE82XQ9O36JToIrdQrqINdXzNRflcRnFp3Y1ll:WspRbNI6tzEnXQ9OKJTxRIZt3v
                                      MD5:1D414759DE1D4B05E091A9D099848577
                                      SHA1:C7917C7D9744946C48B3939FE8FE34703ACEDC7F
                                      SHA-256:9F56024CF2B64F8AF503D4D7640B40755C286E21C453BAD4D3170E76C8DD5CF0
                                      SHA-512:117A32466E39D183614D4B68F02B16C6F1A39FE4B5F78FB5C34776FFC58DF157975B2E167EAB1D9C9B2FFAAC4ED48C9302917561D2D20CFE226A4ADFB935AD7B
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J...........................................8l\7.....I.......I.qk..B.....LZ........8l\7.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................DZ..$.@.z.....N...^................c^.|.GO...x.].........f........................................I.qk..B.....LZ...............DZ..$.@.z............DZ..$.@.z.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.085664087969886
                                      Encrypted:false
                                      SSDEEP:48:YCOsltj2aG4+tKKELh9dXAR9s8dTo2j9rdP7rUIZdXh5NRgS/jZp:HOsSaG4+TEfdXk95dT3xRfzOcjZ
                                      MD5:27E0D4D0EB56D334DCD17ECD0B04C4BF
                                      SHA1:EF7067E9B489E759F8FDB9430379496C2A49183F
                                      SHA-256:94727DD7155ABC8B096EC422C534E540727A30D3125E685EB667D03954E4FCB9
                                      SHA-512:AFA8C0C8431D51A543B010092451F9EDFFC3B2FE481EDBF0B2AF215AF465D72EAC8FD5BCD76FF57E11E40D792CBCAB2E6902972F76C1A04E44923C7E4BF4CA1D
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.y.......y.z.=H.-t..\H...y.z.=H.-t..\H...y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i$.p.X..6....(.....N...^.................}.?.GD...ep.PR........f........................................I.qk..B.....LZ............i$.p.X..6....(.........i$.p.X..6....(...........y.......y.......y...........................................y.j.....y.T.]...y.......y..B...y.H.....y...B...y...>.).y...J...................;........4...4...4.."...............y...y...y...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........y.......y.....#.y.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.073000392186264
                                      Encrypted:false
                                      SSDEEP:48:YPVsJmdl7Ka6YtUzmEFnoXg95M0ToSrd2troIDdX5ZRagl:wVsYlea6YKCEFoXg953TzRexr
                                      MD5:9A8507C7FFC229331B8A15A6F12930D8
                                      SHA1:5C86BAB9B2F60D481F7C327089E66FD8E279E1A4
                                      SHA-256:2A3891D1C686E77C647AFAA45E674F9CD6A28924727D0970695490ECF17A49A6
                                      SHA-512:96B8DA96A61D40AF949B94FDB802A201914BACD8FBF19A78A89B237F85F4721EEF0F4CA5AA4F16146B91FB90CC361E012DB7A132DC22270CD8CF75D9241C341B
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ7.x.....7.x.a_....%...#27.x.a_....%...#27.x..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............-U..F~..'..:].t.....N...^....................>C...l..K........f........................................I.qk..B.....LZ............-U..F~..'..:].t.........-U..F~..'..:].t..........7.x.....7.x.....7.x.........................................7.xj....7.xT.]..7.x.....7.x..B..7.xH....7.x..B..7.x..>.)7.x..J...................;........4...4...4.."..............7.x.7.x.7.x..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........7.x.....7.x....#7.x............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.10191974080082
                                      Encrypted:false
                                      SSDEEP:48:tszfQq5WjItJftgEt9XI9sHy6V9To4rdfokr0MIRTdXfSk7+Usa:tsbcjIBgEnXI903V9T9RfH0nswjs
                                      MD5:0154337DD86950AD929FC608CF137C01
                                      SHA1:B8BD09149D294EEC94656F108D8EA27D57C67BEF
                                      SHA-256:D20ED3A3AE9DCE4F86E2AB1E90CA30DFAC39A32F45E7B68315DB1B9BFAE44C33
                                      SHA-512:1DE0FCB2C4D1142DA7B5BF7E925CCD94D4AD16D36F21CF85599401F624000834B718A3D6DCD6889DB7CD13722E7CC049AF3124E3254823043021FFB763B33EAA
                                      Malicious:false
                                      Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ.VM......VM..#....bl.[.VM..#....bl.[.VM..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Q.........~.(.....N...^......................M...O.B"........f........................................I.qk..B.....LZ.............Q.........~.(..........Q.........~.(...........VM......VM......VM..........................................VMj.....VMT.]...VM......VM..B...VMH.....VM..B...VM..>.).VM..J...................;........4...4...4.."...............VM..VM..VM..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........VM......VM....#.VM............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.065584016055153
                                      Encrypted:false
                                      SSDEEP:48:+aDsRAD9LmFtSstgEno3+X4927Z8TozrdlriIAdXyxIVksIR8a:NsCxmFhgEBX49OZ8TuRpcXVYR8
                                      MD5:F5AD975CE1C49312C63E863A50DAB144
                                      SHA1:F92CF6BEC7CA56DECF2D48339C9D4C6EC6FF93C7
                                      SHA-256:F8BD2973C7E49F48D1EAC87D083B4414F2ADDAC81F8AC5E4AA45AC77FCEF733F
                                      SHA-512:3B024B24838C12E5933473469D2CF8FEE56DC7A6270AAA43D02B8C42B8925D30A25020951634A2D2035015B8591C88434ED0969105F827D8C93CFC3101C89735
                                      Malicious:false
                                      Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ..........z\S..C?...v....z\S..C?...v.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................7.-..$.......N...^....................U4N.2....|A........f........................................I.qk..B.....LZ..................7.-..$.................7.-..$.......................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.090211373423316
                                      Encrypted:false
                                      SSDEEP:96:ZsH9Fx9mtcE5X09mHTbRRwogeBdbHgvhFo:ZsH9FxW55X09mHfRRwog2dbHg5Fo
                                      MD5:0F6863A71A5AAD71443998AC896CF9C2
                                      SHA1:773D77FC37209F45FB71636B20F88F787D71984A
                                      SHA-256:77CBDB68ACA0784D89CA2F8ACE2B972BA676714C7DF1E4B2D42F19E13D5F3200
                                      SHA-512:1E6094974245BA9E8B80C312AA1B0052A94AC5B3267EA1B90BDAD311949BCFB74352AEB30659D408222E33B014F8F1DF7ADFD9563B7137437FF580D7B2FC71C7
                                      Malicious:false
                                      Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ................6h...qz........6h...qz.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............Uj.q.-.Q..XO.....N...^..................e..D.....#T.........f........................................I.qk..B.....LZ..............Uj.q.-.Q..XO...........Uj.q.-.Q..XO.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.146217793119528
                                      Encrypted:false
                                      SSDEEP:48:2sHWBiG6T0tr0EtXoX/o9XjhMTonrdjr8rhIodXabC+7532d3+7xzBeSig:2sxG6T0WEqXA9VMTGRv8RMpNlQ
                                      MD5:627C90BD0ACFD066B110E04413C79796
                                      SHA1:543A1838A2AE7ABA2D42259A2F457AABC98182F8
                                      SHA-256:2D7EE22D22DB9A9D48EC9E2625DC947EC56C15E225CD68BF4AD22DF510534D43
                                      SHA-512:B9F07503851502174EBBEA7A70B3ED9185BFD1313083B67D4D504E85A6E0C3EC9C9A9D67B0D0A223722EB60FF1306C4EF1BA80E84EEB5B809C94E7D3504C1473
                                      Malicious:false
                                      Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ\.......\....=......~x..\....=......~x..\....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h....0.(.So.(.....N...^................=7....N....v..........f........................................I.qk..B.....LZ............h....0.(.So.(.........h....0.(.So.(..........\.......\.......\...........................................\..j....\..T.]..\.......\....B..\..H....\....B..\....>.)\....J...................;........4...4...4.."..............\...\...\....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........\.......\......#\..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.1749658734776816
                                      Encrypted:false
                                      SSDEEP:48:oC0syJpZmlUxDCA8ptZaMtEEPlOTpXmp9AGAToArdQrSTdI6dX6bUmlRyqVvhhig:B0sF+ZCA8pZEEP+pXmp9ALTFRIYSf
                                      MD5:0BACB2F018683AD2298C98AE013615E5
                                      SHA1:BEF35DA29ECCBB94F46C837D803C80F962A22863
                                      SHA-256:9097509E9488B0C1C912A7E59ABCDF0080F614CD0DFC574DF19F4120954CCD97
                                      SHA-512:14B5F1666D4165FDEB5850D4F8389A0E2F4B06B537B1EB438CAD74C6786B27104935F87C509EC6459CDFC745781D8C1540869F1EDADB451A7DA479A30D4B2142
                                      Malicious:false
                                      Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ.a.......a.sQ..........a.sQ..........a...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................K"./...#.]`....N...^................L.P..E...)i{`.........f........................................I.qk..B.....LZ.................K"./...#.]`.............K"./...#.]`..........a.......a.......a...........................................a.j.....a.T.]...a.......a..B...a.H.....a...B...a...>.).a...J...................;........4...4...4.."...............a...a...a...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........a.......a.....#.a.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.148026737533884
                                      Encrypted:false
                                      SSDEEP:96:FsdPnqhcVEBA7OXo9dEUTPRK1cYnhJYX3D:Fs4h5AOXo9OU7RK1
                                      MD5:7E4B627E04AC03DBA934B1180ACC22E5
                                      SHA1:9FD33AA15F4B48737CD953E9B4E8420672194089
                                      SHA-256:63C8FDD56F83DF9DB958192278F580E40DC922AF91016ED322C9E2C286491901
                                      SHA-512:39E470D224E7EE9DFFEBF9BED8F57F92FC14033548DBC3053A3E450A19583ECABB1E5DD63EFAA97C69B6E3A831F654D6E578847CA4C5C801A6598CB118A97438
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........cc:..5...a0.k...cc:..5...a0.k.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$.*>x...*../!Q......N...^................^x.'6.L...z............f........................................I.qk..B.....LZ............$.*>x...*../!Q..........$.*>x...*../!Q..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.138536613209583
                                      Encrypted:false
                                      SSDEEP:96:S0sjQGncx5E7hXI9MVT6JRKq/w6IlwtVT:S0s5csVXI9MVmJRKq/w6IlwzT
                                      MD5:D848D8FCD79BAD79C7920F537E4E3A1B
                                      SHA1:8B006D4992A746C35D267B5C7EDB6B77DDB6D06C
                                      SHA-256:7009A2BD95801249E45A61F40D70169B408ED75093E70A7D9E42D515D72F2330
                                      SHA-512:52677691028A0767765777A208D5F6AC06C6DB9B5BD55B4FC9FD651F7B0A5B5D49C8EE322F5A90B82640116F4771D06EB7FC28ADE570EA783AB5B96DF75F07A4
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.........?Z....=o.KAP...?Z....=o.KAP.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............K..u....&........N...^...............\.?.D.uM...d..9........f........................................I.qk..B.....LZ.............K..u....&.............K..u....&........................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.142127118701654
                                      Encrypted:false
                                      SSDEEP:48:lsc8uOlqBwq2SjtbkimLyEEC/5XI97n6ToLrdSrbIYdXMmGsd:ls9ejq8EEMXI9uTGRKb7
                                      MD5:347005FCCC73E589010AC119FB0268FE
                                      SHA1:5D322DE0695DCECC8EDEE5217F44EF4B43194A4D
                                      SHA-256:B7D8D0346A04331910D9B4CDF308BF87726522C077D804159B0C21DDFB8F59D7
                                      SHA-512:5C1186AD811D829FA6D434BDBC2150051A4AECDE115EFCA619757093D0A84E5BB33E37470C3CBB07DD7C83C0DBF114FE0F15086D42A952676EF092C0D6479C5B
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........;.)...&......;.)...&......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............5a.*..4.M^=F......N...^...............#`....@..j.g...........f........................................I.qk..B.....LZ..............5a.*..4.M^=F............5a.*..4.M^=F......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.122417690165459
                                      Encrypted:false
                                      SSDEEP:48:b4gs6q2zIRy64t6br1yE2CHncXDc9vM7ToovCrdSrGIUDdXwGbVaH6SbGlBwG:FsLy64ob4E2EcXDc9yTyRK8Dhl
                                      MD5:F57334045828EEF008090E5C30735477
                                      SHA1:D1B0578D3F9B3B4C2B2078758627F817BEA561B8
                                      SHA-256:46A986850C758A88EF46A8BC60A9771F4BEE4BED9363EBAA1176C6C144F640AD
                                      SHA-512:A70F20DD78FFE673AE6F45D19ABCA5F27BB983E3A1A4E5B9634CCD610DB52419E4854ECE0725FFADF5DEE410218D04234AB3D3E870C8A1DF53B6CAD89DF5191A
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ*.m.....*.m|NU...r..L.=.*.m|NU...r..L.=.*.m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............-.`.j....3"M......N...^...............2.&....B.U.N..$.........f........................................I.qk..B.....LZ.............-.`.j....3"M...........-.`.j....3"M...........*.m.....*.m.....*.m.........................................*.mj....*.mT.]..*.m.....*.m..B..*.mH....*.m..B..*.m..>.)*.m..J...................;........4...4...4.."..............*.m.*.m.*.m..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........*.m.....*.m....#*.m............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.122968626820496
                                      Encrypted:false
                                      SSDEEP:96:tsxmcbEouiGIEiMUXDU9QT4RKjjVWJf2wVAB2:tsxmcbEp7UXDU9QURKjjVWJf2wVK2
                                      MD5:3CAB774CC7678B2FF994EA27393AE284
                                      SHA1:B571C0AE5A564D3A47C0DAA091560E3E43860BAD
                                      SHA-256:C12F765EB16783A649B006383595714766CEE53471BDAA065B633A9926DC880C
                                      SHA-512:F7E7CC6EDD116BE6227F693F5DE40B54C8D70F0F1CA8D64C38D1A3A00D55DF00415F868C4591A0F33C2A72957929F507196C74CC864F78528E8B34DEBBBB9811
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........8.....B..e.u....8.....B..e.u......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................Tp....`q&V....N...^...............k.pH..I..(I............f........................................I.qk..B.....LZ................Tp....`q&V............Tp....`q&V........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.099892528286727
                                      Encrypted:false
                                      SSDEEP:48:bJsgbknr5ttiKEnpDCZPdwXzHw9nfjToQrdSrpIddXz4xq3Fk1:bJsbnr5rxE1UwXzHw9nbTNRK0Xm
                                      MD5:C1584B89350D498A9E8D49FD0CC42950
                                      SHA1:5063D0EF7AF554E37413BAE15AD539A42BA50D24
                                      SHA-256:F2D584B5472B94DB8AB65C3E201D54C299CB0A745D58F7A4E8553D6FB34637D9
                                      SHA-512:38427182355FAC106F594172340BC1B0C84B18D6D33E894DF1BEF0E3D809E658A4B27FA511B0B828294B17DCD909F6698D7B8975FCEA7B0910C5B221CA9C91EC
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.........L/0....<4i.i...L/0....<4i.i.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'........................Y......N...^...............k9..)[.@....f.R.........f........................................I.qk..B.....LZ.......................Y.....................Y......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.147471792611828
                                      Encrypted:false
                                      SSDEEP:48:e0sd8UQ0T6+ANtrwyEmCKhXY979l7ToordSr8IcLSdXXuAGV:VsHjT6+iZ7Em3XY97XTdRKiWa
                                      MD5:483A3C30CA8AA3B6AEC5BCDD0DE29D6C
                                      SHA1:2321F6EBD796C7E5D06B7DF6299CBB818E5F956E
                                      SHA-256:14167AB79B3DC8AAC097D6F9847531461C9B3D617F3892EEE30A846C5F711AE4
                                      SHA-512:28FB70B41D17DE079641FAA6B9F0258711EED67E2C435995A80FDFD73D875402CCA4CF0C3D5B3D64D28487F5A0DA319B4309ECCB21BCB4223542C790833932C5
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.}......}.t.......\....}.t.......\....}..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................'..:....{.O....N...^...............E.uK..G......lb........f........................................I.qk..B.....LZ................'..:....{.O............'..:....{.O..........}......}......}..........................................}j.....}T.]...}......}..B...}H.....}..B...}..>.).}..J...................;........4...4...4.."...............}..}..}..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........}......}....#.}............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.110983743452952
                                      Encrypted:false
                                      SSDEEP:96:KUsaxjaf4sElCHXM9VTaRKEbPLddEP4Da:rsaxjaSOXM9V2RKEbPLzEPua
                                      MD5:43954ACFDD3F7EBFD09FD0E3E4EACA90
                                      SHA1:FAE39751BBA3B18550CBBFD8B7D82AFF08523762
                                      SHA-256:628849CDD7A7AE8541ECEF00359DBDC204A31CB49C2127210A186AC7CE38B9FE
                                      SHA-512:EC5DBD3835A4051FBA19B01F194C0D2982320545FBAEE623BFCC5ACFD5D3B2FB7FFDE3CDEE3CA7F2A7FE9ABF15105AC8B4A4437B8E9EC40B966548F834F5B453
                                      Malicious:false
                                      Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ.$d......$d.+......2...$d.+......2...$d..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............B)C......v..._.....N...^................w....OL..{ZO.........f........................................I.qk..B.....LZ.............B)C......v..._..........B)C......v..._...........$d......$d......$d..........................................$dj.....$dT.]...$d......$d..B...$dH.....$d..B...$d..>.).$d..J...................;........4...4...4.."...............$d..$d..$d..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........$d......$d....#.$d............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.170405012987647
                                      Encrypted:false
                                      SSDEEP:96:K3gs+r4F3YtE6c7cX89sTVRKuarq4dYeR3bErqBC:Ugs/3tDcX89spRKu
                                      MD5:D6FF87D6DC48E005AFC7AE7BC88BFC2A
                                      SHA1:6180B42308042DB741D871656F3E0692C837A772
                                      SHA-256:46DA43DD4EF598547C319B1BC033477380195B392AC45F6DDD781D7E35C86EEC
                                      SHA-512:75C5DBFC292BC4032FABD935B598984B6CCBA061C64D77F68EF35CD7F6DE57C3C8AB094DA9ED10D03F2812A6ACCBAC012F0B3EEBBB86AFB8CCF5510CBD16731C
                                      Malicious:false
                                      Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T.........................................5./...*..A.I.......I.qk..B.....LZ......5./...*..A.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................:.....e.=.LV....N...^...............L.....F...PO..........f........................................I.qk..B.....LZ...............:.....e.=.LV...........:.....e.=.LV........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000019.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.112193105858204
                                      Encrypted:false
                                      SSDEEP:48:QvseEvp+7tfSEIWCCYuX892T4To1rdSrQhIOdXWHxx1:Qvszp+7MEPNX892sTQRKqe
                                      MD5:782CC62B2C7D5232521256BE606D2760
                                      SHA1:63345477F96D569CC944E0C2EC7E190196D349E1
                                      SHA-256:3C3C21D53C52EC405DD02428DE986F077BC591B16AA9C5B9109871FB50AD408D
                                      SHA-512:E12B3B22CB237D4EC370D7EE0AD6289A5B96E5CCC9920F7BEE955EFF0F72ECAAEDDCEF37452AE626D38495A51469ED5B87F23441A7199915D591B6DA5E744424
                                      Malicious:false
                                      Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZ............ ..`......... ..`..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=.}..7......%..O....N...^...............*y...V.D.Tm./..4........f........................................I.qk..B.....LZ............=.}..7......%..O........=.}..7......%..O........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001A.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.1388047906727925
                                      Encrypted:false
                                      SSDEEP:48:Pxsq1sRfBpetFmqEVC/VXs39EC3MCTomrdSruIXdX5uQWF:PxsFBpeREVYXs39z8CTXRK30
                                      MD5:412400A3AB4E6261A8ED02C227F8C560
                                      SHA1:46CD8906908EAB337D5B9EBEBCA55D5D3A89717E
                                      SHA-256:240FD8A5E932BC37108C6848FCA37E889A25FB42E50D47605917935A18D878F6
                                      SHA-512:BC4E13584C9C241D57D1485272665EC88C3D9D2E096A7E72802AD3FE5289C339A43861E8B98E5A06FA57E5C39586CBBF5B2CB9401F76B55EEBA15EDCC40B17FE
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ\.".....\.".D#1.<.N,....\.".D#1.<.N,....\."..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=dEc..............N...^...............f....=.N....._.........f........................................I.qk..B.....LZ............=dEc..................=dEc...................\.".....\.".....\.".........................................\."j....\."T.]..\.".....\."..B..\."H....\."..B..\."..>.)\."..J...................;........4...4...4.."..............\.".\.".\."..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........\.".....\."....#\."............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001B.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.1492130408406505
                                      Encrypted:false
                                      SSDEEP:48:c0n0jesEVL3Cu0DmtbwSEsWCjtsXs9F9OifTokrdSrpIRdXPwxMCLeMHRBh:9sjDmdEsWMmXs9XvTRRK4+l
                                      MD5:42EE14909B4F9BD5A95B110904908F25
                                      SHA1:A6A3489FC077F300916C9CA85DF295420D42E5F2
                                      SHA-256:CA6E03F0B4A305365EE135CA888A1380B7C70116ED13ED72F2D3A08B76150ED0
                                      SHA-512:7D9E4EDD206491EF36FCA1B3272DD81ACF6A507B91D4EE44472EA9E17D571C556A16BEB6A5895BD612D15B00770F144553C315EB2253AF9A8D63C6E101D51F9E
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.u.......u..(G.....c.....u..(G.....c.....u...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............c....|..............N...^...............D...8.@.q,.V*..........f........................................I.qk..B.....LZ............c....|..................c....|....................u.......u.......u...........................................u.j.....u.T.]...u.......u...B...u.H.....u...B...u...>.).u...J...................;........4...4...4.."...............u...u...u...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........u.......u.....#.u.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001C.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.110796340370887
                                      Encrypted:false
                                      SSDEEP:96:Rsl4X0tGonJER3cWtXQt9wzfTYRKYvCyn0tB+5JPppyWIL:RslG0tGo2xltXQt94URKKr0tB2JP
                                      MD5:D3FFAE40AB8AB9E8772966506AF7298E
                                      SHA1:42E03151AB7D01B9463FF3B88881E3DF366D7FF1
                                      SHA-256:821A950AB9C36BD21FCDC1CC3C1BBEE7A85059A74709A76305BE96D5F5739083
                                      SHA-512:3FD8CBD2D976DBB5197D4EBE58CC336614B1FB93FCB298B2D72E93F2D7ED2BED32AFC219D03AAEFF20A1DBF85CF32A28707BF3A726149D6B43E251787CB11574
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZe.C.....e.Cv.....Z..;(=e.Cv.....Z..;(=e.C..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............7P0.3!L."..-..F....N...^.................y9..I.a..............f........................................I.qk..B.....LZ............7P0.3!L."..-..F........7P0.3!L."..-..F.........e.C.....e.C.....e.C.........................................e.Cj....e.CT.]..e.C.....e.C..B..e.CH....e.C..B..e.C..>.)e.C..J...................;........4...4...4.."..............e.C.e.C.e.C..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........e.C.....e.C....#e.C............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001D.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.162018813204546
                                      Encrypted:false
                                      SSDEEP:96:EusxwNtGCWhENA1s2TXg9exrTyRKsi0lMl:EusPCTyTXg9S+RKsi
                                      MD5:E794E05051A93FB8F9EF37836675FC74
                                      SHA1:3E2BE6B94AF46789414A5E354B2C66B66434F840
                                      SHA-256:85BE9B017BB961A849B8142A3018A87D8567031F5F791A6B3DB39BFC175A9189
                                      SHA-512:7951E12B33D3314E7EFD3D32D4FBE4E14CEAAB3606D078509AA6BA196134B419D4624004EF0CD260AB3ED6F151DFE0840B6F95EE693D0786E258710939A170A5
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ_.h....._.h... ./.n...._.h... ./.n...._.h..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............W;.........{.....N...^................!b..NO.G.Q=.@.........f........................................I.qk..B.....LZ..............W;.........{...........W;.........{.........._.h....._.h....._.h........................................._.hj...._.hT.].._.h....._.h..B.._.hH...._.h..B.._.h..>.)_.h..J...................;........4...4...4..".............._.h._.h._.h..z...y.. x.. ...........$........4......7...7........................;........4...4...4........._.h....._.h....#_.h............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001E.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0012030586861
                                      Encrypted:false
                                      SSDEEP:48:KTN1MsEJeryIAYcatlUsEyrCQOXs9HURxmTodrdSrlITSdXa10QfK/1:KTN1MsRyFYcaDlEyr+Xs906TsRKn/
                                      MD5:840DB02E396956D3A38E0334EB2A2C08
                                      SHA1:8FB64512D49E59B7A759CAE83CA2F89F795527F9
                                      SHA-256:BD02BF4D79EA78FE81266F5867591468F6A5FE40C4955BB048070259C4E0FD1B
                                      SHA-512:FEC29334B8B2C7D10849A92E56FA8846B8356EC3AD2622AED0E005BECC2323342D3AEF7EAD61858CC613CBE457DF5D65BEAED3A2DEA6FF0A2F77D51C8CA7D49E
                                      Malicious:false
                                      Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T.......................................1d..5E..Q.g.I.......I.qk..B.....LZ....1d..5E..Q.g.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................'....,..6y.S.....N...^.................]`..B...S.J..........f........................................I.qk..B.....LZ...............'....,..6y.S............'....,..6y.S.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001F.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.138384636582309
                                      Encrypted:false
                                      SSDEEP:48:Dsn8TAWslT1U6UtDMEJlCDQXHDm9H7mV5U9ToprdSrVIedXicmNWPPH/xi1f:Ds5l5UbKEXpXK9bmnU9TgRKjXdc1
                                      MD5:C75613CDE046FB155B0683FC72230767
                                      SHA1:9F7C58421DB9224D81692ECB2C4EEDA48639BF04
                                      SHA-256:BAA6F50803D8BF4AAE0A020380266DAC82A392ADC9DBACADDD7A7F1A2CAE11DF
                                      SHA-512:6DC6B66CBE8CBBFE76211203105DA99C38F91D33536B0F374980F984256AEFB35D1325359E8B3657979B1E7AA5E540ED13807EEF46904972DDC7B6274020AF60
                                      Malicious:false
                                      Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZ...........0.....D(.lW.....0.....D(.lW.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............h.....4^.r.H......N...^............... t.3._.E....L..p........f........................................I.qk..B.....LZ..............h.....4^.r.H............h.....4^.r.H..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001G.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):3.5264487415908166
                                      Encrypted:false
                                      SSDEEP:96:woV6zgZyh4LCS/qYooK5EG4I8PE8c4I4pBjH4IkoGtU4a:hyh4N/qYonmO78U4pNX5Oa
                                      MD5:8A40D142173A16F674C72464D55306C1
                                      SHA1:157924E64C4FF7737294A96AF4080C3CE9B8D270
                                      SHA-256:C19692B3898FA04AB7558A47FF47FAFFDF587F28C8AE825B30CB8B1017D51191
                                      SHA-512:60A09033DFE3B0ABDD24D34F29780CDCEBC2B86CD25EDCC5045769AD5AF96EAE4CE0E9B5E974BF2C35ED6116C444527B09D953347AC701CD440B20AF696BC696
                                      Malicious:false
                                      Preview:\...L...............................................................................................?...................................................\...L...............,........................................#..4u......Tb......Tb.M"..B.G...Fe..o".z.#S7.b...e.....U.....v*X.SW...U..?.].....z.j.)j.?........................................................................r.......r...J...$.................-&..!.r[.q.2...........^.......0...........Tb..-.G.1.f...r.e....J...?.......Tb.T./..-.GT.v..1.fT......rT)................".......n.....T)O......1.f......J...c..,0...e...B4.$...........GP..A..}.....J....................Tb.M"..B.G...FTb..(.....F.b...wb;(...1.fG..H.(.G.K..1.f.....>................?.].....z.j.)j.J.e...;<..}o!.1.fG..H.(.G.K............0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001H.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):4.626340019860702
                                      Encrypted:false
                                      SSDEEP:384:+5KRkdYnK8HXCdC/i/C73fRtyD/BGuJS7mpmack1wmG+fuNIXW+RPEn162:+5KydYnK8HXCdCEC73fRwD/8wSqpmacB
                                      MD5:D6E47456ED17338B4BBBD4B5AAF09114
                                      SHA1:D1E6673483F4AE65685184F19E676DD35AFC6D8B
                                      SHA-256:4468E62B52F0B322B93FA8F92644B70F5A2E5BDE5BAF61600E24B1B3ED7E0DC0
                                      SHA-512:50EE1F45485AE6160C8F61FA72F9484A151875D5DFA377413F837125E7FF8BD1446C289DEE02C70E86C8608F4735B5A69E9EF06202C2A64BC32A8535AB18D9D1
                                      Malicious:false
                                      Preview:....>...........v........@..( ..`J..........>...t...8...v........H..( ..PI..................................................................................>...........v........I..( ...I...............I.......I.qk..B.....LZ%.......%..e.`k..C..8...%..e.`k..C..8..q%...'.<..A......<..'.<..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'.............~2..UK..=1+!.Jh.....N...^.................4D(..A.$.....i............J...............................4....I.qk..B.....LZ............~2..UK..=1+!.Jh..................................%.......%.......%...........................................'.<(.6..'.<(.z..'.< ....'.<$....'.< ....'.<(.5..'.< ....'.<$........%..3%..8%....z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001I.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                      Category:dropped
                                      Size (bytes):22203
                                      Entropy (8bit):6.977175130747846
                                      Encrypted:false
                                      SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                      MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                      SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                      SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                      SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001J.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):3.969610327941933
                                      Encrypted:false
                                      SSDEEP:192:1m2s2+Fei30Ng0Xf5xWR/3zMpst9EvEJItuFaqSN:8t0C2xgR/opsvEviI
                                      MD5:86ACBF76E1E0C682BD235E690F05B832
                                      SHA1:B0C3A87A335C51E6C5A63B670DA0EB007342C377
                                      SHA-256:967788B07BD926B5BB623E2FC91D63573DF94011B84062619AD2BDDA6BCABDC4
                                      SHA-512:7AA63FDD810A29458F06185D196C88F6269684C49B4A77EFE8CFBDDF2A3763CA302CA5068C9B87F995D5CC623209465108127066CA2240DD8EBD7872AAA58772
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZ"9f.)..."9f...z...'....."9f...z...'....."9f..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................. @...ysM........N...^................`%..>.A......Z.................................................I.qk..B.....LZ................ @...ysM................ @...ysM............."9f....."9f....."9f........................................."9fj.h.."9fT)..."9f....."9f..L.."9fH.].."9f....."9f..H.."9f..}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i.................."9f."9f."9f..z...y.. x.. ...........$........4...!..7!..7..............."9f:"9fF"9fG"9f..z...y.. x.. ...........$..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001K.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):52945
                                      Entropy (8bit):7.6490972666456765
                                      Encrypted:false
                                      SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                      MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                      SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                      SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                      SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001L.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.524909270426115
                                      Encrypted:false
                                      SSDEEP:192:is8owTD1NiwrjFxAXadcUGvRtvvxzMQEYZXXa1M75gNDA90Fr+kK061d:v8LiwrjFxK+cDvRtvN3w1M75gND80FrG
                                      MD5:9F941626ED000A3BF529F1DDB6907EC4
                                      SHA1:22E7D5003C64D280381AD533A70E0F07CF1B4E8A
                                      SHA-256:3473A0BAEE04682E223C4FB76726172FE345D490A80DC64AA908FEE804124B0D
                                      SHA-512:28ACC7A834BDB26F74999912E9B34A35A7468DA7CBC4339BE8F48D8F2C01A5009D92FF8AD705A8CAED41ADE3C4932BB313396070BE1658CD10A7AC10F364FB0A
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZ>...9...>..]7^..4%6j...e>..]7^..4%6j...e>....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............l.R+.p...JGhn.....N...^.................Y...D. ...,b............................................r....I.qk..B.....LZ.............l.R+.p...JGhn..........l.R+.p...JGhn..........>.......>.......>...........................................>..j....>..T.H..>.......>....\..>..H....>....3..>....O..>............Z4...........................................4../4......p...............C.a.l.i.b.r.i..................>...>...>....z...y.. x.. ...........$........4...!..7!..7...............>..:>..F>....z...y.. x.. ...........$......

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001M.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):25622
                                      Entropy (8bit):7.058784902089801
                                      Encrypted:false
                                      SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                      MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                      SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                      SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                      SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001N.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):3.182105440559077
                                      Encrypted:false
                                      SSDEEP:384:a+odMx/GCEeOaYQOO9Ta8Da5ERSbeqljnhjqS7Pf:a+odMx/1E0YQOO9TbDa5ERAeqlThjqST
                                      MD5:D1B98211F800822910EEB63CAAB24804
                                      SHA1:9990926464C22C0A807E4225818BA118BEA3FDA0
                                      SHA-256:534653A09F24D599EF528BEBC5A4D500EEEC6ECB95AC320F559A629860A0F259
                                      SHA-512:BE8C682E33DB33BA9CF3CC96BF97064DD8ED52805874703C04507A3D43E733CC48F0CF07DFDB5A3D22767F726122BA0017458CEC5887E85403E461E9BD9BF09A
                                      Malicious:false
                                      Preview:2...>...........v.......0 .../......9.............K.........9.............K......I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8....................I.......I.qk..B.....LZ4..T...4..v,X..5.,....4..v,X..5.,....4...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............9.............K.....N...^...............9kF(+..@....9L..........................9.............K.........9kF(+..@....9L..............9.............K..................................4......4......4..........................................4.j.e..4.T....4......4.....4...a..4......4......4. .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................4...z... ..$..............

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001O.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):15740
                                      Entropy (8bit):6.0674556182683945
                                      Encrypted:false
                                      SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                      MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                      SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                      SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                      SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001P.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.7633585513843895
                                      Encrypted:false
                                      SSDEEP:192:dsT8JW0rSY+cHsopXGtrCCWRtLYJywaO59me24X85Tp9pYIl7ekp:ig40rSqnpGtuCWRtMJyDOWsX85TzpYI
                                      MD5:7EF897AE1733EC3BC2F33105740CF8EB
                                      SHA1:8C23EE37EFD6363768B7E1F69D69ED24C3BFE380
                                      SHA-256:A9C582D93E574EF4C24E37983641E4839BF09C8EE111FE327415CC699036BA5E
                                      SHA-512:ACDCCBC219661C90C2EA818CC5E83CA3A6A394BB1BA5AB05A3BE40EE98C9A3AC4FC626439AC5F5A16FDB701789377E7FB0D4D31705880074C9F201FEF5D6A4D9
                                      Malicious:false
                                      Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ...9......\Ts..C\.j......\Ts..C\.j.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............`!.p....,.8.$&.....N...^..................g.KE._..o%..................................................I.qk..B.....LZ.............`!.p....,.8.$&.............................................................................................j......T.Q............n....H........9......V..............Z4...........................................4../4......p...............C.a.l.i.b.r.i............................z...y.. x.. ...........$........4...!..7!..7..............'..%......z...,4. ...........$>........4

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001Q.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):55804
                                      Entropy (8bit):7.433623355028275
                                      Encrypted:false
                                      SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                      MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                      SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                      SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                      SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001R.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):4.656231952753496
                                      Encrypted:false
                                      SSDEEP:192:rsCn/Lwpi1i/Q5Fo2IVGEqoqMoyekU8g7HybN4eXTpl6S9RtrIluNAKqTZ49+nZW:Q8UpiY/Q/ovGEqoqanXg7y6QRRt8lCAA
                                      MD5:C39DB50101139689746A4FEE9D8E48ED
                                      SHA1:7C851457C123D8A1F6E86F3E1682EBE85FFCBB5D
                                      SHA-256:C14F2183A4CA34229CE5D9C4E50E044E6C55C26405E44876FD4E2E7949F22651
                                      SHA-512:1C669D1D7D25D98E32E02BA5EEAF4565EE5E76EFB2696B97443B9D64A1022ADAF38CE3036A49A3FA3D47B81975111AAD4589F00C021E5C700E6A10CD79471AC8
                                      Malicious:false
                                      Preview:....>.......>...v.......0 ..h+......>...........v...Z...@...X*...........................................................................................................................................I.......I.qk..B.....LZ..................a.5.S...........a.5.SH.....I.qk..B.....LZ.I..T..ne..E.[7~...T.............I.......I...................................................I.t.....I................................................................4..'...'..............bj.7!.G....<.^.........................=W;c..H...3M.B.....N...^........................................I.qk..B.....LZ............=W;c..H...3M.B..............................................................................................T....|..T..(....T..(.z.....j.N.....T)................b..... .......'...8.....z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001S.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):41893
                                      Entropy (8bit):7.52654558351485
                                      Encrypted:false
                                      SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                      MD5:F25427EFECFEE786D5A9F630726DD140
                                      SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                      SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                      SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001T.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):4.537333699855513
                                      Encrypted:false
                                      SSDEEP:192:vshpszTX9F98c/KMXdUZ7fav1vqdOHc5OgLXQfa/wclRtfpntlGdwql4kwL9Gz:kmTX9H5/KWUZ29vqd+6pjLNlRtxtl+w6
                                      MD5:AE431AFA68CF5922432738ACCAD6B8EE
                                      SHA1:E8E5B142363DC541D0AAB62807702833B21EA087
                                      SHA-256:F9B4BDEE32A3B20F7A74441A17DC8433BAA88195395D4D5C5C8125BA4A76EE3F
                                      SHA-512:BDB58C4920A50A8A544376A4A6C7DA93F5A28C742F23EEC9D8133FDE4D17675D099D611A4A49E458880F20FEBCC640483D2BCC97B21CABFE150D04FA1151B054
                                      Malicious:false
                                      Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*..........................................................................................................................................Qx..G...Qx......0..Y5..p.I.......I.qk..B.....LZQx......0..Y5..pQx...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............f..*".F.3{I.ogr.....N...^...............S.8".D.@...h.F.&........V...x....................................I.qk..B.....LZ............f..*".F.3{I.ogr..................................Qx......Qx......Qx..........................................Qx.j.A..Qx.T....Qx......Qx...r..Qx......Qx. .7..Qx......Qx. .........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................Qx..Qx..Qx...z...y.. x.. ...........$........4...!..7!..7...............Qx.;Qx..Qx...z...y.. x.. ...........$......

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001U.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):14177
                                      Entropy (8bit):5.705782002886174
                                      Encrypted:false
                                      SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                      MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                      SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                      SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                      SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001V.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):49152
                                      Entropy (8bit):4.676889025715574
                                      Encrypted:false
                                      SSDEEP:384:Wv0Tg3iXNJuVAY6Esk+/xfw2YLW67B0fPW83KebIH18m5iQQl879DXMRbtN8zpo2:WdeNsV+dw3TcoEsm2/fhe3QVBm0B
                                      MD5:ADF46D8243A99C24F4304BF565BBBD52
                                      SHA1:A102B2FF719A7AE64A5CD2B9647133044E359FB8
                                      SHA-256:E673531D7556869C8C9E9300C0F71994620278F974A8FE8DADA62FC837EEF1EA
                                      SHA-512:E3E74A54BECB812008820510F26FBD301B7B0ADB822D0420BDCEE666C023DA7B7FFF0F793303C6D5E2897D28EC7FB9B4688F5A77F5DC6B4C733326CBFB66938B
                                      Malicious:false
                                      Preview:2...F...^&.......%..v&....... ..H@..0`..........2...F....&.......%...&..8.... ..H@..0`..................................................................2...F...&&.......%........... ..H@..0`.......................'.K.Nf..R...V.......V...5....qKK5...J....0i.LD..t.J..J....+.;..D..O..J........1.3.&..S%..............Z.S.....Z.S....................................................T.5....T.7.....T......T%...t..T.U...S.T.C...&.T......@T.+...........0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.........-o......-o..(.....G.../$.&.......&.:}D.I.....23E2...v.......(....................V...Z......t......_....&...........n:......_....c..,0...e...B4.$........{p.....G...^...?@kO....................=[......=[5l.5I.=.O&.<...f.......f.Qm.J.?.5...E....I.9cr4q<..E..-o..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000020.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.34429536358552
                                      Encrypted:false
                                      SSDEEP:96:josNIG3HUsrz11FE8nXpd9FwJ+RAnVJGNTFPM:josNIGEOzm8nXpd9M+RAVJGNTFP
                                      MD5:2D4F018526B05FFE00B91E581068F2C7
                                      SHA1:A961433534D208AA70F4225E4D865952642F5824
                                      SHA-256:A17976D3DE54DB253142C4D864B2E2C03F12A5018A5563430B1C12945066038F
                                      SHA-512:30AA4056AFD688F681FBD3B1F5A578E8421BABE20B65F7B6A33542DA75D46447ABFADF636F15A15E21A094DEC1C5AEDECDCDDCBA59F84C89E1975906818B8F98
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZFk......Fk........10.tFk........10.tFk...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............L..................N...^...............v4.;&l.D................f........................................I.qk..B.....LZ............L......................L.......................Fk......Fk......Fk..........................................Fk.j....Fk.T.]..Fk......Fk..B..Fk.H....Fk...B..Fk...>.)Fk...J...................;........4...4...4.."..............Fk..Fk..Fk...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........Fk......Fk.....#Fk.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000021.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                      Category:dropped
                                      Size (bytes):12654
                                      Entropy (8bit):7.745439197485533
                                      Encrypted:false
                                      SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                      MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                      SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                      SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                      SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000022.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.350777899896445
                                      Encrypted:false
                                      SSDEEP:96:AsinMjvsJYEp5XTUZ91lI8RAnBMD0fZk:AsinMjv0Fp5Xw91lI8RAnBMD0fZ
                                      MD5:F453D7FBC86F78DAFD56243F883CDB36
                                      SHA1:7795547BDEF32B7D04FFF9C4375414BF515A708F
                                      SHA-256:D4686445F7BEDBF4D979166F0D7B1772CE7256DA757E7D34B5A4D70C1C3D38C9
                                      SHA-512:60C9DEE0B48A27671D7BB7835672BB5F7FA572DBE79A0E4B42B7AED5168A87FC4E6DF37F9E373F84C9BE1EF9DE35AFA751B97BCFBFBC4DC65639BB857048546C
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ6t......6t...+......u.BL6t...+......u.BL6t...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............s../....7...!iv.....N...^...............#...QyD.;#f.MP5........f........................................I.qk..B.....LZ............s../....7...!iv.........s../....7...!iv..........6t......6t......6t..........................................6t.j....6t.T.]..6t......6t...B..6t.H....6t...B..6t...>.)6t...J...................;........4...4...4.."..............6t..6t..6t...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........6t......6t.....#6t.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000023.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                      Category:dropped
                                      Size (bytes):2695
                                      Entropy (8bit):7.434963358385164
                                      Encrypted:false
                                      SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                      MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                      SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                      SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                      SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000024.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.329188149239823
                                      Encrypted:false
                                      SSDEEP:48:tyxsQpHaJ7FBty/PE/Et/2X9299fKcpXrdhSrrOtXZ5zUr9LwAV:tyxs8g7bqPE/M/2X9299C+XRAi7+CA
                                      MD5:511163DC7695FFE0FE769860316B6865
                                      SHA1:9D4CC0A6099406A965FC3D3139D3702C5CFF6B37
                                      SHA-256:40B9C8539D877FAB4AB29000400FD2A112D0B698E9CB6F2C5CBED830BDDB47C7
                                      SHA-512:B9E422639A4B4900F3D54FB68501C7D8F98A5294813CA91FE3C05CFA14728CDBA5F428C31BB2047DE568B1F47560B7DE0B90517FE8E6EDBEB8ECBC91A68C48BD
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.A.......A...@..........A...@..........A...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............)..#....0...B.......N...^....................uO.|U.7w..........f........................................I.qk..B.....LZ............)..#....0...B...........)..#....0...B.............A.......A.......A...........................................A.j.....A.T.]...A.......A...B...A.H.....A...B...A...>.).A...J...................;........4...4...4.."...............A...A...A...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........A.......A.....#.A.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000025.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                      Category:dropped
                                      Size (bytes):11040
                                      Entropy (8bit):7.929583162638891
                                      Encrypted:false
                                      SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                      MD5:02775A1E41CF53AC771D820003903913
                                      SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                      SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                      SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000026.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.502156421000456
                                      Encrypted:false
                                      SSDEEP:96:gnsCWkqfSH9aWEP3FkX69i43RLVkUrq+yjUrd9:gnsCWkqfSd6/GX69i43RLVkUrq9jUp9
                                      MD5:159C5F073AD81517A2727BEF30BD3BF7
                                      SHA1:64DE5BF78A007BBBFFF1FF17491FCF375CE13C64
                                      SHA-256:A8F631FDBBDFD92BB21031C565B7AB24CD02357D7A5D0D8E35A66638B754000E
                                      SHA-512:3F3712A9A4AEEF16FE6E59D2C8270B365B486D77B4B245523AF0E44C20E7E6ED18840D514F5A7073B912B2CB81A499EB322C37354CACAD10F20D78A4869773FD
                                      Malicious:false
                                      Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ..Y.......Y!.......%...e..Y!.......%...e..Y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................U..9.^.|.e.....N...^................"./y8.@."d.............Z................................... ....I.qk..B.....LZ.................U..9.^.|.e..............U..9.^.|.e............Y.......Y.......Y...........................................Yj......YT%c....Y.......Y..G....Y..H....Y..>....Y.......Y .3...................;........4...4...4.."................Y...Y...Y..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4...........Y.......Y....#..Y............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000027.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                      Category:dropped
                                      Size (bytes):2268
                                      Entropy (8bit):7.384274251000273
                                      Encrypted:false
                                      SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                      MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                      SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                      SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                      SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000028.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                      Category:dropped
                                      Size (bytes):784
                                      Entropy (8bit):6.962539208465222
                                      Encrypted:false
                                      SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                      MD5:14105A831FE32590E52C2E2E41879624
                                      SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                      SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                      SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000029.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):2.7320819893247523
                                      Encrypted:false
                                      SSDEEP:96:VsVBd+Nv/GVkBoKXWE6rXD9EtERQ5CWDaYAoD/l4y:VsVj+NvNKW6rXD9EtERCC
                                      MD5:D4D893D9CBAEB7A8B58170ED223F5EF0
                                      SHA1:18EB8C1CC7234FFF83912AB105140E7E2508A0E6
                                      SHA-256:18938F6088D4B170B3459A4B5FAD989DBE55E312C82C055A241B36AD0EDE8D47
                                      SHA-512:B3CD5B0479C73883E97AB5468EE6B8819548D4847A38BB91DFCF3D08B37456EFDF38E89667A3C61A3212A3AE9F8277AF33841B4B09E8A6CDB895030273D9B38F
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZ.,.......,.'.1..9. ....{.,.'.1..9. ....{.,...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............N..VB..+[U.X.aj....N...^................A._..FF..h.-|..............................................^....I.qk..B.....LZ.............N..VB..+[U.X.aj.........N..VB..+[U.X.aj..........,.......,.......,...........................................,.j.....,.T.l...,.......,...Q...,...Q...,...>...,.......,. .3...................;........4...4...4.."...............,...,...,...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........,.......,.....#.,.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002A.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                      Category:dropped
                                      Size (bytes):3009
                                      Entropy (8bit):7.493528353751471
                                      Encrypted:false
                                      SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                      MD5:D9BD80D40B458EDB2A318F639561579A
                                      SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                      SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                      SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002B.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                      Category:dropped
                                      Size (bytes):2266
                                      Entropy (8bit):5.563021222358941
                                      Encrypted:false
                                      SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                      MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                      SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                      SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                      SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002C.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.316230984159809
                                      Encrypted:false
                                      SSDEEP:48:Yul0sVd0hfNtA+xltTfvqWEgQX/uxvJ9OAoBrdQqr2x6Z5BX2VzUY9:Yhswm0lPEpX/uH9OAwRQycmgJ
                                      MD5:68C8939F2BB0CB9D9298C502DFF52C30
                                      SHA1:42FFCDED6F9E41B9DF2D7A259849EFC642C17840
                                      SHA-256:0FB5D950D63CBF9B3172D5DA13AF183A02DE8EC797D624F07EDF8FEDFA9438BD
                                      SHA-512:C69B186587FA44D3102F481B3B644C7A351AF1BAF1E71C8D0FB3ECE95A668AFD1A3062749CBF4FB0EDE3CF8D71EF9E5CC051D3B19D4230339B321130DC71562A
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZe.X.....e.X.............e.X.............e.X..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............w...=@....3=#.....N...^................A....K.3a".wBs........f........................................I.qk..B.....LZ............w...=@....3=#.........w...=@....3=#..........e.X.....e.X.....e.X.........................................e.Xj....e.XT.]..e.X.....e.X..B..e.XH....e.X..B..e.X..>.)e.X..J...................;........4...4...4.."..............e.X.e.X.e.X..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........e.X.....e.X....#e.X............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002D.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):99293
                                      Entropy (8bit):7.9690121496708555
                                      Encrypted:false
                                      SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                      MD5:EA45266A770EEA27A24A5BB3BE688B14
                                      SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                      SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                      SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                      Malicious:false
                                      Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002E.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.338213410533771
                                      Encrypted:false
                                      SSDEEP:48:Yu4jXsrnTUOFQ3tu155sEVpyrXta9mf0oxrdQqrzevsBXcbV3EUVYy:YFsHNQ3KgEPcXta9mcYRQynu/VY
                                      MD5:E284F1AF9BFF0258D8D13106DDF8D51B
                                      SHA1:3FB5E1806416D2FD020D5D03F9304820BB6409FB
                                      SHA-256:DAC4C3B58E9F8F0EDAC442A7DAD0831446301CE1D7B539D346C6C706C1D30E65
                                      SHA-512:235C4716A73B2F981AA3CF6AC3FDEFF8255BE544840DA066C6EA56A4D0A91A525440D973C5395182DA365ADF10869B05CAF7C6ACD7FE602814351BDB06C33F83
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..f.......f..1..7.W9..X...f..1..7.W9..X...f..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............31b.H./.#.....O.....N...^...............O....>K...i..........f........................................I.qk..B.....LZ............31b.H./.#.....O.........31b.H./.#.....O............f.......f.......f...........................................fj......fT.]....f.......f..B....fH......f..B....f..>.)..f..J...................;........4...4...4.."................f...f...f..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........f.......f....#..f............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002F.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                      Category:dropped
                                      Size (bytes):2898
                                      Entropy (8bit):7.551512280854713
                                      Encrypted:false
                                      SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                      MD5:7C7D9922101488124D2E4666709198AC
                                      SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                      SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                      SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002G.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3048783686644825
                                      Encrypted:false
                                      SSDEEP:48:mjxsAlmDrhPtyUWOESh7VxXr1/9+3oNrdQqrRWXhQkBXMCsnN8g:mjxsFfhPUOESh7Xrx9I8RQyRKQkmX8
                                      MD5:4F28E1F27058B61CDB6C0E675627BBC4
                                      SHA1:AB51DC107A82DBF43A4D1B1407A582684244E247
                                      SHA-256:BCC515891339CCD81157FF0FF4104C94FBD14618ECDB5BA6D539DC08D96AAF39
                                      SHA-512:73180A1334AA42F4595D2FF1B0C267BF96B2C6CC96DFBF5C6EA5CB844EF3AF2524416CEBEB16D572F5F5F43F44251559DF9FE95CFFB140AC91BE05523CE8CFF9
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..,.......,u........<6...,u........<6...,..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............KK).1.p...&..j.:....N...^...............?.t..B.@...@...$........f........................................I.qk..B.....LZ............KK).1.p...&..j.:........KK).1.p...&..j.:...........,.......,.......,...........................................,j......,T.]....,.......,..B....,H......,..B....,..>.)..,..J...................;........4...4...4.."................,...,...,..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........,.......,....#..,............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002H.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                      Category:dropped
                                      Size (bytes):29187
                                      Entropy (8bit):7.971308326749753
                                      Encrypted:false
                                      SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                      MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                      SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                      SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                      SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002I.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.340062171145647
                                      Encrypted:false
                                      SSDEEP:48:ws0lNcVuqt+tqdwEYYOt73dXc9KNIovdrdQqrOdg+wBXw89Hv31:wsXVuu+0uEYY6RXc9j0RQyOXwd
                                      MD5:7B50441F7DB81729254C45E81CDDAAEE
                                      SHA1:F177F47AAB2762F0A75D9E62D28CDF60C8BD430D
                                      SHA-256:D234B9E8E2341C579AF038840B787F358DA583110852899CBE394E0C9F18001F
                                      SHA-512:3E685E8C255840D579E6CF95D13CC3E19DB3E5A7E5E0DFC0CA49BC0E6E54F6575A26939CC3569DE3CF4209CA411B5277907B8FC19DBCA8959177B04FE126523A
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZP.......P..2 .W.0.3.r.,.P..2 .W.0.3.r.,.P....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............4g......t.0.......N...^................|....E.k.).:u.........f........................................I.qk..B.....LZ.............4g......t.0............4g......t.0............P.......P.......P...........................................P..j....P..T.]..P.......P....B..P..H....P....B..P....>.)P....J...................;........4...4...4.."..............P...P...P....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........P.......P......#P..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002J.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                      Category:dropped
                                      Size (bytes):4819
                                      Entropy (8bit):7.874649683222419
                                      Encrypted:false
                                      SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                      MD5:5D6C1F361BC04403555BE945E28E53FC
                                      SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                      SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                      SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002K.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.377057677231575
                                      Encrypted:false
                                      SSDEEP:96:is9E2xstmToEVoZX83k9luBRQyMuutY/:isFxstKV+ZXWk9lERJMuuq
                                      MD5:47C24268510FE90193A89301AAC29D66
                                      SHA1:BE0279AD7CA7592EBF209E963AD17E45B65D53D8
                                      SHA-256:A67A01669A2F7F066B2C6A5EA0ABF155483B297B69DAD3A9BB772DE9F3031A1E
                                      SHA-512:7F321D7FFD261D411435F6CC8C1B85A0E33AB0A807DA6E8EF6B41205E11CB4F9205A254A212D9784424C4DE1D2CAD18AADCC28829D1D911CAC260463552A1AFB
                                      Malicious:false
                                      Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ...........7.F..2.......7.F..2.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............n./G.5.(...,8b.....N...^.....................YI.NK..1..........f........................................I.qk..B.....LZ............n./G.5.(...,8b.........n./G.5.(...,8b.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002L.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                      Category:dropped
                                      Size (bytes):1717
                                      Entropy (8bit):7.154087739587035
                                      Encrypted:false
                                      SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                      MD5:943371B39CA847674998535110462220
                                      SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                      SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                      SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002M.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.303948846701295
                                      Encrypted:false
                                      SSDEEP:48:pGNsP64nvzfntQM7EKd79yXy+59GxboFTrdQqr1IlRSBXfg5f8g:isrz/xEKd5yXJ9OkRQyyLSS8
                                      MD5:AC4DE3C75AA39DD3FA1EE1BD5F7AF130
                                      SHA1:3A952660428F048B2F5DBFAC817E11CEE99802AE
                                      SHA-256:58341CBF06EB9650D8BC0491268BDD57135E6CFBF7F4203124FEAC811B90AE19
                                      SHA-512:313D2EAB629D89E5929678309C504B3AD0E13EBFE8CF2A863BA7AF108B8DE7DD8427D1164D87C5303EB2B8BB49433F8769884F1C01D870ECF87F9E693A7816D6
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ../......./..g..;...Z...../..g..;...Z...../..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............aj.xr...J.I.L.....N...^...............sm.....J.....).........f........................................I.qk..B.....LZ.............aj.xr...J.I.L..........aj.xr...J.I.L............/......./......./.........................................../j....../T.]..../......./..B..../H....../..B..../..>.)../..J...................;........4...4...4.."................/.../.../..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........../......./....#../............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002N.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                      Category:dropped
                                      Size (bytes):3555
                                      Entropy (8bit):7.686253071499049
                                      Encrypted:false
                                      SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                      MD5:8A5444524F467A45A5A10245F89C855A
                                      SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                      SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                      SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002O.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3738698847136295
                                      Encrypted:false
                                      SSDEEP:48:AsVcqzdMnEXtw5WElW/X4P9evaoHBrdQqrbwa6I2BX+Q9qwF:AsyEXW8EM/X4P9VYRQyEXD
                                      MD5:5AAF8B1F0E26732CA245A1D965223BE9
                                      SHA1:74CF488841C31A11B4CCB1B4B6B5C6CDDC714696
                                      SHA-256:3070CBB3819D2DAF319F9777AA20249EB411C95A72778782012644EFBD25FC23
                                      SHA-512:9927B184068DD1E10E84DB321C32ACDDAB725A37EF819FC3043B22FE83942A68D0C6172364810B4D9B1FA80A9709F5060093E4CE25CBA5693F45C2329810C719
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.........U.Cj..p...S<g..U.Cj..p...S<g....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............`t.Ehh../..........N...^.................m6...J..(H.W..........f........................................I.qk..B.....LZ............`t.Ehh../..............`t.Ehh../..........................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002P.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                      Category:dropped
                                      Size (bytes):3428
                                      Entropy (8bit):7.766473352510893
                                      Encrypted:false
                                      SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                      MD5:EE9E2DF458733B61333E8A82F7A2613D
                                      SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                      SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                      SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002Q.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.373553035745973
                                      Encrypted:false
                                      SSDEEP:48:sPsKQz4lDLtixEXNrx73tcX7c9abo9rdQqrpHVBxBXZtW9g0due:osj4lDL4EXNrxTtcX7c9IcRQyV5m
                                      MD5:631B2E84DFC6C3D3236F2EE0029B9E55
                                      SHA1:DE85117F6FA57DBEE194B4A28B7FEB4049755C7C
                                      SHA-256:1298DC05776DD2DAD0C50832DFDC8D380D8B898516106670F593C20EB5B24882
                                      SHA-512:A5DED3C64ABA89D5E5B3DFD9E6CC5CDBB81CDDBBB482BA9F4AEEDB50341FADFCE4E601C59B2A9D86F52AC047084B23DDC786D58AD18B10F7A7842EBDCF7CE797
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZT.......T....c..-.x6}i.T....c..-.x6}i.T....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............iZY&O....4..L......N...^...............r./;...J.9..{..:........f........................................I.qk..B.....LZ............iZY&O....4..L..........iZY&O....4..L...........T.......T.......T...........................................T..j....T..T.]..T.......T....B..T..H....T....B..T....>.)T....J...................;........4...4...4.."..............T...T...T....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........T.......T......#T..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002R.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):65589
                                      Entropy (8bit):7.960181939300061
                                      Encrypted:false
                                      SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                      MD5:8B48DA9F89264D14B83FF9969F869577
                                      SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                      SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                      SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                      Malicious:false
                                      Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002S.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.369992138429253
                                      Encrypted:false
                                      SSDEEP:48:APs9RlQMto+mEmdPsCXR9q6odrdQqrsDiBXiGUk7Qaak31:qsNQMAEmdkCXR9tURQyeiiiH
                                      MD5:5E5F8B834CFE14B77EFE611B3BEF2B39
                                      SHA1:69402BB4644E4D3C519B25C11572D3412C2BDDEB
                                      SHA-256:269F401716B44FA8AE4E6F59E054FC458D3F09816D6CFF0789009738F38D30A0
                                      SHA-512:721C2D8B8858621722D8D47261DA053ECF15CC6F538CB333D8CE56D43C9838E8F6C6274C0E43BEA38347AA3D8457103705B2115CFC8EFF7F08DBDB2627195EDC
                                      Malicious:false
                                      Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ7B......7B.T.,..2.~a2#B.7B.T.,..2.~a2#B.7B...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............|c......(....%.t....N...^.................}[.Z=N.B0r...........f........................................I.qk..B.....LZ............|c......(....%.t........|c......(....%.t.........7B......7B......7B..........................................7B.j....7B.T.]..7B......7B...B..7B.H....7B...B..7B...>.)7B...J...................;........4...4...4.."..............7B..7B..7B...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........7B......7B.....#7B.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002T.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                      Category:dropped
                                      Size (bytes):1873
                                      Entropy (8bit):7.534961703340853
                                      Encrypted:false
                                      SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                      MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                      SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                      SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                      SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002U.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.486093532702645
                                      Encrypted:false
                                      SSDEEP:48:WBsGR1lL7tUEeuXox9Ty7oardQVrumWBXtukVFl:WBs6l/WERXm9MHRQ543
                                      MD5:B4D8B510584ED20BBAC69FB3755447A3
                                      SHA1:63C105B7AB2DF9766D6E0AB05228C65864ABB59E
                                      SHA-256:3302A49D003F403FFAF34BB9AFE7DF52F165BED13C3B6A04DCDB5FC9FCD0D896
                                      SHA-512:154A187495FAD9E6D33C1CF21C255383D5F74FF3FA3689B25BC1915617E0B8EFFA9BC3045A1D5ABE3F1A3D6DA9A40934A5036CA824E8FC764D1A6283845CE5BC
                                      Malicious:false
                                      Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................9.......9.t.0:.-L....._.I.......I.qk..B.....LZ.9.t.0:.-L....._.9...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............H....O..R...!"\....N...^...............,.)&..m@......-........Z........................................I.qk..B.....LZ.............H....O..R...!"\.........H....O..R...!"\..........9.......9.......9...........................................9.j.....9.T$c...9.......9...G...9...H...9...>...9.......9. .3...................;........4...4...4.."...............9...9...9...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........9.......9.....#.9.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002V.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                      Category:dropped
                                      Size (bytes):5465
                                      Entropy (8bit):7.79401348966645
                                      Encrypted:false
                                      SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                      MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                      SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                      SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                      SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000030.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                      Category:dropped
                                      Size (bytes):3361
                                      Entropy (8bit):7.619405839796034
                                      Encrypted:false
                                      SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                      MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                      SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                      SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                      SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000031.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.346587154884703
                                      Encrypted:false
                                      SSDEEP:48:yFLsS1DuFQ+zi9XKtOMSBED5uXFL9ydeo9rdQqrPf1me6BXS9mQBvKVW2G1:KspgKCE8Xp9yM0RQyPCc9
                                      MD5:F599E09EAD9119E0B0B54FBC82F75C74
                                      SHA1:1540DCA1859C5234427B990C80C3564F3528283B
                                      SHA-256:AC5BFA891381D5563C6354EA959624B358535F625B772C50A0F03A6E9434A1F4
                                      SHA-512:598CC1BEA2CBAEDC5797EF11891930B0F18ED6F725640994CB8DBE3FE147BCD18D4BB701580C88582F18870A90AFF6B94DA20122BA8C7DB087B6E700CB3A0200
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZGb......Gb..h)...GdXQ...Gb..h)...GdXQ...Gb...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............6..H.$<.(Z..x.`.....N...^.................lq.M.F.HCkZ.c8........f........................................I.qk..B.....LZ............6..H.$<.(Z..x.`.........6..H.$<.(Z..x.`..........Gb......Gb......Gb..........................................Gb.j....Gb.T.]..Gb......Gb..B..Gb.H....Gb...B..Gb...>.)Gb...J...................;........4...4...4.."..............Gb..Gb..Gb...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........Gb......Gb.....#Gb.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000032.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                      Category:dropped
                                      Size (bytes):140755
                                      Entropy (8bit):7.9013245181576695
                                      Encrypted:false
                                      SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                      MD5:CC087700C07D674D69AFDFDA0FA9825C
                                      SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                      SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                      SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000033.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.352342097785993
                                      Encrypted:false
                                      SSDEEP:48:YufqsQ0X/6deu8tUN8EuVLRXpC9ieoFrdQqrzUWBX/0BKOt:Y0qsAdeu8ymEuVtXpC9ieMRQyDJC
                                      MD5:6C66C1377C6694588A355291A34B6E0B
                                      SHA1:8BC9C61C8336CD047B6B1C033247445CE88F59CA
                                      SHA-256:A38D95CC9F3B619C58D39FEED30C91BE2BDFE129752A26F5658C06FFB7825C37
                                      SHA-512:05FE07CE5CAFFAC77D2179ADCD9D74327D59ECDC515F6C20D880D45FA61940FFDCAE666DEF467F745DBB5428E66979D732809CED3E72943DF618C8D53292F429
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZd.......d..g.=.-Ee..{.d..g.=.-Ee..{.d....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................]i......=H.}.....N...^................&U#DHzK.E@R|...........f........................................I.qk..B.....LZ...............]i......=H.}............]i......=H.}..........d.......d.......d...........................................d..j....d..T.]..d.......d...B..d..H....d....B..d....>.)d....J...................;........4...4...4.."..............d...d...d....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........d.......d......#d..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000034.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                      Category:dropped
                                      Size (bytes):129887
                                      Entropy (8bit):7.8877849553452695
                                      Encrypted:false
                                      SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                      MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                      SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                      SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                      SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000035.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.350176362284015
                                      Encrypted:false
                                      SSDEEP:96:YVsu3X+gnowjEr78XI92Re0RQygYihLUXxiLY/w:2su3VnoPr78XI92Re0RJgYihLUBiL0w
                                      MD5:4DF378A82493685F30FD029BD3794A9F
                                      SHA1:A4C54D624BDBB4414F2383A6A3D27E708F120814
                                      SHA-256:44B6A2EBDEAFAA1A26881A64D16177FC5706CB6FC81FA8599B0129AC4B64FA67
                                      SHA-512:3215E2F1B9948D3F8767A0DD7627764C2CED06610EF204FD835C1AF9CF3045C95041331C48F61E951022A99C2A1B4020E57DD8CE1FBC34BE8D70675D8C88A371
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ...........}..L..4..a..Z...}..L..4..a..Z.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............._..r&..}.S#.......N...^................m..T..O....X..........f........................................I.qk..B.....LZ.............._..r&..}.S#............._..r&..}.S#...........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000036.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):84941
                                      Entropy (8bit):7.966881945560921
                                      Encrypted:false
                                      SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                      MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                      SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                      SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                      SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000037.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.311087768770338
                                      Encrypted:false
                                      SSDEEP:48:YuisU+moucwfGBt+zEe+h8XXO/9+3o5rdQqrjxzHBXrKSrNrW48LHSrf/5rJ9:YNsWZfeKEPCXe/9+3oRQyFzF/j/5
                                      MD5:390255383BAB1808DED5F010A00AD19D
                                      SHA1:72B3D61D4D3559AF0DBF84C80141A42E4E19467C
                                      SHA-256:F80281E3FCBA90E0CFB26F6FFEAB639311600701ED4E4042DE9620B873EF029B
                                      SHA-512:01178AE99D5B46A2978738098478512B4AF8A7B717BBECB975499A88D2EA445CDD77734AACFC5798B48DDBD46ADD49AC002B78189C2C002D8530439FAF9EF7A5
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x...........................}.......}......16U.SV...I.......I.qk..B.....LZ}......16U.SV..}....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............E.J....;...-.....N...^....................Z.N....T.$.........f........................................I.qk..B.....LZ.............E.J....;...-..........E.J....;...-..........}.......}.......}...........................................}..j....}..T.]..}.......}....B..}..H....}....B..}....>.)}....J...................;........4...4...4.."..............}...}...}....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........}.......}......#}..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000038.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):1569
                                      Entropy (8bit):7.583832946136897
                                      Encrypted:false
                                      SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                      MD5:07DB3F43DE7C1392C67802E74707DAA6
                                      SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                      SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                      SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                      Malicious:false
                                      Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000039.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.361027999651294
                                      Encrypted:false
                                      SSDEEP:48:8seQilHPHtSFJE+YlLvXGatE9ujoVrdQqrzp5BXLU9weZ:8s6lHPHCEplLXvE9ujkRQyd5w
                                      MD5:6993E74F3312C6AF4B9CE56818753BB3
                                      SHA1:9B6DAED3F2D201A59B048ABDBE58C4A1F92CC6EB
                                      SHA-256:34D6EDC0DE680FBA80BD8A82A87939C0C284AA51A9991A6E1871BC01AE8CD4A0
                                      SHA-512:841484123804CA1C474FE26EF18B015E0695FBDAA75EBA8BC6F742E13EA96C40C0A528C4F17C30E7F12C38EF57EC87E6C3E0D66D2DB4C9612B9E54D7A0490B09
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..}.......}]............}]............}..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............vd;....2-..E._.....N...^..............._......B.._..l..........f........................................I.qk..B.....LZ.............vd;....2-..E._..........vd;....2-..E._............}.......}.......}...........................................}j......}T.]....}.......}..B....}H......}..B....}..>.)..}..J...................;........4...4...4.."................}...}...}..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........}.......}....#..}............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003A.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):40035
                                      Entropy (8bit):7.360144465307449
                                      Encrypted:false
                                      SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                      MD5:B1DDD365D87605F96D72042CB56572F6
                                      SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                      SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                      SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003B.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.6223362512522055
                                      Encrypted:false
                                      SSDEEP:96:l7satCoxiPmE3/OXB98PuMRQy39gCJ6xne:lsatCoxib3/OXB98PuMRJNgCJ6xn
                                      MD5:A3DA6C429455FCAA3C1CF815F9822362
                                      SHA1:CB325BC62A9F39BCE955D7E83475CF2264E7778C
                                      SHA-256:34BD6C0DC87B30DD5C853A99A88016D63F4ED6845737B0FF4056497055EB9EB2
                                      SHA-512:FABD232C5AF38A2A03D2A82DD96B818D7AE70807ACB7A6C0C57AFAA190D16932E9639C6181CEE1A0CC0CBE552106306D7A763DEE4A6B0D1E2C80344BC5B8F993
                                      Malicious:false
                                      Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZ.........9.......gDH...9.......gDH.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............`.*k.B..)^.|.H[.....N...^...............i.A....J..A..@.........f...................................:....I.qk..B.....LZ............`.*k.B..)^.|.H[.........`.*k.B..)^.|.H[.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003C.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                      Category:dropped
                                      Size (bytes):242903
                                      Entropy (8bit):7.944495275553473
                                      Encrypted:false
                                      SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                      MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                      SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                      SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                      SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003D.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.329181497125768
                                      Encrypted:false
                                      SSDEEP:48:YuSsJj5vxJ/tviDEXMRLYXp/weIX9erorlrdQqrHb3wSBXLtq1MB:YlsPv7/lgEXMR8XNIX9er+lRQyUSYM
                                      MD5:15477B4D0C53F05CE7E65E7F3E80F337
                                      SHA1:3A094E2D812C346D7AA38F8C8F503EE5C9F2C0F2
                                      SHA-256:C72556C3C9FAFE1996B1A6503CF90EFE67A31E8F8F03DDF768AEC9819ECC26B5
                                      SHA-512:B3A3AF7D97AFC5FAB6FAEFE683ADD6CF6E0046F9F35AEC775F5EDAE365B501051FD823B612915BC606793E87AE0C66C9077E673FC8C4F9DAA0193C9777290E63
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZDi......Di. ..I..%{1..Di. ..I..%{1..Di...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................W..)......M....N...^...............O7...B.O...b...+........f........................................I.qk..B.....LZ.................W..)......M.............W..)......M.........Di......Di......Di..........................................Di.j....Di.T.]..Di......Di...B..Di.H....Di...B..Di...>.)Di...J...................;........4...4...4.."..............Di..Di..Di...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........Di......Di.....#Di.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003E.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                      Category:dropped
                                      Size (bytes):70028
                                      Entropy (8bit):7.742089280742944
                                      Encrypted:false
                                      SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                      MD5:EC7811912ACA47F6AEB912469761D70D
                                      SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                      SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                      SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003F.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.325866733725053
                                      Encrypted:false
                                      SSDEEP:96:WsymWxjYE5VyXuq9W2kRQyZUcibbTcMMZ:WsVCpXyXuq9W2kRJZW
                                      MD5:B6D347256E81370FACA0F51A7F89FAA2
                                      SHA1:53B9EC6F2AD1C6E81F92ADD82787F37F4DC50C9A
                                      SHA-256:37B0CCE2B42C44EB816A4AB84F0029A8F81FF53B96A613D952D28D6912B38972
                                      SHA-512:3E18BA8C74CD28ECB5B1E410A64215A4BC9138C9879B2F3EADB315DE15D404A6ACEE2F7A70328825D07410F5C9C39692E8E9A91CB2781DBCECCA629CB9CEB455
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.........F..].,O...{B...F..].,O...{B.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................YT....J..W......N...^.................n0...D..,.UV..........f........................................I.qk..B.....LZ...............YT....J..W.............YT....J..W......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003G.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                      Category:dropped
                                      Size (bytes):24268
                                      Entropy (8bit):6.946124661664625
                                      Encrypted:false
                                      SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                      MD5:3CD906D179F59DDFA112510C7E996351
                                      SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                      SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                      SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003H.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.316030820155276
                                      Encrypted:false
                                      SSDEEP:48:mssSN1Nuf2bz+t46rEr07Xf393YTroBrdQqrDdC72BXjN4NCVUm3oWr9:msCf2byvEOXv93ur4RQyE2Xf
                                      MD5:D35D3E57013B1A695BE10F5D93F292B5
                                      SHA1:B2AA547B9AC09A28674D4964EA464892016F9D97
                                      SHA-256:2A010969691EA14E7CAEA5EDA2B3F1E6754B701448F21DD2FB2C086DDF0AE859
                                      SHA-512:FB0DD2B37079ED5318D0268E88237896CD5A3715F5D912BA03551FA7935E32FE627BDE8880DE67276091F5451A1B17BBF4AC951DC59DB7B391846F618E76551C
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.e.......e.}.?T.1.uA ...e.}.?T.1.uA ...e...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................00#. a..R.......N...^................%.}p.1K..z..H.........f........................................I.qk..B.....LZ................00#. a..R...............00#. a..R.............e.......e.......e...........................................e.j.....e.T.]...e.......e...B...e.H.....e...B...e...>.).e...J...................;........4...4...4.."...............e...e...e...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........e.......e.....#.e.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003I.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):47294
                                      Entropy (8bit):7.497888607667405
                                      Encrypted:false
                                      SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                      MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                      SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                      SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                      SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003J.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.465713540000981
                                      Encrypted:false
                                      SSDEEP:48:9ysL11eI+a45XtgUZEwLvFLFXTi9e+WoGSrdQqrX7BXR+C8C4kH+aMKCWjYeBC3Q:Us85XKEEwrXW9eB1SRQyreHCJcHojO
                                      MD5:A7A10C7BB2BD779051CCFF43E96C6F44
                                      SHA1:A3EE1EE121BEAD904FA07000C8074283756AC7EB
                                      SHA-256:0E8B318FEB0E212BC5CC449D03D442D16AFE3AA4EC606F1AD08C5A26126612C5
                                      SHA-512:7F50BA8599281BD0ECE68096EF5EC112C731F26C5F31A480C5867D4D3AF81581DE65DD2DBE7705CC9356C15137BED5303DFD69EBE896AA4A74F498C6B16EEB40
                                      Malicious:false
                                      Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.ax......ax.l...#.Y.5.O[.ax.l...#.Y.5.O[.ax..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................!^c..&.....N...^.................Y...8A...............f........................................I.qk..B.....LZ....................!^c..&.................!^c..&...........ax......ax......ax..........................................axj.....axT.]...ax......ax..B...axH.....ax..B...ax..>.).ax..J...................;........4...4...4.."...............ax..ax..ax..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........ax......ax....#.ax............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003K.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):347
                                      Entropy (8bit):6.85024426015615
                                      Encrypted:false
                                      SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                      MD5:78762C169F8B104CB57DFF5A1669D2DF
                                      SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                      SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                      SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                      Malicious:false
                                      Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003L.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.349336745090841
                                      Encrypted:false
                                      SSDEEP:48:07UesJ5dmpItp0dE6xXw9MzdorBrdQqr8inDLdBXZbo98Wkc:07xsVmpIDQEmXw9MzduBRQy84LdDK
                                      MD5:7D795259B2ECA6E696524A652642AD92
                                      SHA1:D79D38AF097321490E06DAD6C08DC14C9C2F72F4
                                      SHA-256:6EB5DBA51F18EDDD39223C497092B54C63C83A7C79BD8CF5AE4AF34DE4DF9514
                                      SHA-512:A82D6B05556E218F1F15D370720CBACBD287907C5890868693A40DBB4ED70BC04FE380C1C3B493F1E5E5D0DBA8FD38F5436B3DDC779BE406617911B2DC738983
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ................".9.<.P........".9.<.P.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............RZ.p...7.B..gD....N...^................!.|<.@...............f........................................I.qk..B.....LZ..............RZ.p...7.B..gD..........RZ.p...7.B..gD........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003M.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):827
                                      Entropy (8bit):7.23139555596658
                                      Encrypted:false
                                      SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                      MD5:3E675D61F588462FB452342B14BCF9C0
                                      SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                      SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                      SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                      Malicious:false
                                      Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003N.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.313626815228004
                                      Encrypted:false
                                      SSDEEP:48:s0esX23L7MtRrPEX24L8X7b9uDoxrdQqrsdxBX9550Vkp:KsU7M/EXnoX7b9uDwRQysPOk
                                      MD5:679F0FCE06F1C55CECACA5C6402E5D45
                                      SHA1:35B25F5E8E91042AA80BFAAABAB8F61B8187E0AC
                                      SHA-256:9C81332454FEAFD1785C54DF7AEE10D4EEE24FB85F728AA2D06EDFCFC9C6493E
                                      SHA-512:59DAF1C7CE28F73F2014F24C8D08F33375861077771E63F3F639761A6E1297465B2B97FE465F8484C5DE49F7BFDA67E00EB6063CE081820A5C4C2409BD16AFA4
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.y.......y.....wD.2....y.....wD.2....y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............k..i....=?.qi.aV....N...^..................`..mL...).e..........f........................................I.qk..B.....LZ............k..i....=?.qi.aV........k..i....=?.qi.aV..........y.......y.......y...........................................y.j.....y.T.]...y.......y...B...y.H.....y...B...y...>.).y...J...................;........4...4...4.."...............y...y...y...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........y.......y.....#.y.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003O.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):4410
                                      Entropy (8bit):7.857636973514526
                                      Encrypted:false
                                      SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                      MD5:2494381A1ACDC83843B912CFCDE5643B
                                      SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                      SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                      SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                      Malicious:false
                                      Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003P.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.279050185208988
                                      Encrypted:false
                                      SSDEEP:48:YuRGvbsLs3dcY5bGtm5EZUncf0LHQIXrQI9+xoKErdQqrxVwkBXnxpuyh1:YUGvbs0RJGsEZnf09XN9+xkRQyQkpKy
                                      MD5:B2D97B5D05393101C7AD974BF9083416
                                      SHA1:1EB309639BC51DFF511AB5FA0899D7069F2E3F8C
                                      SHA-256:B0F836C3CA3E2585C57EA936E377DF83A05435F2F3004DE2D009EDAC993888D1
                                      SHA-512:ABAAAFBD734457EDC6CB38E100F64C5BA2E8DC5467EEEFCD6C0A665013F4CF4088ECBB6987D0DB408214E002DE6FB3D1DF46C6D2F83AE8CF6B4C2C595B63E8F5
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.............r.7_..k`i.....r.7_..k`i.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................dFJa.0....N...^..................e{.J..@G.h..........f........................................I.qk..B.....LZ....................dFJa.0................dFJa.0........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003Q.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):136726
                                      Entropy (8bit):7.973487854173386
                                      Encrypted:false
                                      SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                      MD5:4A2472AC2A9434E35701362D1C56EDDF
                                      SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                      SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                      SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003R.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.335215944341873
                                      Encrypted:false
                                      SSDEEP:96:2sGTs/d19fp+JWEKHpcXmbJY9CVgRQy2T4Hl/QFKEPi6wHOdK:2sG4/d19czAuXmlY9CVgRJ2Tw/QoEPi
                                      MD5:FFBAB486A9FD421D7B0C6FDA030287A5
                                      SHA1:04D8695A52941B0F7514B5A7D0F11794DA6AD0F7
                                      SHA-256:4F4808F70CC76DD932757E10F20A6113EC10AE090769FBA79B63184F3893622C
                                      SHA-512:5183323AD797444C63DD504A6C00EE55D1D8A2DB855696574570B734551AEB1115F32ED0411E6A60A6DD0EA512BDF9E8203BFBD836E1DEA93FC60EB9AC1E8D37
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.P.......P.8(t....=.R.A..P.8(t....=.R.A..P...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............9y..).p.7?.@...?....N...^...............[m\...fB...K.,Y.........f........................................I.qk..B.....LZ............9y..).p.7?.@...?........9y..).p.7?.@...?..........P.......P.......P...........................................P.j.....P.T.]...P.......P..B...P.H.....P...B...P...>.).P...J...................;........4...4...4.."...............P...P...P...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........P.......P.....#.P.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003S.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):5136
                                      Entropy (8bit):7.622045262603241
                                      Encrypted:false
                                      SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                      MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                      SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                      SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                      SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                      Malicious:false
                                      Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003T.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.423335002381969
                                      Encrypted:false
                                      SSDEEP:96:ytUsCbxUJJaAEUXw9KNMRQyoB5Wt6Q86w:6UsCbxUJJUUXw9KNMRJA5Wt6Q86
                                      MD5:AA11A2219DBCC402CEA930E62302DD66
                                      SHA1:80FFEB0610493D1DB7623AC1319C3FBA8653E34B
                                      SHA-256:DFF76EC06965D0108A87D7324F0209B5E36D5D6EA3527A69D17428E4686560BD
                                      SHA-512:F17E788D5C3CEC6177DE641A7FFD7CB4A3CC4789094253D294F3D2E48066A352876FF43DA081BB00D0CF5C66CA5BB75DC0CC72B3C1CF589A3082221EAEE0297F
                                      Malicious:false
                                      Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ7.N.....7.N...........i7.N...........i7.N..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............\..../.;..wD.....N...^.................#1..zF..,............f........................................I.qk..B.....LZ..............\..../.;..wD...........\..../.;..wD..........7.N.....7.N.....7.N.........................................7.Nj....7.NT.]..7.N.....7.N..B..7.NH....7.N..B..7.N..>.)7.N..J...................;........4...4...4.."..............7.N.7.N.7.N..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........7.N.....7.N....#7.N............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003U.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):52945
                                      Entropy (8bit):7.6490972666456765
                                      Encrypted:false
                                      SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                      MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                      SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                      SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                      SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003V.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.4210209986632565
                                      Encrypted:false
                                      SSDEEP:48:zWvHWsX74vtRthQnEbLRXX4XYm9Wo3LZrdqrbWAnBXjjgN2QLEp:CWs0vPmEbmX/9WoVRytnRgS
                                      MD5:15E3588C5672D32099A672CED5149755
                                      SHA1:85D983316EB076D7951221499ACB81F8398FAC85
                                      SHA-256:7544D41DFCD3EB12BB72B4EB580A7A5494FF50EBA50F9624E11D41C842DD986D
                                      SHA-512:5DAE39F058ECA4605382B3F17AFEBAA76D349980A577AE73E56D800A602ADF7121BD73B9D0D0507DCE6CE60EBC401D25B6B96F9EEC0F0B54E3D3D4F32AE4E92E
                                      Malicious:false
                                      Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v...............................................>.&.'K...I.......I.qk..B.....LZ........>.&.'K.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=.....6.......E....N...^......................I.tP...j........f........................................I.qk..B.....LZ............=.....6.......E........=.....6.......E........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000040.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):79656
                                      Entropy (8bit):7.966459570826366
                                      Encrypted:false
                                      SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                      MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                      SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                      SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                      SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000041.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.479507841697745
                                      Encrypted:false
                                      SSDEEP:48:mVsiIa3EQRbM+t3dUhEWniqlCgXyTf2dJg9LqoNrdqr2Z6D5JRXxkYbykH0fYrRz:ks6VRbM+tdMEwXrdG9LqMRy24D5JNH
                                      MD5:48C584442CE64EE17CF727B8D5228D09
                                      SHA1:49E64232034841F589DC1F6056607B461BB640A6
                                      SHA-256:1D78CD8B2260D14DEA6A963B3CF76CFCD33D9BF75311219E2A056C2D20C46806
                                      SHA-512:4259E602C3872B410377A34559D2CB7D615C40C154BEC3A62B1C6D2897C35588BA7B5087B52EB72E6F54BD16315350024211177BD271BA21DB5C16C2AEDD4604
                                      Malicious:false
                                      Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ.........J..Q.8..b.-.~..J..Q.8..b.-.~....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................[`sl.=...m.......N...^...............Y..aH.C..).8.nr........f................................... ....I.qk..B.....LZ...............[`sl.=...m..............[`sl.=...m.......................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000042.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):40884
                                      Entropy (8bit):7.545929039957292
                                      Encrypted:false
                                      SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                      MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                      SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                      SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                      SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000043.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.366935736222218
                                      Encrypted:false
                                      SSDEEP:48:Yu+shrWOrNapUxtemEfM+3XH5C9ZtLoZrdqrvfRXOtfrNRie5kStF:YJs6pUxTEE+3Xs9nLwRyXwl
                                      MD5:3211EBDD1411C63BF47ABE122CAD5C02
                                      SHA1:A49B76C0E390F20AB53499F05581FB8CCCCB05C4
                                      SHA-256:B0541138CF28BA5408C08FC41C1C32FB348B664C05C603A49C6CF8A1DB1B915E
                                      SHA-512:4C33254C02A4FBF9337D6B3927BC11ECEFFB7F0332075B602A425F1F113E15EA57DC2009D928820BEED014A926846DCC5CA3438A6E8803B2EC25514219AA2184
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ........... ...,........ ...,..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............HS.3@.n..9c.3.......N...^..................6.}.D....D...........f........................................I.qk..B.....LZ............HS.3@.n..9c.3...........HS.3@.n..9c.3...........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000044.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                      Category:dropped
                                      Size (bytes):68633
                                      Entropy (8bit):7.709776384921022
                                      Encrypted:false
                                      SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                      MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                      SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                      SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                      SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000045.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.4568194268541905
                                      Encrypted:false
                                      SSDEEP:96:5msjJUySCKGdEg37mXEcXbfc9TZrERyOInkm0Q/:5msjLSrG6g37mXBXb09TxERyOwk
                                      MD5:87800359686BC7BBDA16BAD8E74A542C
                                      SHA1:4E950BF9CE87407F27291AD340DFC3EA6254644B
                                      SHA-256:1F75EE01E131EF9334BD8457FD9DAAA4616876769B7AA3E872A549C579B79EA6
                                      SHA-512:E5B0AD332841621D0A01137BC7576CA1F7886810E75129983929EC1E1EBBFCC0CC4D7BF15E944236323D4DB935AEBEFE083A0E81D5D95113DC58D9A42C973741
                                      Malicious:false
                                      Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZNs......Ns.......Q.....Ns.......Q.....Ns...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............C..w._o.2[!v..3.....N...^.................Z.A..J......m.........f...................................$....I.qk..B.....LZ............C..w._o.2[!v..3.........C..w._o.2[!v..3..........Ns......Ns......Ns..........................................Ns.j....Ns.T.]..Ns......Ns...B..Ns.H....Ns...B..Ns...>.)Ns...J...................;........4...4...4.."..............Ns..Ns..Ns...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........Ns......Ns.....#Ns.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000046.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):11043
                                      Entropy (8bit):7.96811228801767
                                      Encrypted:false
                                      SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                      MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                      SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                      SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                      SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                      Malicious:false
                                      Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000047.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.349838190723826
                                      Encrypted:false
                                      SSDEEP:48:Hwsv+scxtqSEQLBXZG9vLXoNrdqrWYLRXu4F9hZ5:Hws3cxvEQlXZG9jXMRyXL7
                                      MD5:4C59D5090A04773AAFF870909264EDFE
                                      SHA1:3A7B73E3FBAE9211CA3E5EA583290C97734C54AF
                                      SHA-256:B12FDED3EAD35A2E576CF100F26EF8BAAEFD25388F6398E360539A2AC96C760A
                                      SHA-512:6D74855C322967D31855471ABBCFA5DB576F659921B683A7C1C4D943381DC93FAFCA41BB754A33F8DF02F2AE83DC8A35EF769C6A3DEB8118A13D3CA196ABDD7F
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.4.......4.%.6..1.#..%Q..4.%.6..1.#..%Q..4...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............B..R.V....c.9d....N...^...............;.....A....@R.n........f........................................I.qk..B.....LZ............B..R.V....c.9d........B..R.V....c.9d..........4.......4.......4...........................................4.j.....4.T.]...4.......4...B...4.H.....4...B...4...>.).4...J...................;........4...4...4.."...............4...4...4...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........4.......4.....#.4.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000048.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):647
                                      Entropy (8bit):6.854433034679255
                                      Encrypted:false
                                      SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                      MD5:DD876AA103BEC3AC83C769D768AD39FB
                                      SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                      SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                      SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                      Malicious:false
                                      Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000049.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.335322504089309
                                      Encrypted:false
                                      SSDEEP:48:8w6sEu8jxyIV6UtDCEjFL4XVl59b3olrdqrKn/vBRX2IUglcg:8w6sWxnEU8EjFsXVl59b3kRyKnBjlc
                                      MD5:FFF95A646B2240C28BCCD5D0310C1100
                                      SHA1:3AA431A199C8534DAE0C8A28702CB089A16B5607
                                      SHA-256:148795362F0CDB6C4A8CF4A26DFB100C244F71724061C0C2EF647F3858484965
                                      SHA-512:5E15D5F008EA71B5E45227974D5C8FB1667C9CDF09BD8910E573F19D9868C2DEE5B42E771BECF7428197ACBFAC96504E42B1AFAABB3A4362A44A3320EE868D9E
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.,.......,.x.2..?...(...,.x.2..?...(...,...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................R.. .........N...^...............>t.F...M..G..T?}........f........................................I.qk..B.....LZ.................R.. ..................R.. ...............,.......,.......,...........................................,.j.....,.T.]...,.......,...B...,.H.....,...B...,...>.).,...J...................;........4...4...4.."...............,...,...,...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........,.......,.....#.,.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004A.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                      Category:dropped
                                      Size (bytes):52912
                                      Entropy (8bit):7.679147474806877
                                      Encrypted:false
                                      SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                      MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                      SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                      SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                      SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004B.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.289663224583287
                                      Encrypted:false
                                      SSDEEP:96:BYssRJ6UM05EktX39T38RyhTPgeorjbeoqR:BYssf6U4ktX39T38RyhT4eorjbe9R
                                      MD5:DF88AE931C9A4FAE70A4C0FBED3FA9B9
                                      SHA1:4902DAB0291A113C8D3E11DC1C950BC5FD10830F
                                      SHA-256:E1E39AD6455253F47D20781EB539ED93A41C9CB0A285BCD83988A6AC54604528
                                      SHA-512:BA1B979DED44DB3D453DCD6D0CCDBB9215D435B273D00720464C75BB77477C3A53837D0C5807CCBE4576821CE34CE8B7003FAEC3D17E3D5A5420603ABBF91E7C
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........5.."...'...-....5.."...'...-......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............e.J:....&.s.0d....N...^................7s....G.gr.}.).........f........................................I.qk..B.....LZ..............e.J:....&.s.0d..........e.J:....&.s.0d........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004C.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                      Category:dropped
                                      Size (bytes):27862
                                      Entropy (8bit):7.238903610770013
                                      Encrypted:false
                                      SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                      MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                      SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                      SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                      SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004D.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.461161359154362
                                      Encrypted:false
                                      SSDEEP:48:+sENOBoyE+u1RMtVME5zmOXN99XJoFrdqrDiRXcMBgB6NqBkiBDBgBrRBxB1:+srBZ+qkE56OXN99XJsRy+zKxH1KrHn
                                      MD5:F1118594207BE323E024366108539090
                                      SHA1:969A09AACDBDDEFF2A257297E52DE21F7F16C355
                                      SHA-256:1691F1084D8DA8005FD03B6A2A3A56C472477F03ABEF3486377D81DBA25AB407
                                      SHA-512:41704A72351E9B11F5ECF5AEC2249E5D4ABC69A91928972DA4203BE18B8A4CA39C7EDBCF2FE0AD67D778F44A1BB804BAB74CF72E34567735F4E1A5E1C383DA4F
                                      Malicious:false
                                      Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZ...........#H.B.=z"...}...#H.B.=z"...}.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............D.l...........S....N...^...............]d..o..D.....K.........f..................................."....I.qk..B.....LZ.............D.l...........S.........D.l...........S........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004E.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):977
                                      Entropy (8bit):7.231269197132181
                                      Encrypted:false
                                      SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                      MD5:B7F74C18002A81A578A4EE60C407A8D3
                                      SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                      SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                      SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                      Malicious:false
                                      Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004F.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.335701930971071
                                      Encrypted:false
                                      SSDEEP:48:DjAsvEuAyp2RD5Wtt8lE3VpLCWX8/9/TSoZrdqreNYRX5ZC9fyPpX3hspt:DjAs72RD5WzEE3TzX8/9/WARyeYG
                                      MD5:4F40F2BE461A4C2EB2263C5323F775F7
                                      SHA1:7B4973964A6198092CAC15ADDFC6FE437966465F
                                      SHA-256:CA8E2F48BC20B21E314EC512CCC3515C0E2E06C0D758D93FDA6C6259FC6E836D
                                      SHA-512:F6D3F27D3A2C379B669A2E0C544A445E3FCE57D8788D058599FB7E2DA3B5AC4F71DA6D1E621EFBABCBECE3959F54FE93A7154C2855131A18FCD7FF133C4DEAAD
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.............Y......U.......Y......U.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............{x.....;+.tA.:....N...^...............X.o....L..2W6.A.........f........................................I.qk..B.....LZ..............{x.....;+.tA.:..........{x.....;+.tA.:........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004G.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):34299
                                      Entropy (8bit):7.247541176493898
                                      Encrypted:false
                                      SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                      MD5:E9C52A7381075E4EBC59296F96C79399
                                      SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                      SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                      SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004H.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.347136339740023
                                      Encrypted:false
                                      SSDEEP:48:WsLmbdtWOMNtKksXEHSFLhXJYQ9ltZolrdqrU3m8RX0BuZKB:WsLOtpMNUXEyFFX79DZERyULDK
                                      MD5:27758955EB29FA1CEAF8AD8397CD1683
                                      SHA1:C1F920EAD099EC7744CAB3226771F98823C3F78D
                                      SHA-256:71996D7F41D26D1F2DE6784D7C456C8710819CDF7DD181F5FF7A0A9C3BD35FA5
                                      SHA-512:034DA9A13D4609F92AB3AF440442B62084C155F9AB2DB33DE659D2BDD09964F00B09D6F257769CFF6FCF2FEE07B9373ED8C7E42CDE844200C2823C4625B5A30F
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..@.......@.ud`.25.......@.ud`.25.......@..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=...&...:J}E.B......N...^..................S.".C.......-........f........................................I.qk..B.....LZ............=...&...:J}E.B..........=...&...:J}E.B.............@.......@.......@...........................................@j......@T.]....@.......@..B....@H......@..B....@..>.)..@..J...................;........4...4...4.."................@...@...@..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........@.......@....#..@............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004I.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):10056
                                      Entropy (8bit):7.956064700093514
                                      Encrypted:false
                                      SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                      MD5:E1B57A8851177DD25DC05B50B904656A
                                      SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                      SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                      SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                      Malicious:false
                                      Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004J.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.347993628850824
                                      Encrypted:false
                                      SSDEEP:48:ysXwZaKbNnttNbEXh2aLFX919LzKo5rdqrQvURX5RwXRK8u:ysCbNntbEfBX919LzK4RyQMSK
                                      MD5:473BB948350C7B4372934E2229BE823E
                                      SHA1:DA553F9E0D09E49B5BE171C662A8278F4F73ECEE
                                      SHA-256:CFBB15FDE30DDF91F930934260FEE82CE1F38ABF34D2AAA76319C3895D2FD9BD
                                      SHA-512:8DD0E51BA9D35235BCEC2F367E53AEF304A34C239C6846371646F4C8CA93012EA67606BD402B945C14043DE6DDC6044FC5FF8EF3D0D3CF16336BE19F6C107ABF
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ6o......6o.nD...$xw..1..6o.nD...$xw..1..6o...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............e..;t..%.[.S..+....N...^...............D].G...N..`,............f........................................I.qk..B.....LZ.............e..;t..%.[.S..+.........e..;t..%.[.S..+.........6o......6o......6o..........................................6o.j....6o.T.]..6o......6o...B..6o.H....6o...B..6o...>.)6o...J...................;........4...4...4.."..............6o..6o..6o...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........6o......6o.....#6o.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004K.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                      Category:dropped
                                      Size (bytes):84097
                                      Entropy (8bit):7.78862495530604
                                      Encrypted:false
                                      SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                      MD5:37EED97290E8ECB46A576C84F0810568
                                      SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                      SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                      SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004L.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.297369932694852
                                      Encrypted:false
                                      SSDEEP:96:XsBgh2WAE+Xxbl9XWQRymOMFNHT4FBcm:XsBghD+Xj9XWQRymnFNHT4FOm
                                      MD5:8D6771EF9F0B780C45B3DA10217DB9E0
                                      SHA1:4BBA29B08F650D6D6FE400D360BC3FE6EB5524CE
                                      SHA-256:1CAEF8533BE0AD5C0E39EA341D8BA6F36F50408E845ED638B5B2B970CEBC2771
                                      SHA-512:3363574711303C602DE31F8AE6A0BFC34C5CBA6315F2E4417529152BF2D86BCFE3065071A504114AC757E5DD16AE96438BBB2AB85FCF2755A0E68A193DA38F24
                                      Malicious:false
                                      Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZ.L?......L?.i.*....AE..~.L?.i.*....AE..~.L?..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............X.. .i.....3,U.....N...^..................8.#!L......,........f........................................I.qk..B.....LZ.............X.. .i.....3,U..........X.. .i.....3,U...........L?......L?......L?..........................................L?j.....L?T.]...L?......L?..B...L?H.....L?..B...L?..>.).L?..J...................;........4...4...4.."...............L?..L?..L?..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........L?......L?....#.L?............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004M.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                      Category:dropped
                                      Size (bytes):64118
                                      Entropy (8bit):7.742974333356952
                                      Encrypted:false
                                      SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                      MD5:864EEA0336F8628AE4A1ED46D4406807
                                      SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                      SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                      SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004N.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.347334407941662
                                      Encrypted:false
                                      SSDEEP:96:is8i7tPLyjjEpXTj9jUQRyv7b87QhqYFAGp:is8i71LKQpXTj9jUQRyzw7gqYFA
                                      MD5:FE8FBAF8C52A4C226F2B797599370DA1
                                      SHA1:EEB68F5CE0051E2787C67721083D1B2C9ACF411F
                                      SHA-256:18AC9DE79F437377EFE93FBB7C6D66A554ED85F64FFC936D02FCB674A1A2203D
                                      SHA-512:842D4ABE87CB74F5D987E0B4D88A1EB594AF9A01ECB10B441B1D4ABC9EE2AE0E9F7254964FD90CC4781C6691095DCF1DC960D17EF6A89B602BA7BD550823D506
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZDI......DI......|+.=...DI......|+.=...DI...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............E..oY.7....SqN....N...^................\+f[8.G../:w...........f........................................I.qk..B.....LZ.............E..oY.7....SqN.........E..oY.7....SqN.........DI......DI......DI..........................................DI.j....DI.T.]..DI......DI...B..DI.H....DI...B..DI...>.)DI...J...................;........4...4...4.."..............DI..DI..DI...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........DI......DI.....#DI.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004O.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                      Category:dropped
                                      Size (bytes):65998
                                      Entropy (8bit):7.671031449942883
                                      Encrypted:false
                                      SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                      MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                      SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                      SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                      SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004P.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):3.2547258745815197
                                      Encrypted:false
                                      SSDEEP:96:isE5Gl5b+WEcgqy8XtA189TG14q0oR0PqwDc:isEGl5Kc48XG189TXoR0Dg
                                      MD5:5ABA4E32AA64C3DD23A0992E6278244A
                                      SHA1:1FA362A66EA29DCD092C1D2D16E1BEC46B5FA55C
                                      SHA-256:67CCE17744ADD77B062197C4C2A87D69D60E7390B761947D723DE4483BE87248
                                      SHA-512:CD877BB225DB69E510B6AC9AF2FC1713BA47D516DF6C541FE7779CA7C356AC79115766987C145391CB6A15669B163C1C4B2B8F4B44B501D75627E2A9A13B28DC
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>...j.......v................................I.......I.qk..B.....LZ.........~..~..~...q...~..~..~...q.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=^1..`......H.5....N...^................E..^22@................&...................................>....I.qk..B.....LZ............=^1..`......H.5........=^1..`......H.5....................................................................j......T.a............D....H........N......?.#...9...................;........4...4...4.."........................z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4......................#..............................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004Q.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):32656
                                      Entropy (8bit):3.9517299510231485
                                      Encrypted:false
                                      SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                      MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                      SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                      SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                      SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                      Malicious:false
                                      Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004R.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12824
                                      Entropy (8bit):7.974776104184905
                                      Encrypted:false
                                      SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                      MD5:2628353534C5AD86CBFE57B6616D46DD
                                      SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                      SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                      SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                      Malicious:false
                                      Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004S.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):32656
                                      Entropy (8bit):3.9517299510231485
                                      Encrypted:false
                                      SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                      MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                      SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                      SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                      SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                      Malicious:false
                                      Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004T.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12824
                                      Entropy (8bit):7.974776104184905
                                      Encrypted:false
                                      SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                      MD5:2628353534C5AD86CBFE57B6616D46DD
                                      SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                      SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                      SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                      Malicious:false
                                      Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004U.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):32656
                                      Entropy (8bit):3.9517299510231485
                                      Encrypted:false
                                      SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                      MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                      SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                      SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                      SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                      Malicious:false
                                      Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004V.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12824
                                      Entropy (8bit):7.974776104184905
                                      Encrypted:false
                                      SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                      MD5:2628353534C5AD86CBFE57B6616D46DD
                                      SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                      SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                      SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                      Malicious:false
                                      Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.326544245605176
                                      Encrypted:false
                                      SSDEEP:48:YuusgsAZu5VJk1UStPONcEya7NOLXzccL9/kjdlrd3rRxORX09LVJ:YzsgsvEyS5OCEyaROLXzccL9/kXRbiI
                                      MD5:88023CA8ED1FE41DFFE0E904BDFDE5A0
                                      SHA1:D1D169A082633A28E6C6834B04758BBA1986D21F
                                      SHA-256:56FBEB337B104394097D0A5810C20E06B44B171B0EB436C8AECED11ED2D200AE
                                      SHA-512:AC95D81452E95387268C3D06F59B6D4504BB64A1B1CECBBD3A1ACAC8BAF7BAD939BF2E2C7811EC280F0069C8EAE876FB011B79D6006AF24B3CE95E240B74842D
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.....................svI.............svI.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............-..1.1...R._...~....N...^...................XH.@.B.q.I.........f........................................I.qk..B.....LZ............-..1.1...R._...~........-..1.1...R._...~........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000051.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):39010
                                      Entropy (8bit):7.362726513389497
                                      Encrypted:false
                                      SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                      MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                      SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                      SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                      SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3717233558774
                                      Encrypted:false
                                      SSDEEP:48:zWesx7cTx4teBEr+sdXzo9E7j4vlrd3rQxnHdXUCY2qGB:FsqTx44EndXk9E7wRbEUG
                                      MD5:C15B81931DA73ECC63170EDF23BC6DE3
                                      SHA1:4A93EC63D17147452F7B1F8F0893B28079074915
                                      SHA-256:6C6046E1D88AA1065C6981D878F98E6DCF9A0ACD1BFC524EEB33215AFC321F80
                                      SHA-512:EF4C4C89E42B8C5B790852A17A72674874E9E58C48839E493155AB317E016CDF50EE57F764A01A3B9C05CF9EFDE9A8FEC6C43ABD57AC2A854AD91FD268878FB3
                                      Malicious:false
                                      Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ|aD.....|aD?c....u.N..Z|aD?c....u.N..Z|aD..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=i.Jp..&...+Up;....N...^...............`g4....K.....^p........f........................................I.qk..B.....LZ............=i.Jp..&...+Up;........=i.Jp..&...+Up;.........|aD.....|aD.....|aD.........................................|aDj....|aDT.]..|aD.....|aD..B..|aDH....|aD..B..|aD..>.)|aD..J...................;........4...4...4.."..............|aD.|aD.|aD..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........|aD.....|aD....#|aD............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000053.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):25622
                                      Entropy (8bit):7.058784902089801
                                      Encrypted:false
                                      SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                      MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                      SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                      SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                      SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.354474887467266
                                      Encrypted:false
                                      SSDEEP:96:YNs7DgTTyttEmgXU9gtWgRb8mKwgv+HJr:us7DgTTyImgXU9gtWgRb8mKwgv+HJ
                                      MD5:9B395AE4F241CB22C4E963A54A69BE15
                                      SHA1:B41944122F3557492E2444DA625BE7D69F7DBC52
                                      SHA-256:69FEC2DB5931A5F0D921B9EFBCB697E96BD02038298AB6D69046849A12914E84
                                      SHA-512:A8704BF0CCD44D832D6727105A365CF8963916DE71868001DB9A331A726ACCAF6B1A2621A054E9868DE6B68AB1F5D42CB454A90005E34A3C6B6B8691E0E3557A
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZY......Y.g....J....0Y.g....J....0Y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............uf.U^6x..`...W......N...^................V. .6*L..3.&.K.........f........................................I.qk..B.....LZ............uf.U^6x..`...W..........uf.U^6x..`...W...........Y......Y......Y..........................................Y.j....Y.T.]..Y......Y..B..Y.H....Y...B..Y...>.)Y...J...................;........4...4...4.."..............Y..Y..Y...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........Y......Y.....#Y.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000055.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):2033
                                      Entropy (8bit):6.8741208714657
                                      Encrypted:false
                                      SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                      MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                      SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                      SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                      SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                      Malicious:false
                                      Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.232205307201387
                                      Encrypted:false
                                      SSDEEP:96:8hswK4qYUWTjE82Xb9GbNkRbek4xji5k8M:Ksxnh82Xb9GbNkRbexb
                                      MD5:576298A526ACA9833A66846B87933FB2
                                      SHA1:C2B7E906F0E3D85957438B34955B674B894E68D9
                                      SHA-256:CDE3A450312B2744F65AE08C096270A6EDB0245328E107A91C06E3EE53669847
                                      SHA-512:9A1D6F004F5F9AB71253945488D6C1FCDD43DCE24E9D4CC4F2FE598624F312B6C949CB75CAF9814F39B7A5D4397FE9079831C7609F91E5A1E45B5E4DC280224F
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v...........................-p......-p.$N?...(g..r...I.......I.qk..B.....LZ-p.$N?...(g..r..-p...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............R...v)...G+X?.......N...^...............j.>.bRL.j.c|...........f........................................I.qk..B.....LZ............R...v)...G+X?...........R...v)...G+X?............-p......-p......-p..........................................-p.j....-p.T.]..-p......-p...B..-p.H....-p...B..-p...>.)-p...J...................;........4...4...4.."..............-p..-p..-p...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........-p......-p.....#-p.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000057.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):55804
                                      Entropy (8bit):7.433623355028275
                                      Encrypted:false
                                      SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                      MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                      SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                      SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                      SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.473254365603751
                                      Encrypted:false
                                      SSDEEP:48:nMsxrsGN9Gxgt7RBW9EbzRXxBP9EDj4OmlrdMrToPYdX5gWwkPeFxPrWJHNX:nMsxuxg1RB2ERXxR9EDqlRM8YOx4
                                      MD5:6BB0B5BCCB5DC1483FB72BA955C66776
                                      SHA1:83BEA31C567E56347D56411EC46E610060E4E630
                                      SHA-256:099BCD33AC9CA9E291339EB9FFDAE81D50DF2B78E0CCCD0AA3FF3F9F3D04C4B0
                                      SHA-512:4BBC567498C4B9383A3ED24F4BB7E621760DF712F07AEF72648BD71C7FB961C6CEA9537F2C14D1FF594B7CCC57218EA14580BE9B9986DF167A537C5009B3B731
                                      Malicious:false
                                      Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.............4....(v..'".....4....(v..'".....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................v.... .....9.....N...^...................ey.I...u..-........f........................................I.qk..B.....LZ...............v.... .....9............v.... .....9.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000059.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                      Category:dropped
                                      Size (bytes):59832
                                      Entropy (8bit):7.308211468398169
                                      Encrypted:false
                                      SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                      MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                      SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                      SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                      SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005A.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3414886611855055
                                      Encrypted:false
                                      SSDEEP:48:3s48A4qs2ktQXdtUEQ2b8XEaBc89eoe7j49rdMrK5dX3YCgEZaEg:3sPtQXdWEmXtf9eo0YRMeZuE
                                      MD5:4ECE277AD18E37C01B621FD79FF73CBB
                                      SHA1:47D55369BE2A3B3EFB740B7460973E83141B22A2
                                      SHA-256:62D0C34F2156E332FAC25A4AB22D53E3466DE8C3DED04DDAA706EDE357C39E1E
                                      SHA-512:1FB4AF961D32FDB1C8620302CC50E7AD809101A24B060753482CEF2808FF1F6DF29EE44ED265BCB311342CCEB272D589B1CC43250D0A909C4B862B7DADECC88B
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ7.......7...W....A..-..7...W....A..-..7....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............._v.N....(-...e......N...^...............).m<2k.O.&.^..T.........H........................................I.qk..B.....LZ............_v.N....(-...e.........._v.N....(-...e...........7.......7.......7...........................................7..j....7..T.^..7.......7....B..7....C..7....>..7....|..7.. .3...................;........4...4...4.."..............7...7...7....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........7.......7......#7..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005B.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):33032
                                      Entropy (8bit):2.941351060644542
                                      Encrypted:false
                                      SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                      MD5:ACF4A9F470281F475EA45E113E9FB009
                                      SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                      SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                      SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                      Malicious:false
                                      Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005C.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12180
                                      Entropy (8bit):5.318266117301791
                                      Encrypted:false
                                      SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                      MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                      SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                      SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                      SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                      Malicious:false
                                      Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005D.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.329226941588233
                                      Encrypted:false
                                      SSDEEP:96:i1sepd2Km6SYIg1EsAowTcXPsgHc9UP9RMqRa:gseHbm6SR/sAowTcXEQc9UP9RMo
                                      MD5:CB53AD8F059330D822D773F07EA705D2
                                      SHA1:BE5AE8C49B71A7FE9CBFE031E46DF0D4B3AA5BA8
                                      SHA-256:1648160B9927089CE7D0B6373A2462381072DA03EF06093A027CCAE571060BC6
                                      SHA-512:FA954E3C7591B098B25F4E7EE12C93DBFADDF508A472ACA50726C421A1874AB100BDB8AF013D2F1735FA2A2A32678BDEF34CD61FAD1EE28D68C6C3AA26C9608E
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z.........................................I...J.'N"!.I.......I.qk..B.....LZ......I...J.'N"!.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............!e.9...)..I%......N...^...............N...ghM..l39@..........f........................................I.qk..B.....LZ..............!e.9...)..I%............!e.9...)..I%..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005E.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):2104
                                      Entropy (8bit):7.252780160030615
                                      Encrypted:false
                                      SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                      MD5:F6C596F505504044DF1E36BA5DA3F09B
                                      SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                      SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                      SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                      Malicious:false
                                      Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005F.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.350971356009752
                                      Encrypted:false
                                      SSDEEP:96:OsR7groQE2cIX+dI9xNcRMViianyXn3k:OstgryvIX+dI9xNcRMVNanyXn
                                      MD5:EF8EFCEE9D13AB6EEFEDEF056065F6EB
                                      SHA1:C73BC3DDE19A43D31EDC1E2635E6C4C1270E8396
                                      SHA-256:8A5D609DEF67B4D7B28B172683DAD24E26F500D3EE5763D566406BD0A378F2BE
                                      SHA-512:D79377DAEBE04AD89551D90EB6689EE322581842D33903868AA4F4D1BC55CC55E8B8D885EE92CAA55ECB7B805960F60D7F6CB467D8D64E9CE3EE7987CBE0ADA5
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|........................................,e.......b..I.......I.qk..B.....LZ.....,e.......b......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............V.C....."W.n.......N...^...............7.....J.R..s...........f........................................I.qk..B.....LZ.............V.C....."W.n............V.C....."W.n...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005G.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):14177
                                      Entropy (8bit):5.705782002886174
                                      Encrypted:false
                                      SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                      MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                      SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                      SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                      SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005H.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3479786443337405
                                      Encrypted:false
                                      SSDEEP:96:L0sD2h89V6Lg9qjykhEQtXQ59JFDMRMfMBc8f8sHtbuBtek:L0sD2h89YLg9xjQtXQ59JF4RMfMBc8fk
                                      MD5:C7EF90C8A55CF8F820DCE700E4A3F1C1
                                      SHA1:1DE4FF25AB8D9C9C0E62A1CE65F9C65EFD5F15F3
                                      SHA-256:D3C71544C08B87A64565E877838ECDECBBC31078954C3E53A425A88D234586AA
                                      SHA-512:A7670623AFEA1E340A0464E5AA512C094821F76880E3FF48E73E56CFFDD2E0D282AC87427E8231D245FA9E2424604CFC1C8650E6AEA7CBA02564F799F878F3DC
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ#.......#.......8.2.*O.A#.......8.2.*O.A#....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............J................N...^...............S.?....F.8..V.H........f........................................I.qk..B.....LZ............J....................J.....................#.......#.......#...........................................#..j....#..T.]..#.......#...B..#..H....#....B..#....>.)#....J...................;........4...4...4.."..............#...#...#....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........#.......#......##..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005I.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                      Category:dropped
                                      Size (bytes):36740
                                      Entropy (8bit):7.48266872907324
                                      Encrypted:false
                                      SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                      MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                      SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                      SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                      SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005J.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.379744473953329
                                      Encrypted:false
                                      SSDEEP:48:hsY4bxjkHkjMthPmELLYdX6lpa9BssDpy5rdMrrHuzpEFX+hkSdhKsg:hs9xjkHkIOELoXv9BZcRMrOC2As
                                      MD5:63CED3F8B0BAD4EC811AA5F99CCA7A03
                                      SHA1:D66EA7DE288ECC79AE0FEBB9A262DAC77A7B68E8
                                      SHA-256:875A406F3D2073C084BCACC784AA698FD0CB489B7AAAD8E8C64836E1E2300EF0
                                      SHA-512:E5221516CA6F160D47056DE6A326F64433CB87E2FE0638A08B80E069C7265F5FEA931BD14B7B5595902D9DEAD820E628A8F26021832490DA644E05F9E6210F91
                                      Malicious:false
                                      Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ.............-..=h0 <"TN.....-..=h0 <"TN.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............^.t.ZN........'p....N...^.............../V?...I....sa.........f........................................I.qk..B.....LZ............^.t.ZN........'p........^.t.ZN........'p........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005K.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):53259
                                      Entropy (8bit):7.651662052139301
                                      Encrypted:false
                                      SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                      MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                      SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                      SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                      SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005L.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.318576518184481
                                      Encrypted:false
                                      SSDEEP:48:5ksztdLs14FItWZMZEXDJXeXSsiT8P9RsLJpyLlrdMrhU6k8UFXFNP1YoLE+//F:2sLzFI0ZoEXgXSsy8P9R4JqlRMq8UZH
                                      MD5:951534BA80023E8CA4A34FD5CBC5184D
                                      SHA1:876AA2D792A5CE5A20722758B2038938BFB6A835
                                      SHA-256:38F1CD59C35BAC16A7AAC23BC9C5BE944D0F2150E7262633D992ED203EF32EA9
                                      SHA-512:C7E325CB7FD75F784AB5834B6E6F952C04C76E10DDBB7DEC5361702C79F95BEF2ED71CE1EAB2603534299014733CC236220253B4A9417E94A477B0CCB276B784
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.'.......'.nS.n."\.Qp.Hi.'.nS.n."\.Qp.Hi.'...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'....................8..m..@.....N...^...............M"..iKF.L..n..........f........................................I.qk..B.....LZ...................8..m..@................8..m..@...........'.......'.......'...........................................'.j.....'.T.]...'.......'..B...'.H.....'...B...'...>.).'...J...................;........4...4...4.."...............'...'...'...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........'.......'.....#.'.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005M.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):60924
                                      Entropy (8bit):7.758472758205366
                                      Encrypted:false
                                      SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                      MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                      SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                      SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                      SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005N.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.334749232064487
                                      Encrypted:false
                                      SSDEEP:96:Es+HNKRacEjX7k9JZeURM82d1tTCdejs:Es+tKR4jX7k9JZeURM8
                                      MD5:692A8D4AB838D5A58FCC3B6915DE5E8A
                                      SHA1:854E1F88DCA9EF5B951A208213A5873BF9FC9624
                                      SHA-256:E5BFE8528AD04AD54DF1E2609360D64225DADEC5005F3DA3D9A8EB92355A1E1D
                                      SHA-512:6F767F7BE2B1FAFAE2A36A80ACD555ADA18C8C3BBCD019346102572B7E1C974DD894271705E90F635CDE02D6867E4CFEC98DF9E178EBB8268144FA973EC19DA1
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZG.......G.......71.^...@G.......71.^...@G....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............._`.... .6Mu.......N...^...............L.....A................f........................................I.qk..B.....LZ.............._`.... .6Mu............._`.... .6Mu............G.......G.......G...........................................G..j....G..T.]..G.......G....B..G..H....G....B..G....>.)G....J...................;........4...4...4.."..............G...G...G....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........G.......G......#G..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005O.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):515
                                      Entropy (8bit):6.740133870626016
                                      Encrypted:false
                                      SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                      MD5:E96BE30D892A5412CF262FEE652921CA
                                      SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                      SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                      SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                      Malicious:false
                                      Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005P.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.362518953107034
                                      Encrypted:false
                                      SSDEEP:96:2s+xtp55dPEP3XQdi9pY0RM7/ILbcqMbr2WI:2satpfGP3XQU9pY0RMrI
                                      MD5:368201BBCB79926A60DC271C3A8D4CE6
                                      SHA1:37C3C39A4EDF384D46C5BECF423C8C86E494FC62
                                      SHA-256:F9E995E84E1749BFFED61B5CCD10578CB6FD091A0FE748DD1F52EBC5094A0028
                                      SHA-512:4BC9CB4BCAC7D195E18EDCDB65ABD99AA406748276B7B7E89EAB443C1D09E5A077ABC08CA387EDE34E8C4AD7227B9366CE6644E941D8259E06E5E29EB5E28174
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.KG......KG6.&9.(......KG6.&9.(......KG..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................x...?Y.V...G....N...^................p...A.....Z.f........f........................................I.qk..B.....LZ................x...?Y.V...G............x...?Y.V...G..........KG......KG......KG..........................................KGj.....KGT.]...KG......KG..B...KGH.....KG..B...KG..>.).KG..J...................;........4...4...4.."...............KG..KG..KG..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........KG......KG....#.KG............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005Q.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):1547
                                      Entropy (8bit):6.4194805172468286
                                      Encrypted:false
                                      SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                      MD5:0BA36A74DFBF411FAB348404CCEC3348
                                      SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                      SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                      SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                      Malicious:false
                                      Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005R.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.324023969212709
                                      Encrypted:false
                                      SSDEEP:96:WsqhN9JXz4autEJXb9WnoTgRMney2JA/eH:WsyJXz4LKJXb9G6gRMnf
                                      MD5:1EFC82C67E3E2445E6743A4AC59DD5CB
                                      SHA1:DED84DB7930F22F4EC337A97907C84315A9E7042
                                      SHA-256:7EFE82E5BC404C2CD896E47DE946DE8FD606802A02CB4C73DFC64A9555668500
                                      SHA-512:14EBABA6CA55648169819C935106F41067EFEDC7C8C6C373F43D4EF723D3B2153C8F40B442C2A6434B902EE9C638BF5E90F97E71227D8574F96EBECB7DE97027
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ8.......8.....X.......N.8.....X.......N.8....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............C.Pd9.....*.0.....N...^................;.D..I.K...*..........f........................................I.qk..B.....LZ............C.Pd9.....*.0.........C.Pd9.....*.0..........8.......8.......8...........................................8..j....8..T.]..8.......8....B..8..H....8....B..8....>.)8....J...................;........4...4...4.."..............8...8...8....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........8.......8......#8..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005S.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):95763
                                      Entropy (8bit):7.931689087616878
                                      Encrypted:false
                                      SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                      MD5:177DD42CA99CAA2CCBF2974221680334
                                      SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                      SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                      SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005T.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.334261046736482
                                      Encrypted:false
                                      SSDEEP:48:uslr1oeNXqn0t/hnEyLg0eWXVIW9r1UxpyBrdMriNmFX/FpNKNsEZEou:usbDqn0bEy0fWXuW9rGxERMTAmo
                                      MD5:3CE73FD0EB6CFB6CCB51F636A599E55C
                                      SHA1:60DDFDEDAA11CA559D854CA7351C829997ABC766
                                      SHA-256:8B3E5A63250DBC4FF4956138A33B5AE8946B28FFAA99B006C487A0EE65830FBD
                                      SHA-512:6F33E77316FE4EDF09EE91C61EC825ED55266164E650A6309BF2728EF881BFCEF806CF4BE576DEF80355750BE72AF5A4E9A94B50FE3BE4D2747FC0E314B2E86A
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........#.nD..-w/;x.....#.nD..-w/;x.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............I....&`.8...N8.d....N...^.................o.~..A..pQ.z.$........f........................................I.qk..B.....LZ............I....&`.8...N8.d........I....&`.8...N8.d........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005U.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):67991
                                      Entropy (8bit):7.870481231782746
                                      Encrypted:false
                                      SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                      MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                      SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                      SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                      SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005V.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.32484260755133
                                      Encrypted:false
                                      SSDEEP:48:gsiO/IrEJto1qdrMhIEvlL6rX0tLydrO9VUupyRrdMr7k/JCEFXstc9iTEJd:gsxIIJoqdrGIEdsXHdrO9muERM7EAEr
                                      MD5:61804151D3F91299958C2DA991291A11
                                      SHA1:CB4B18291C3CF3E55B288E2EA2DB96F1A8C3F977
                                      SHA-256:A2486D257F980027521C0082FB84851ACAD71DAA72F9AC7DCE1975AF801E8F50
                                      SHA-512:228290EC4EF25579FE0EC1D601D1CCA502263396DACD7CEAAC73D3BD93BA7C83EAD4A7A06AD36FA414A39EF0D2B142196A297A3642FAD507C38E2C7D483898CF
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........(......[.......(......[.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............2..D.l..H..(.e....N...^...............$ps....C....h..+........f........................................I.qk..B.....LZ.............2..D.l..H..(.e.........2..D.l..H..(.e........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000060.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                      Category:dropped
                                      Size (bytes):22203
                                      Entropy (8bit):6.977175130747846
                                      Encrypted:false
                                      SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                      MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                      SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                      SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                      SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000061.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.429591859247591
                                      Encrypted:false
                                      SSDEEP:96:hsYrbuV/MK1EDYXxV9CY4RMu7LRfPiRObox:hsqmjCDYXxV9L4RMu7C
                                      MD5:4D9C0750492064B230673C98CDB31471
                                      SHA1:50D0F3D070232CFD0B192DCEFF1F104F758AE7EC
                                      SHA-256:DB7483E3BCB10A53CDC412CC673CEAE1A2FC106E14F0DA16E46C0EDB0417606A
                                      SHA-512:C6705D6E6F7EB3BC3E2F3E72F4DAB19C8081A41E56173F1B42F31C7B3B987C975917937D195353DEBD3FE80B1D293D303C0934ECD304D46BDB35F51E9931AAC5
                                      Malicious:false
                                      Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ.........k-@{..._..W60..k-@{..._..W60....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................~......=.cY....N...^................$.LI..D..............f........................................I.qk..B.....LZ.................~......=.cY.............~......=.cY....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000062.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):15740
                                      Entropy (8bit):6.0674556182683945
                                      Encrypted:false
                                      SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                      MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                      SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                      SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                      SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000063.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.334728715210755
                                      Encrypted:false
                                      SSDEEP:48:x2TBsXJqwiJiJbsMIEgtpqlmrEAkLxEjnXPz9xUvxpyPlrdMrEkpU0vFXHd7JiXM:+BsKM3gv/Ej6nXL9yJOlRMEk3VR
                                      MD5:CD797236935129076A5DE5429A2BBB85
                                      SHA1:0042584CA096FB6F881C9F6FAD9541D5A329DEAC
                                      SHA-256:7AC3C7F3FE07111663E7E0499E23D44954D5B20DC427D24D842647BDE58826C4
                                      SHA-512:E83991422870146156A6F0462B463C450197A61C7B8BF41AB2EF51F2339E4BE22673DF2965E9C2E097877A395951AEABA96FE4B3E4E01F7393FFA10722EEFE19
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZks......ks....o.(.%....dks....o.(.%....dks...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............nC,..........V......N...^...............K9.....K....).;.........f........................................I.qk..B.....LZ............nC,..........V..........nC,..........V...........ks......ks......ks..........................................ks.j....ks.T.]..ks......ks..B..ks.H....ks...B..ks...>.)ks...J...................;........4...4...4.."..............ks..ks..ks...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........ks......ks.....#ks.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000064.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):86187
                                      Entropy (8bit):7.951356272886186
                                      Encrypted:false
                                      SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                      MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                      SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                      SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                      SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000065.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.665735176309732
                                      Encrypted:false
                                      SSDEEP:96:YseWnfPT9rhEtUnJ5XjQ96JURMtjxy59WoFu59w/Ec:YsdnfP1+KJ5XjQ9yURMRxr0
                                      MD5:1F5EF0E75FAAC319763E01D09105A89A
                                      SHA1:31E8C60293DA88CDBA61F682B24FCA69ED3AE4AA
                                      SHA-256:EF3EE26403C09E58419A707CF7D05AE1A76C33D07BB8452993997AB1E691FAF6
                                      SHA-512:BA7C658BEA2517FCA65EC0D8DB65971FEDA31E8A0687DE9D86C5C0E35DBFE176691C900BF75D9CF8CF5851D6C34025B6142D04E7F0BD1B4D47504A6748C6E6AA
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ.l.......l.t+.i.;...e..q.l.t+.i.;...e..q.l...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............dd..^..6d.S.?>....N...^................BYz.PA..=...".........f...................................H....I.qk..B.....LZ.............dd..^..6d.S.?>.........dd..^..6d.S.?>..........l.......l.......l...........................................l.j.....l.T.]...l.......l...B...l.H.....l...B...l...>.).l...J...................;........4...4...4.."...............l...l...l...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........l.......l.....#.l.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000066.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):11197
                                      Entropy (8bit):7.975073010774664
                                      Encrypted:false
                                      SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                      MD5:DDC3CC30794277500EFE4BC6667EC123
                                      SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                      SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                      SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                      Malicious:false
                                      Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000067.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.31991611080456
                                      Encrypted:false
                                      SSDEEP:48:2sY/as8wxPwt6VgrElLrsXeRK/9vCWUtpyRrdMrmeKIXFXzDP/S2ccp6ZBPK/S2V:2s2PwMyElEXw09vytcRMNJVSR7vKJh
                                      MD5:916C97DEB8FC71F58823BEBACC0B4BBD
                                      SHA1:2A75C6AD5D66D9306A52309525DF01F615494987
                                      SHA-256:C3C02C4D1278D7424BC3FB03228DF701A9DD5F2986EEEC432E042C70AA664F4E
                                      SHA-512:BB16975FA47F7842AB5757FB28EB8D24DA6360B66083276BF71D48B013B4FF586BA94C413172EA6855C43275F5427444E5C9F07B898CF3157EE5B657B51416EC
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.U.......U..-...:1..2.o..U..-...:1..2.o..U...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............x.......:.#..?Ek....N...^....................^vM..7:...........f........................................I.qk..B.....LZ............x.......:.#..?Ek........x.......:.#..?Ek..........U.......U.......U...........................................U.j.....U.T.]...U.......U...B...U.H.....U...B...U...>.).U...J...................;........4...4...4.."...............U...U...U...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........U.......U.....#.U.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000068.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):19920
                                      Entropy (8bit):7.987696084459766
                                      Encrypted:false
                                      SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                      MD5:1BDAD9B3B6DE549162F9567697389E1C
                                      SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                      SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                      SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                      Malicious:false
                                      Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000069.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):2.9131586733746055
                                      Encrypted:false
                                      SSDEEP:48:JsV+u8EiVuXtu5/E1Lc9NVSL6MhwIKXD5K9ps+pylrdMrH3iFXgxXzwuY9:JsiTuX8E16N0f0Xo9pLYRMHSUE
                                      MD5:B8F3CA508A2C836973CF6AFFE8501979
                                      SHA1:278D3BED0002DB617D0F168D1C9FD8F6CCF41DCA
                                      SHA-256:5D775E96A063CD04A8666C156D936B784590FD36E6EAFC0EF1CBCD1247BCF50A
                                      SHA-512:1BF4D202899B47AC834CA122BF204A249B5BA56FC0D76869D14F20642A3AEE5C841ECCB18930FC42530E0A1C4C05594D395A46717623FE2C4C56E6B6DFCFBAFA
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>.......H...v................................I.......I.qk..B.....LZPZ......PZ.k.e..?p..w.+^PZ.k.e..?p..w.+^PZ...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................{....5...p....N...^...............o`.O...D.!..,.>.........f........................................I.qk..B.....LZ................{....5...p............{....5...p.........PZ......PZ......PZ..........................................PZ.j....PZ.T.]..PZ......PZ..B..PZ.H....PZ...B..PZ...>.)PZ...J...................;........4...4...4.."..............PZ..PZ..PZ...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........PZ......PZ.....#PZ.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006A.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):179460
                                      Entropy (8bit):7.979020171518325
                                      Encrypted:false
                                      SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                      MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                      SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                      SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                      SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006B.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.358008746224462
                                      Encrypted:false
                                      SSDEEP:96:ysJS1PA/FJmpEFpXzFJm2p9JsURMjmq0ZSg:ysJS1ormWFpXzrm2p9JsURMjmq0
                                      MD5:C79693BC28C9FF2D9BCB6FD7EF5DFA89
                                      SHA1:F2AD8F8F2E70D593BCB285B3DBF28D1ECA7DFDC2
                                      SHA-256:C18FBE66FA4068329080512F7980D0C93B825BFA1E258B630FE2DF9A3E5F3E0D
                                      SHA-512:6AD9930E09801E5AA85A22F6169496E625BD24546AF60C51634386B39E6BE88CCCFD632FDBA9A1FE359C04CD0234A6A93F76A7A1B66332F50DB6BFEF68AD249E
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ`.~.....`.~2..]...Y..XC`.~2..]...Y..XC`.~..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................@...].?.LA.....N...^..................e.o.J....6..........f........................................I.qk..B.....LZ.................@...].?.LA..............@...].?.LA..........`.~.....`.~.....`.~.........................................`.~j....`.~T.]..`.~.....`.~..B..`.~H....`.~..B..`.~..>.)`.~..J...................;........4...4...4.."..............`.~.`.~.`.~..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........`.~.....`.~....#`.~............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006C.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):109698
                                      Entropy (8bit):7.954100577911302
                                      Encrypted:false
                                      SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                      MD5:8D804A60E86627383BED6280ED62F1CF
                                      SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                      SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                      SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.349167753665361
                                      Encrypted:false
                                      SSDEEP:48:KsOKds06pvFt9zj1E3yMZXNz99hsZpyZrdMr9bf6FXBmFWK9ZBkj+FOPsi:KsP6pvFHlEXXNZ9hgMRMJ622
                                      MD5:70CAA889194ABF20CD283B9AC30FAAF6
                                      SHA1:E701B563AF7DC310F4DE75310B704A33E196197A
                                      SHA-256:4FD81B270386729CF6B0B246C2A0FA6E2B51B9EE19502C20016C94D0A26DACA4
                                      SHA-512:CA1F5B9B69A5D913A200B2436FD400FD1F0842843AC0D48980682F414E7B73963426C7D3A1E755BF21E0D06A380BE952C4274BD58DC4B9BF9F41BC400C19A108
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..-.......-.|.....:...#1..-.|.....:...#1..-..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Z$...f...^....p....N...^..................^...@.I.Q.^.?........f........................................I.qk..B.....LZ.............Z$...f...^....p.........Z$...f...^....p...........-.......-.......-...........................................-j......-T.]....-.......-..B....-H......-..B....-..>.)..-..J...................;........4...4...4.."................-...-...-..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........-.......-....#..-............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006E.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):41893
                                      Entropy (8bit):7.52654558351485
                                      Encrypted:false
                                      SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                      MD5:F25427EFECFEE786D5A9F630726DD140
                                      SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                      SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                      SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):2.4595042851259943
                                      Encrypted:false
                                      SSDEEP:48:NwYvLsNdCNDlLZTRVlEKvAgAlXdxtQ0ljLlz:NuEReSe
                                      MD5:6CE0540E0E22A8701F8ACDD8F320EFBA
                                      SHA1:C49C552DA83C54FAC6604D944F4A5CFBB421576E
                                      SHA-256:D4D21939813297136C7150C44C7AB8926DB330A462310D1C950D35E48A7326FE
                                      SHA-512:87B716628E6A967BF57034F51EE7BA39B5A420CFDE2D6D93E3845F7C309ED22D76B21299F96837CC35BF4D8034D376A8AD4C5559C31F4AFDE48D4CD22E626618
                                      Malicious:false
                                      Preview:...."..............................................................................................................................................................................................................q.#.(f..k...x&......x&..S......s..|.Lv..<...#...\..Lv.....q.#.(f..k.......`09......$....n.`09...........................................................................k.....`.........1.......A.......W.......^.......o....................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y.....................c..,........................1... ..$....S.t.a.t.i.o.n.e.r.y.....................c..,0...........J..d23SJ.,.............................^H......'............?...6.......2...H...............................Lv..x&...............................x&...c..,............................1.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006G.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):3.326200585360994
                                      Encrypted:false
                                      SSDEEP:48:f2rmPmKZM+lUoewDT4m8j0TnEDbPUErl7k//KulUHi4UeVVqp6Yp688X9b:fu/wCCnEDb8ECabTVop6Yp6xX9b
                                      MD5:B60D77DADE8F5D1189CABD952E7F51D3
                                      SHA1:C78220BE2F97B7924CF51198DE7E9CFE72691E7C
                                      SHA-256:7B96CAAEE5D84868F806FD21B9AB634459E1D8FD0EE578B90EB599124BF6C976
                                      SHA-512:E3C18566F68CD6EE46BCE315CBA5542E14B0A80E51AF7E0DD2FBE9B499B5878FCB7E4A47B7F54D6839E270F1185765C376918064039DCBE0588A69E1191E3F06
                                      Malicious:false
                                      Preview:........0.......................................................?...............................................................................................h...........................................................`.#..W.......WG..M.T..Y.......4mg..s...8".......o%..(jMs.JF....%..e....@^../..%.............................................................................w.....X.........4...............$..._RT(P....WT.9.....T&d................4..(.....x.(.................4mg..s...8"..W.......WG..M.T..Y...2...v...4.................................W............................W.....%....c..,0...e...B4.$........[.-...I.......9..................................4[.A.g.kT...%.......%..e....@^../......4[.A.g.kT........_R.o.uE.~...ns5._R...WG..M.T..Y..0..W.....>..................o%..(jMs.JF.%..e....@^../....................................c..,0...e...B4.$..............E........................................0...........e....4..................T.o. .D.o. .L.i.s.t........s.)..O@

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.916521231142521
                                      Encrypted:false
                                      SSDEEP:192:BsijFSVLNRpiEw/mLXgcTsqgDRzmqz7yKjPtiPfrt9n1de/3FlG6LlhLJZJxJNJw:WSUVcojd4xRzOTXGJZJxJNJDJ0JxJ+JI
                                      MD5:EB59A1898832EE13D98517E20A3C0CD0
                                      SHA1:733EE2E4ECF6C1FC35FA7BEB938B19D2AAFFC7F0
                                      SHA-256:7CB2C5254C2EBA382344C8A7D335E94EAF316C59E5C5D38A12F0B95869FF319E
                                      SHA-512:3B3932C0F9CC938854A5E487FD9912F8222AE0D6306B35E12ABA9FA0DBFA4B784F76184676CDD420DDE159A70EF5021F40E1A334255B43D6D736E4E89D1EBDEE
                                      Malicious:false
                                      Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ....;......0.....?........0.....?..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............X..r....v...V.....N...^...............s..Q...M.sT. V.E........h...L...............................D....I.qk..B.....LZ.............X..r....v...V.................................................................................................j.......T&n....................H.........K.............$...........-...J.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(...#...8.....z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006I.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                      Category:dropped
                                      Size (bytes):68633
                                      Entropy (8bit):7.709776384921022
                                      Encrypted:false
                                      SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                      MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                      SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                      SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                      SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):4.0785592936011
                                      Encrypted:false
                                      SSDEEP:192:lrGoW6G2wE4beoZaiktt4S3nMPFw/kQL3OZIDezfEHY7iXaxoW4tDbRJg6f38Vg0:xHajZw/BEAY7cRRJugLmcncDfmc2a
                                      MD5:4FF8E6EBED4F2AED9E8370E807F3A8BB
                                      SHA1:DBD573242F1D0DDCF74F2CB11E6F4CDFBBA7E8E2
                                      SHA-256:3A5F50244EDCADED0ABAC8A908B14D89D3BC67F402AB497710BDFD0B7FC7BF6E
                                      SHA-512:61F66316BAD366DC051B32BEAC0ACE8CC4B1212072BCEF8CE0F2B0A96B5CBB804AF19D3F702BB980317D34D90AAFA2DEF9B6A5A0E6E3BBF83C835ECD90E13148
                                      Malicious:false
                                      Preview:^...>.......L...d... .... ...9..^...>...........d...h...@...@;.....................................................................................................................................................>...........0.0..1....0.%......e..P.....>...........0.....0.%......e..P...0...I.qk..B.....LZ.I............0.......0.......0.............................................$....... .......$.........)..... .....0. .N.&.0.....'.0...@.....'.0.2.0...z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y.......................0.:.0...0...z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3................z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'.0.%.0...0...z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1........0.*.....0.....%.0.#...'.0.&...9.0.....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006K.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                      Category:dropped
                                      Size (bytes):59832
                                      Entropy (8bit):7.308211468398169
                                      Encrypted:false
                                      SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                      MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                      SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                      SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                      SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):3.2501737225556955
                                      Encrypted:false
                                      SSDEEP:384:z/jAuSwGNenh1f+IkawruHPRJGk4RyAaAC9:z/jAuSwGNeh1f+IkaKQPR4k8yAaAC
                                      MD5:319E4CC57BBFD19BBA153773F6D157AB
                                      SHA1:B1B762D3AB27641805228D4E7F443774948C30DE
                                      SHA-256:D428EF1B2953144752D44A1E7276D478B747EAC0FBE18710EACA91B81F606FAC
                                      SHA-512:3EA47BE9CC2CDBCC7B510DEA0FC83FCC8DC73867688682B4A9671DAF63E801B284FD5DEA064C7EEF7EB4FB7DC0E55947F6EF453CE2DBDB0852300B26EC4E381E
                                      Malicious:false
                                      Preview:2...>...........v........ ...-..2...>...B.......v.......@....,...........................................................................................................................................I.......I.qk..B.....LZ|Y..P...|Y......!D.E..1.|Y......!D.E..1.|Y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............c..}...Q.p.......N...^...................l..N.*cF.WB.................................l..N.*cF.WB.............l..N.*cF.WB...........c..}...Q.p....................................|Y......|Y......|Y..........................................|Y.j.^..|Y.T'...|Y......|Y.....|Y...-..|Y......|Y......|Y. .L......|Y.3|Y.I|Y...z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6.............|Y.3|Y.9|Y...z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006M.bin (copy)

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):53259
                                      Entropy (8bit):7.651662052139301
                                      Encrypted:false
                                      SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                      MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                      SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                      SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                      SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\header

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Matlab v4 mat-file (little endian) , rows 975182774, columns 0
                                      Category:dropped
                                      Size (bytes):72
                                      Entropy (8bit):2.3625543551141495
                                      Encrypted:false
                                      SSDEEP:3:bll9aaHtlCthto8tl:bllXHtlYk8X
                                      MD5:5C43152F0FB73F702B077209957FD673
                                      SHA1:75B2B9FE224C70071C0B0A924FD60BA0E71642FC
                                      SHA-256:29089A4D58CA22DB2C86B0934143EC4B1BA0720B14ADA8F6AF055334681E3930
                                      SHA-512:BAA042741FD72940DF0A59BE0ECBF8E4E78BDE9A2455D62C7D98E02B5C9FFA28F16CEF3BD66C978F78876031B635DDF43AF69CFF23288A04BB0EB8D754870DEE
                                      Malicious:false
                                      Preview:...... :............ ..........................@....,...z..@............

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000001.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):0.04401584019170665
                                      Encrypted:false
                                      SSDEEP:3:RRk//:Lk
                                      MD5:CD74ABACE8A00B17BD8107BC5982C21E
                                      SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                                      SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                                      SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                                      Malicious:false
                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000002.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):0.4902311391318697
                                      Encrypted:false
                                      SSDEEP:3:vldawlAuil8xt/l2lLa/npd1GjFP/tljFPpnllOkdnrKd1t+Xl2hliJw5YCnk/x5:NTcm/pUhTu3M1GwJIk/xPmw1EVzB0
                                      MD5:5F2C27DA0D53D37BCBF45BB22FB695D9
                                      SHA1:5BA522412EA2361D01E585B71DE2931B7E02F60D
                                      SHA-256:9ACABD31F13C5AA2EC17DC4B33381AA7B5CF5EECF155D26E70BF5019A030B8A5
                                      SHA-512:D9A019CE22ACDB93BB6122BA621E74B8929B9A4ECEF6082AAEB8012464B1AB697551AD2CC2636FC2AE8B54FB268A6A12A3F3BE8214A98C76181707741C0CA298
                                      Malicious:false
                                      Preview:2...>...........~.........................................................................................................................................................................................x.......x...F..H....T..........................x...F..H....T..x....................................................x...........................................................xP..............................................................................5........m;.H....7.5N........6.#..:........aI.7YH.L.r.^.v......N...^...........................................................................................................aI.7YH.L.r.^.v..............................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000003.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):2.86185007641594
                                      Encrypted:false
                                      SSDEEP:48:e23EdVxz3LPExyw0LQOd6m4Blkw0LbuY0ksCLYwEwLr0VWdWVuFSm:edxjzExyLE/m4gLH7wCREwUVPVsV
                                      MD5:285BF5FDAD2E46A859600A70FB0B8F24
                                      SHA1:885AFD14A2445C0DCA822417CC3CA6D0E2333161
                                      SHA-256:4696FED04FACFA52EBAF7E3B8E127A28EB456A380CE1D572CAA8C461E3FE3BE2
                                      SHA-512:AAC8586E68C37DDB9BC6AAA508EA512445697D761074008611B6BE9FB760C7A18A6A31B6A5F221086969CF173D7448CCC084438362C2F60732D7E39BDAAA9A0D
                                      Malicious:false
                                      Preview:0...`...................................................................................................................................................0...`...........................................[.......[.....}..d.3...~a.......a.....w.....sC..[.....}..d.3...~[........92."...D.C`....a.....w.....sC..a............a.......a...................................................5......5.c..L.......ba.......a.....w.....sC..2...^...........,...............[....5...9.-.Q.zNX..p..jP........5T%t....9T.N..-.QT&...zNXT$...jP.T.:..a....5..a...."..a....o......jP......[....c..,0...e...B4.$..........C@RQ.H..B......Y......................9.......9eu{.N.}.w4.. .p.......p..c$'...&y....-.Q....@...c..v.-.Q.jP...7.C.p......jP....9eu{.N.}.w4.. ..9.....>....................92."...D.C`a.....w.....sC..jP...7.C.p......jP......jP...7.C.p......a.......a.....w.....sC........5......p...c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000004.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):4.707720551893674
                                      Encrypted:false
                                      SSDEEP:192:ns/u67k5IqPXmoxRieS7bMpkgLtAZ9IjM9:s4WqfbxRiB0tKIjM
                                      MD5:F792B799F0E1D7E392C441A90479BC99
                                      SHA1:787D2671C67F2680ABC98D6C0204B03EFB7C210A
                                      SHA-256:569D1B28A43CC8DA34BDAF7BBBFD089FB36379C5B29CE6339804C5D50F26BDDD
                                      SHA-512:C8E2A19C2447EBAB2F75D78FDC4E61601D1D985C92E0F840C5BDB6BA8E6754960F545C0F6AA262ED237BFC7B8FD71D524AE446E600D013FB91154B1CE0D99BB7
                                      Malicious:false
                                      Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ..b.4.....b..Zj.&....^....b..Zj.&....^....b..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............V..n..r...g..;.#....N...^...............l.~:..A..}).wg.............>...............................$....I.qk..B.....LZ............V..n..r...g..;.#........V..n..r...g..;.#...........b.......b.......b...........................................bj......bT%;....b.......b..W....bH......b..+....b..S....b..........Z4...........................................4../4......p...............C.a.l.i.b.r.i....................b:..bk..b..z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000005.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):40884
                                      Entropy (8bit):7.545929039957292
                                      Encrypted:false
                                      SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                      MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                      SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                      SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                      SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000006.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):4.432689836058189
                                      Encrypted:false
                                      SSDEEP:192:vsKPC658l7cIXGfkiw8LW8X9bq8wk9NNSRpmD1DN7QX6lALRkDauL+1ANKVsXr9i:kKq6mlII0kp4W8X0vk9NWpmBDs6lALR7
                                      MD5:89E5036D979C415416F19FBACEE12DFA
                                      SHA1:BB4E117A2ED73EEB94553B05FE2B1CA7C323E3BF
                                      SHA-256:8540533F847C367755915603B8B6DA57D52EEAF88209CD66B3F2050AA5D385BD
                                      SHA-512:3F3F3928EF7D550CC9F15881079502E411506D518FECAD411301B30A859AB043D7691CED6DFAC9868E2DB793F978BBDA14423500330FC322D33286009C025E4B
                                      Malicious:false
                                      Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZM.i.H...M.i......V%..[..M.i......V%..[..M.i..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............y..`S....*P..D....N...^................{QqO.)O....ojk............................................"....I.qk..B.....LZ.............y..`S....*P..D.................................M.i.....M.i.....M.i.........................................M.ij."..M.iT....M.i.....M.i..T..M.i.....M.i .A..M.i.....M.i ........M.i3M.i:M.i8M.i..z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000007.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                      Category:dropped
                                      Size (bytes):24268
                                      Entropy (8bit):6.946124661664625
                                      Encrypted:false
                                      SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                      MD5:3CD906D179F59DDFA112510C7E996351
                                      SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                      SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                      SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000008.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):4.6519821082642645
                                      Encrypted:false
                                      SSDEEP:192:7XbsZwILpdWs1yq/uaGhjbDCgRJ8vH6z+nNKLX+df3RpwLdX8HdtSrAygdL9WdQU:7XA26pdWOGaEjagcvH7No+df3RpXdt43
                                      MD5:130301DED4FC1FB28384840F5EC26A8C
                                      SHA1:E4D21035AB0053BAC8FB1065128C3E51468A98DA
                                      SHA-256:6A8861C55E6B35D657F5FFB111C54EE48802EFA56B053001006AEC8039532A87
                                      SHA-512:99575ECA2EB2C4494FACBD2E398365778E1D1F5E6010E1D03C2162B4F3079B3CCDD40900D4D12E21960F55A814F44538FCCDE460B3AB290D050EAE86C9B04F31
                                      Malicious:false
                                      Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZR...N...R..<.(.....p|~b3R..<.(.....p|~b3R....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................v...,.G..a......N...^...................T.C..-..d..............P....................................I.qk..B.....LZ................v...,.G..a...................................R.......R.......R...........................................R..j.9..R..T....R.......R...s..R..H....R....0..R....`.&R..........R..3R..:R..AR..8R....z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000009.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):39010
                                      Entropy (8bit):7.362726513389497
                                      Encrypted:false
                                      SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                      MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                      SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                      SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                      SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000A.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.9063481379379024
                                      Encrypted:false
                                      SSDEEP:192:osia9vk0MKeZ0C0T8b0W8XRertK/0H/o00mrX4PKB883wRZKi0J11KYxKz0H870R:dPv7eJ04GXReoc74SGWwRgNsjlyp
                                      MD5:84E9EB24FAED1F52FF513D3D54881130
                                      SHA1:CC3C46B4204CABDCA60C5B57B0B8D9AB98EB1E6B
                                      SHA-256:6D7B3D25533667D3A24BED45E349764352F91F4922F200B2940D0229AFCDEA5C
                                      SHA-512:C0904B60F62CF24A324F6BAB3667E98FD388B1A5943DD00E494287752091A9035FD51691BB482651B0997203D3F9960288AA98C3FD4BEE1F63E86BDC1FDDCD31
                                      Malicious:false
                                      Preview:....>......."...v.......8 ..."......>.......r...v...>...@....!...........................................................................................................................................I.......I.qk..B.....LZZ.......Z.....z.5Z.....Z.....z.5Z....~Z.....*.7.K.....m..i..*..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'............."..M.C.."..U. (.....N...^................[.s...M......,z............(...............................z....I.qk..B.....LZ............"..M.C.."..U. (..................................Z.......Z.......Z............................................*.8.....*.7.K.....m..iZ.......Z.....z.5Z....~2................................I.................................*H......*.......*..d....*.......* ......*$.7....*.......* ..........*!..*..z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000B.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):59707
                                      Entropy (8bit):7.858445368171059
                                      Encrypted:false
                                      SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                      MD5:47ADB0DF6FDA756920225A099B722322
                                      SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                      SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                      SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000C.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.8793747150527826
                                      Encrypted:false
                                      SSDEEP:192:SDQ0sfUWnxUXPmOmaGkZqXs9osRlHbACxaA69m+0ukjQ/t:SDQJfUjX/tGkZks9osRlUCdCm+n/t
                                      MD5:ED92E99E0188FF7924899FF5F999C1BA
                                      SHA1:46D1124F6289D9F77D7CA79080B6D280E0442EA3
                                      SHA-256:CDC98524F37036735AA8D8F0F9E17CEFC20C4C8F45CA0BE6EE5E4B5FF465FB2B
                                      SHA-512:1AF740BF89AAF8BC748D438CEBDB4178DE4074F23094622CF1B74B6AE663FB5B607E6832586ABD588D980DA4873E3FD0C911C2F69FFBE119B0C3E25520BBD2BD
                                      Malicious:false
                                      Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZS...<...S....DO.-#x.(..S....DO.-#x.(..S....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............._.po.}......F.....N...^...............<.].k.[O..:.................................................D....I.qk..B.....LZ............._.po.}......F..................................S.......S.......S...........................................S..j....S..T.T..S.......S..|..S....;..S....h..S.......S.. .W.....'S..2S....z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y........................S..3S..8S....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9.............S..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000D.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                      Category:dropped
                                      Size (bytes):27862
                                      Entropy (8bit):7.238903610770013
                                      Encrypted:false
                                      SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                      MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                      SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                      SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                      SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000E.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):5.339973297113939
                                      Encrypted:false
                                      SSDEEP:384:bBf67tNOQzbibfxMdY4YFAyb0fLAF8YewSSIgkw8dDPAdSFK9uydDPygXXg:bY7VuV9QWPjKLw9Bj
                                      MD5:07737C967DDC70DA4C7C4EDA4FF3CFD7
                                      SHA1:BB7DCE5DC219502D8E15B5F409015164C1CF2F01
                                      SHA-256:DD3588D427B5004CAE0B2558598C96E01C4D2D3F098E29DB67AABB2CF85D3289
                                      SHA-512:3E05B15DC8301A6624804C451DD54AB8F1B3844E4ABB2D93779437FB2697817FC2FD895D849E4BEDEB6914D7CCC93F7CEC5D6764E09195F9B472E7B34B5103E3
                                      Malicious:false
                                      Preview:...@...@L...........d....@..H ...L.........@...@.................J..H ..pK.................................................................................@...@................PK..H ...K..........................'.K.]..../.........(.u...o({.%.....7.......7..j.....k..TW....G...%..k...nK.u.q.7s......nK.......................................................................T.......T._.....T......#T....^~*T....d.3T....i-8T!d..Z.T!............0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.................D..p.....n.......n..Z.F....e..2................................................x........n...............0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000F.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0933683691430485
                                      Encrypted:false
                                      SSDEEP:96:0sNLkyO/dXmL8EauSXi9ehpT8n9RLg8ikR9JbC:0s2FXWZauSXi92I9RLn
                                      MD5:12C5031DB6CD9068C851D67282DEEE0B
                                      SHA1:98A99D8EAD8E0221CF5F94B87E8E1E3826B70AD7
                                      SHA-256:4A028AB71234DDC35B1AB432D2680A84ADBB9531DFA93DFCCC6A1274C900BC9D
                                      SHA-512:2264D0654B20B8CFD5C68B43FD80560DC8721DF10BA4CBE2D4C934135FE46F2ED18DBAFA36DE898959DAF9CC248185AD0496148691551655F5449EB511F96771
                                      Malicious:false
                                      Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZJ.?.....J.?Ngz......T.2J.?Ngz......T.2J.?..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................|.-...#.Y.......N...^................|.A...F.p>t.m.]........f........................................I.qk..B.....LZ................|.-...#.Y...............|.-...#.Y............J.?.....J.?.....J.?.........................................J.?j....J.?T.]..J.?.....J.?..B..J.?H....J.?..B..J.?..>.)J.?..J...................;........4...4...4.."..............J.?.J.?.J.?..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........J.?.....J.?....#J.?............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000G.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.097094343767551
                                      Encrypted:false
                                      SSDEEP:48:BsZHSZ+la0g7tRtMEfmh7uKXs7uK9CAdUCToJxJrdqreI50dX2OkHzQa:BsU0g7ZMEAuKXsuK9CuUCT2JRyJ07uQ
                                      MD5:D7EAF00193FADE6505F5BC91452AF066
                                      SHA1:FEB530131B50A536511E2DFC90465D3B7C628777
                                      SHA-256:02E63205AF42AADBEAD9A8E34560C4EE6A389E56FCEE8238FE2C4CE123CE693D
                                      SHA-512:1E6E5DAA74F9A010D8D74CBA452CB4D9374BFDA969D4F32EF4E78E712AAFA4CFBB7A4B6E9902B46D39C2CA64724A9148C83050D39EC48A58AC2B92A3764B52A8
                                      Malicious:false
                                      Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ............[j..!....BV.....[j..!....BV......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............j.o.............N...^.................M..iSG.f..FF.........f........................................I.qk..B.....LZ..............j.o...................j.o.................................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000H.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.067579286322266
                                      Encrypted:false
                                      SSDEEP:48:Ns6r6vLogxMU/tcB30E3piXk9idWTofJrd6rTIKdXijIbi8L9GZ2sQg:NsoAoc/2iE38Xk9kWTURi9KgH9GzQ
                                      MD5:D898B750EE9F963F0AC5E688CDFF908B
                                      SHA1:50CCD8E5CD75CADDC42D70BAE5033A41E308B80A
                                      SHA-256:80F2E47E63F1862A17439A74B2A10ED074DA027A347D5B5C99EA37200BB47A7E
                                      SHA-512:4124A2DAD45F86757EA32FE08D145A2A8E5EE1DEE2470E12D75FA7819B3EA0325CBCDD7B4AE2224DCDB7AB67B96C8F46D334DDAEDB654BBF79D357275E2A6B6B
                                      Malicious:false
                                      Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ.........t@..%...S..5..t@..%...S..5....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............yo......)=1..Q....N...^...............G.XR.E.I.,..'.S.........f........................................I.qk..B.....LZ..............yo......)=1..Q..........yo......)=1..Q....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000I.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0438260489296285
                                      Encrypted:false
                                      SSDEEP:48:tskdC516/tiTdTAElBXw908ToTrdnrOhI4dX6bPyS1qg:tsr16/yuEDXw908T6RrO1q4
                                      MD5:495C6FD087D0B3180CEFB968E34EA77D
                                      SHA1:8378DEFB758089A3424602322D30A148ED30CFFC
                                      SHA-256:493CF51ABF729B0716B250D56963AAA930ECAD6BBF60BAC7CB5878B052484117
                                      SHA-512:4653C997563EA0460225E811462A19A81424C344C490C59355C96C9DA3C81875247C1B69A9EA141F62B65185DCDFDBBC7BFFF4CE5978FDF55665CF21A14CD3BF
                                      Malicious:false
                                      Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZt.s.....t.s.{.L.>#O+.0..t.s.{.L.>#O+.0..t.s..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................M........A4c.....N...^...................Ob.B..v..h).........f........................................I.qk..B.....LZ...............M........A4c............M........A4c..........t.s.....t.s.....t.s.........................................t.sj....t.sT.]..t.s.....t.s..B..t.sH....t.s..B..t.s..>.)t.s..J...................;........4...4...4.."..............t.s.t.s.t.s..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........t.s.....t.s....#t.s............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000J.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0673653226209705
                                      Encrypted:false
                                      SSDEEP:48:lskxMEmNF/TtIlZIEHhgXE91lLoxTou9rdqrCU/IldXm0vyqIg:ls/F/TmiEHmXE9vLoxTH9RyCUm8II
                                      MD5:41D59648BF184EFC7205DBA73FAD881A
                                      SHA1:65F5F893BE62A5FB82F6F7675EC5C9C25EBC11F7
                                      SHA-256:45E4D3679541A1C55EDC4F6B99C9DF93CA23C2107427FA7E2FA622783C058667
                                      SHA-512:2D1586E7B4CD5981E0F45875A1F2EB1999109AC4BEA05059F37A481F2E52D72C29519826090921505090FF0F2CFECB877ABA38F5574F8F797839162AC19175B7
                                      Malicious:false
                                      Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ...........r.j..-....l.....r.j..-....l.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............5.......$.gpcL......N...^...............Kz....E.4l<..%........f........................................I.qk..B.....LZ............5.......$.gpcL..........5.......$.gpcL..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000K.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.094731626644193
                                      Encrypted:false
                                      SSDEEP:96:KsG8WscTEvWXlW9RfTDRPHdFom2YFnOS:KsG8WsLvWXlW9RfnRPHdFom2YFOS
                                      MD5:3522F5BF10A60E72A467A96C2980DB04
                                      SHA1:0225E69254118141922F3047D47B10D64F64A133
                                      SHA-256:92FFC287E2A4306A4EF326548D55E4849A84041C99649EC070744563AF7423D6
                                      SHA-512:A522C50A277E1E917E3C42B84CAFD0B282E2F19DA39AEEFB8FB444DF8C20F6F4AB1513035B152C4E45D6A9CFBB6E3FE3DDC4FCBF1C5A8C5F67F9BF569C2944E1
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.N.......N.O..{.....F...N.O..{.....F...N...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............j..*J..5...k.......N...^.................@.,.?@.V..Q.8.........f........................................I.qk..B.....LZ.............j..*J..5...k............j..*J..5...k.............N.......N.......N...........................................N.j.....N.T.]...N.......N..B...N.H.....N...B...N...>.).N...J...................;........4...4...4.."...............N...N...N...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........N.......N.....#.N.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000L.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.072688909438785
                                      Encrypted:false
                                      SSDEEP:96:Cs2nbcgDIEZ3GsEYvXA9D0suTcR2xbC1Rl:Cs2bcgDIEVIYvXA9osugR2xbCr
                                      MD5:991AB058B8BA8F02E7F15C81E78FD1E6
                                      SHA1:4E160F2251BF894ED8C30F2E53CA0EB35331681D
                                      SHA-256:8ACA05C6574993999C68D20EBE1C309885B6F31830D3A42818D7C71E41ADE0E4
                                      SHA-512:CEB7204E7EF264F1EAB447BD2B886F3A0AF68A582FB52B1AAF833FD8CD2ABB959C5C8AC1DEB7F44A8CD35D931A3C724D98ADFFF0631E17EFFCC77820BE92B873
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ"3......"3..... .6..{."3..... .6..{."3...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............'..q.v..B...$'....N...^...............i...O..A................f........................................I.qk..B.....LZ.............'..q.v..B...$'.........'..q.v..B...$'........."3......"3......"3.........................................."3.j...."3.T.].."3......"3...B.."3.H...."3...B.."3...>.)"3...J...................;........4...4...4..".............."3.."3.."3...z...y.. x.. ...........$........4......7...7........................;........4...4...4........."3......"3.....#"3.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000M.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0740166617002815
                                      Encrypted:false
                                      SSDEEP:96:YNlsRKzsktrRMTEwXTY9dHTbRHJFz0SwO9:ysRKzsMRLwXTY9dHfRHJFz0SwO
                                      MD5:F9FDE6636D571F52329E54A3A178F20B
                                      SHA1:2FF602414E4279ED921966D4D67A5D34BFB3CE88
                                      SHA-256:3D7E0F51D883B7A6B77FB0E29F95B7ED5199513541DC1301BD886DF2E75B7808
                                      SHA-512:DE1906DB20A6456A5861F6003D22BC508FE1C3E5DF66B8CFEFB5C2E85EC8DA3DAEECEDC70E570D2C07B6C958B6EECD2F29CC4EC941679C2ED7998F9AB3363300
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.............Y1."..WY........Y1."..WY........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............h\.....+....B.....N...^...............%#...a.K..2............f........................................I.qk..B.....LZ.............h\.....+....B..........h\.....+....B.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000N.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.075007617230232
                                      Encrypted:false
                                      SSDEEP:48:YxsqtYeK9KaOzRtGuEXgZRKXZK9CMpjToF0rdPrN3IRxdXZZRBKSIAlV:6sq2KaqRLEXgfKXZK9CyjTPRjAxQA
                                      MD5:5895239036BBEDF5F66D275E40297129
                                      SHA1:7BC88348D68B2284A88425DA873493F8BA4EDA4E
                                      SHA-256:F5CCBBBD661CD924B0F7AF9A0F746E5C6B8F18F0C0B4AD8E95E3857F6E2FDAB2
                                      SHA-512:0C2694004200991A0B1DC38D6CA820947CC2C573B3138CD60C582BC14E33914B8A3B2BF54024711065FCCE5138247A2E34DDE10FD108AE977E5D649C9CD68E0A
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.............P'...1.b."......P'...1.b."......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............g.......?..Q!/......N...^...............%.+k.)@..q.K.i5........f........................................I.qk..B.....LZ............g.......?..Q!/..........g.......?..Q!/..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000O.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.100726938407111
                                      Encrypted:false
                                      SSDEEP:48:YfOksd4tOlcCtbVrI6ttbKGE82XQ9O36JToIrdQrqINdXzNRflcRnFp3Y1ll:WspRbNI6tzEnXQ9OKJTxRIZt3v
                                      MD5:1D414759DE1D4B05E091A9D099848577
                                      SHA1:C7917C7D9744946C48B3939FE8FE34703ACEDC7F
                                      SHA-256:9F56024CF2B64F8AF503D4D7640B40755C286E21C453BAD4D3170E76C8DD5CF0
                                      SHA-512:117A32466E39D183614D4B68F02B16C6F1A39FE4B5F78FB5C34776FFC58DF157975B2E167EAB1D9C9B2FFAAC4ED48C9302917561D2D20CFE226A4ADFB935AD7B
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J...........................................8l\7.....I.......I.qk..B.....LZ........8l\7.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................DZ..$.@.z.....N...^................c^.|.GO...x.].........f........................................I.qk..B.....LZ...............DZ..$.@.z............DZ..$.@.z.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000P.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.085664087969886
                                      Encrypted:false
                                      SSDEEP:48:YCOsltj2aG4+tKKELh9dXAR9s8dTo2j9rdP7rUIZdXh5NRgS/jZp:HOsSaG4+TEfdXk95dT3xRfzOcjZ
                                      MD5:27E0D4D0EB56D334DCD17ECD0B04C4BF
                                      SHA1:EF7067E9B489E759F8FDB9430379496C2A49183F
                                      SHA-256:94727DD7155ABC8B096EC422C534E540727A30D3125E685EB667D03954E4FCB9
                                      SHA-512:AFA8C0C8431D51A543B010092451F9EDFFC3B2FE481EDBF0B2AF215AF465D72EAC8FD5BCD76FF57E11E40D792CBCAB2E6902972F76C1A04E44923C7E4BF4CA1D
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.y.......y.z.=H.-t..\H...y.z.=H.-t..\H...y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i$.p.X..6....(.....N...^.................}.?.GD...ep.PR........f........................................I.qk..B.....LZ............i$.p.X..6....(.........i$.p.X..6....(...........y.......y.......y...........................................y.j.....y.T.]...y.......y..B...y.H.....y...B...y...>.).y...J...................;........4...4...4.."...............y...y...y...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........y.......y.....#.y.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000Q.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.073000392186264
                                      Encrypted:false
                                      SSDEEP:48:YPVsJmdl7Ka6YtUzmEFnoXg95M0ToSrd2troIDdX5ZRagl:wVsYlea6YKCEFoXg953TzRexr
                                      MD5:9A8507C7FFC229331B8A15A6F12930D8
                                      SHA1:5C86BAB9B2F60D481F7C327089E66FD8E279E1A4
                                      SHA-256:2A3891D1C686E77C647AFAA45E674F9CD6A28924727D0970695490ECF17A49A6
                                      SHA-512:96B8DA96A61D40AF949B94FDB802A201914BACD8FBF19A78A89B237F85F4721EEF0F4CA5AA4F16146B91FB90CC361E012DB7A132DC22270CD8CF75D9241C341B
                                      Malicious:false
                                      Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ7.x.....7.x.a_....%...#27.x.a_....%...#27.x..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............-U..F~..'..:].t.....N...^....................>C...l..K........f........................................I.qk..B.....LZ............-U..F~..'..:].t.........-U..F~..'..:].t..........7.x.....7.x.....7.x.........................................7.xj....7.xT.]..7.x.....7.x..B..7.xH....7.x..B..7.x..>.)7.x..J...................;........4...4...4.."..............7.x.7.x.7.x..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........7.x.....7.x....#7.x............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000R.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.10191974080082
                                      Encrypted:false
                                      SSDEEP:48:tszfQq5WjItJftgEt9XI9sHy6V9To4rdfokr0MIRTdXfSk7+Usa:tsbcjIBgEnXI903V9T9RfH0nswjs
                                      MD5:0154337DD86950AD929FC608CF137C01
                                      SHA1:B8BD09149D294EEC94656F108D8EA27D57C67BEF
                                      SHA-256:D20ED3A3AE9DCE4F86E2AB1E90CA30DFAC39A32F45E7B68315DB1B9BFAE44C33
                                      SHA-512:1DE0FCB2C4D1142DA7B5BF7E925CCD94D4AD16D36F21CF85599401F624000834B718A3D6DCD6889DB7CD13722E7CC049AF3124E3254823043021FFB763B33EAA
                                      Malicious:false
                                      Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ.VM......VM..#....bl.[.VM..#....bl.[.VM..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Q.........~.(.....N...^......................M...O.B"........f........................................I.qk..B.....LZ.............Q.........~.(..........Q.........~.(...........VM......VM......VM..........................................VMj.....VMT.]...VM......VM..B...VMH.....VM..B...VM..>.).VM..J...................;........4...4...4.."...............VM..VM..VM..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........VM......VM....#.VM............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000S.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.065584016055153
                                      Encrypted:false
                                      SSDEEP:48:+aDsRAD9LmFtSstgEno3+X4927Z8TozrdlriIAdXyxIVksIR8a:NsCxmFhgEBX49OZ8TuRpcXVYR8
                                      MD5:F5AD975CE1C49312C63E863A50DAB144
                                      SHA1:F92CF6BEC7CA56DECF2D48339C9D4C6EC6FF93C7
                                      SHA-256:F8BD2973C7E49F48D1EAC87D083B4414F2ADDAC81F8AC5E4AA45AC77FCEF733F
                                      SHA-512:3B024B24838C12E5933473469D2CF8FEE56DC7A6270AAA43D02B8C42B8925D30A25020951634A2D2035015B8591C88434ED0969105F827D8C93CFC3101C89735
                                      Malicious:false
                                      Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ..........z\S..C?...v....z\S..C?...v.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................7.-..$.......N...^....................U4N.2....|A........f........................................I.qk..B.....LZ..................7.-..$.................7.-..$.......................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000T.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.090211373423316
                                      Encrypted:false
                                      SSDEEP:96:ZsH9Fx9mtcE5X09mHTbRRwogeBdbHgvhFo:ZsH9FxW55X09mHfRRwog2dbHg5Fo
                                      MD5:0F6863A71A5AAD71443998AC896CF9C2
                                      SHA1:773D77FC37209F45FB71636B20F88F787D71984A
                                      SHA-256:77CBDB68ACA0784D89CA2F8ACE2B972BA676714C7DF1E4B2D42F19E13D5F3200
                                      SHA-512:1E6094974245BA9E8B80C312AA1B0052A94AC5B3267EA1B90BDAD311949BCFB74352AEB30659D408222E33B014F8F1DF7ADFD9563B7137437FF580D7B2FC71C7
                                      Malicious:false
                                      Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ................6h...qz........6h...qz.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............Uj.q.-.Q..XO.....N...^..................e..D.....#T.........f........................................I.qk..B.....LZ..............Uj.q.-.Q..XO...........Uj.q.-.Q..XO.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000U.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.146217793119528
                                      Encrypted:false
                                      SSDEEP:48:2sHWBiG6T0tr0EtXoX/o9XjhMTonrdjr8rhIodXabC+7532d3+7xzBeSig:2sxG6T0WEqXA9VMTGRv8RMpNlQ
                                      MD5:627C90BD0ACFD066B110E04413C79796
                                      SHA1:543A1838A2AE7ABA2D42259A2F457AABC98182F8
                                      SHA-256:2D7EE22D22DB9A9D48EC9E2625DC947EC56C15E225CD68BF4AD22DF510534D43
                                      SHA-512:B9F07503851502174EBBEA7A70B3ED9185BFD1313083B67D4D504E85A6E0C3EC9C9A9D67B0D0A223722EB60FF1306C4EF1BA80E84EEB5B809C94E7D3504C1473
                                      Malicious:false
                                      Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ\.......\....=......~x..\....=......~x..\....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h....0.(.So.(.....N...^................=7....N....v..........f........................................I.qk..B.....LZ............h....0.(.So.(.........h....0.(.So.(..........\.......\.......\...........................................\..j....\..T.]..\.......\....B..\..H....\....B..\....>.)\....J...................;........4...4...4.."..............\...\...\....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........\.......\......#\..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000V.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.1749658734776816
                                      Encrypted:false
                                      SSDEEP:48:oC0syJpZmlUxDCA8ptZaMtEEPlOTpXmp9AGAToArdQrSTdI6dX6bUmlRyqVvhhig:B0sF+ZCA8pZEEP+pXmp9ALTFRIYSf
                                      MD5:0BACB2F018683AD2298C98AE013615E5
                                      SHA1:BEF35DA29ECCBB94F46C837D803C80F962A22863
                                      SHA-256:9097509E9488B0C1C912A7E59ABCDF0080F614CD0DFC574DF19F4120954CCD97
                                      SHA-512:14B5F1666D4165FDEB5850D4F8389A0E2F4B06B537B1EB438CAD74C6786B27104935F87C509EC6459CDFC745781D8C1540869F1EDADB451A7DA479A30D4B2142
                                      Malicious:false
                                      Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ.a.......a.sQ..........a.sQ..........a...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................K"./...#.]`....N...^................L.P..E...)i{`.........f........................................I.qk..B.....LZ.................K"./...#.]`.............K"./...#.]`..........a.......a.......a...........................................a.j.....a.T.]...a.......a..B...a.H.....a...B...a...>.).a...J...................;........4...4...4.."...............a...a...a...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........a.......a.....#.a.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000010.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.148026737533884
                                      Encrypted:false
                                      SSDEEP:96:FsdPnqhcVEBA7OXo9dEUTPRK1cYnhJYX3D:Fs4h5AOXo9OU7RK1
                                      MD5:7E4B627E04AC03DBA934B1180ACC22E5
                                      SHA1:9FD33AA15F4B48737CD953E9B4E8420672194089
                                      SHA-256:63C8FDD56F83DF9DB958192278F580E40DC922AF91016ED322C9E2C286491901
                                      SHA-512:39E470D224E7EE9DFFEBF9BED8F57F92FC14033548DBC3053A3E450A19583ECABB1E5DD63EFAA97C69B6E3A831F654D6E578847CA4C5C801A6598CB118A97438
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........cc:..5...a0.k...cc:..5...a0.k.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$.*>x...*../!Q......N...^................^x.'6.L...z............f........................................I.qk..B.....LZ............$.*>x...*../!Q..........$.*>x...*../!Q..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000011.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.138536613209583
                                      Encrypted:false
                                      SSDEEP:96:S0sjQGncx5E7hXI9MVT6JRKq/w6IlwtVT:S0s5csVXI9MVmJRKq/w6IlwzT
                                      MD5:D848D8FCD79BAD79C7920F537E4E3A1B
                                      SHA1:8B006D4992A746C35D267B5C7EDB6B77DDB6D06C
                                      SHA-256:7009A2BD95801249E45A61F40D70169B408ED75093E70A7D9E42D515D72F2330
                                      SHA-512:52677691028A0767765777A208D5F6AC06C6DB9B5BD55B4FC9FD651F7B0A5B5D49C8EE322F5A90B82640116F4771D06EB7FC28ADE570EA783AB5B96DF75F07A4
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.........?Z....=o.KAP...?Z....=o.KAP.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............K..u....&........N...^...............\.?.D.uM...d..9........f........................................I.qk..B.....LZ.............K..u....&.............K..u....&........................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000012.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.142127118701654
                                      Encrypted:false
                                      SSDEEP:48:lsc8uOlqBwq2SjtbkimLyEEC/5XI97n6ToLrdSrbIYdXMmGsd:ls9ejq8EEMXI9uTGRKb7
                                      MD5:347005FCCC73E589010AC119FB0268FE
                                      SHA1:5D322DE0695DCECC8EDEE5217F44EF4B43194A4D
                                      SHA-256:B7D8D0346A04331910D9B4CDF308BF87726522C077D804159B0C21DDFB8F59D7
                                      SHA-512:5C1186AD811D829FA6D434BDBC2150051A4AECDE115EFCA619757093D0A84E5BB33E37470C3CBB07DD7C83C0DBF114FE0F15086D42A952676EF092C0D6479C5B
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........;.)...&......;.)...&......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............5a.*..4.M^=F......N...^...............#`....@..j.g...........f........................................I.qk..B.....LZ..............5a.*..4.M^=F............5a.*..4.M^=F......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000013.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.122417690165459
                                      Encrypted:false
                                      SSDEEP:48:b4gs6q2zIRy64t6br1yE2CHncXDc9vM7ToovCrdSrGIUDdXwGbVaH6SbGlBwG:FsLy64ob4E2EcXDc9yTyRK8Dhl
                                      MD5:F57334045828EEF008090E5C30735477
                                      SHA1:D1B0578D3F9B3B4C2B2078758627F817BEA561B8
                                      SHA-256:46A986850C758A88EF46A8BC60A9771F4BEE4BED9363EBAA1176C6C144F640AD
                                      SHA-512:A70F20DD78FFE673AE6F45D19ABCA5F27BB983E3A1A4E5B9634CCD610DB52419E4854ECE0725FFADF5DEE410218D04234AB3D3E870C8A1DF53B6CAD89DF5191A
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ*.m.....*.m|NU...r..L.=.*.m|NU...r..L.=.*.m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............-.`.j....3"M......N...^...............2.&....B.U.N..$.........f........................................I.qk..B.....LZ.............-.`.j....3"M...........-.`.j....3"M...........*.m.....*.m.....*.m.........................................*.mj....*.mT.]..*.m.....*.m..B..*.mH....*.m..B..*.m..>.)*.m..J...................;........4...4...4.."..............*.m.*.m.*.m..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........*.m.....*.m....#*.m............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000014.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.122968626820496
                                      Encrypted:false
                                      SSDEEP:96:tsxmcbEouiGIEiMUXDU9QT4RKjjVWJf2wVAB2:tsxmcbEp7UXDU9QURKjjVWJf2wVK2
                                      MD5:3CAB774CC7678B2FF994EA27393AE284
                                      SHA1:B571C0AE5A564D3A47C0DAA091560E3E43860BAD
                                      SHA-256:C12F765EB16783A649B006383595714766CEE53471BDAA065B633A9926DC880C
                                      SHA-512:F7E7CC6EDD116BE6227F693F5DE40B54C8D70F0F1CA8D64C38D1A3A00D55DF00415F868C4591A0F33C2A72957929F507196C74CC864F78528E8B34DEBBBB9811
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........8.....B..e.u....8.....B..e.u......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................Tp....`q&V....N...^...............k.pH..I..(I............f........................................I.qk..B.....LZ................Tp....`q&V............Tp....`q&V........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000015.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.099892528286727
                                      Encrypted:false
                                      SSDEEP:48:bJsgbknr5ttiKEnpDCZPdwXzHw9nfjToQrdSrpIddXz4xq3Fk1:bJsbnr5rxE1UwXzHw9nbTNRK0Xm
                                      MD5:C1584B89350D498A9E8D49FD0CC42950
                                      SHA1:5063D0EF7AF554E37413BAE15AD539A42BA50D24
                                      SHA-256:F2D584B5472B94DB8AB65C3E201D54C299CB0A745D58F7A4E8553D6FB34637D9
                                      SHA-512:38427182355FAC106F594172340BC1B0C84B18D6D33E894DF1BEF0E3D809E658A4B27FA511B0B828294B17DCD909F6698D7B8975FCEA7B0910C5B221CA9C91EC
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.........L/0....<4i.i...L/0....<4i.i.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'........................Y......N...^...............k9..)[.@....f.R.........f........................................I.qk..B.....LZ.......................Y.....................Y......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000016.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.147471792611828
                                      Encrypted:false
                                      SSDEEP:48:e0sd8UQ0T6+ANtrwyEmCKhXY979l7ToordSr8IcLSdXXuAGV:VsHjT6+iZ7Em3XY97XTdRKiWa
                                      MD5:483A3C30CA8AA3B6AEC5BCDD0DE29D6C
                                      SHA1:2321F6EBD796C7E5D06B7DF6299CBB818E5F956E
                                      SHA-256:14167AB79B3DC8AAC097D6F9847531461C9B3D617F3892EEE30A846C5F711AE4
                                      SHA-512:28FB70B41D17DE079641FAA6B9F0258711EED67E2C435995A80FDFD73D875402CCA4CF0C3D5B3D64D28487F5A0DA319B4309ECCB21BCB4223542C790833932C5
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.}......}.t.......\....}.t.......\....}..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................'..:....{.O....N...^...............E.uK..G......lb........f........................................I.qk..B.....LZ................'..:....{.O............'..:....{.O..........}......}......}..........................................}j.....}T.]...}......}..B...}H.....}..B...}..>.).}..J...................;........4...4...4.."...............}..}..}..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........}......}....#.}............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000017.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.110983743452952
                                      Encrypted:false
                                      SSDEEP:96:KUsaxjaf4sElCHXM9VTaRKEbPLddEP4Da:rsaxjaSOXM9V2RKEbPLzEPua
                                      MD5:43954ACFDD3F7EBFD09FD0E3E4EACA90
                                      SHA1:FAE39751BBA3B18550CBBFD8B7D82AFF08523762
                                      SHA-256:628849CDD7A7AE8541ECEF00359DBDC204A31CB49C2127210A186AC7CE38B9FE
                                      SHA-512:EC5DBD3835A4051FBA19B01F194C0D2982320545FBAEE623BFCC5ACFD5D3B2FB7FFDE3CDEE3CA7F2A7FE9ABF15105AC8B4A4437B8E9EC40B966548F834F5B453
                                      Malicious:false
                                      Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ.$d......$d.+......2...$d.+......2...$d..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............B)C......v..._.....N...^................w....OL..{ZO.........f........................................I.qk..B.....LZ.............B)C......v..._..........B)C......v..._...........$d......$d......$d..........................................$dj.....$dT.]...$d......$d..B...$dH.....$d..B...$d..>.).$d..J...................;........4...4...4.."...............$d..$d..$d..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........$d......$d....#.$d............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000018.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.170405012987647
                                      Encrypted:false
                                      SSDEEP:96:K3gs+r4F3YtE6c7cX89sTVRKuarq4dYeR3bErqBC:Ugs/3tDcX89spRKu
                                      MD5:D6FF87D6DC48E005AFC7AE7BC88BFC2A
                                      SHA1:6180B42308042DB741D871656F3E0692C837A772
                                      SHA-256:46DA43DD4EF598547C319B1BC033477380195B392AC45F6DDD781D7E35C86EEC
                                      SHA-512:75C5DBFC292BC4032FABD935B598984B6CCBA061C64D77F68EF35CD7F6DE57C3C8AB094DA9ED10D03F2812A6ACCBAC012F0B3EEBBB86AFB8CCF5510CBD16731C
                                      Malicious:false
                                      Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T.........................................5./...*..A.I.......I.qk..B.....LZ......5./...*..A.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................:.....e.=.LV....N...^...............L.....F...PO..........f........................................I.qk..B.....LZ...............:.....e.=.LV...........:.....e.=.LV........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000019.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.112193105858204
                                      Encrypted:false
                                      SSDEEP:48:QvseEvp+7tfSEIWCCYuX892T4To1rdSrQhIOdXWHxx1:Qvszp+7MEPNX892sTQRKqe
                                      MD5:782CC62B2C7D5232521256BE606D2760
                                      SHA1:63345477F96D569CC944E0C2EC7E190196D349E1
                                      SHA-256:3C3C21D53C52EC405DD02428DE986F077BC591B16AA9C5B9109871FB50AD408D
                                      SHA-512:E12B3B22CB237D4EC370D7EE0AD6289A5B96E5CCC9920F7BEE955EFF0F72ECAAEDDCEF37452AE626D38495A51469ED5B87F23441A7199915D591B6DA5E744424
                                      Malicious:false
                                      Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZ............ ..`......... ..`..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=.}..7......%..O....N...^...............*y...V.D.Tm./..4........f........................................I.qk..B.....LZ............=.}..7......%..O........=.}..7......%..O........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001A.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.1388047906727925
                                      Encrypted:false
                                      SSDEEP:48:Pxsq1sRfBpetFmqEVC/VXs39EC3MCTomrdSruIXdX5uQWF:PxsFBpeREVYXs39z8CTXRK30
                                      MD5:412400A3AB4E6261A8ED02C227F8C560
                                      SHA1:46CD8906908EAB337D5B9EBEBCA55D5D3A89717E
                                      SHA-256:240FD8A5E932BC37108C6848FCA37E889A25FB42E50D47605917935A18D878F6
                                      SHA-512:BC4E13584C9C241D57D1485272665EC88C3D9D2E096A7E72802AD3FE5289C339A43861E8B98E5A06FA57E5C39586CBBF5B2CB9401F76B55EEBA15EDCC40B17FE
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ\.".....\.".D#1.<.N,....\.".D#1.<.N,....\."..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=dEc..............N...^...............f....=.N....._.........f........................................I.qk..B.....LZ............=dEc..................=dEc...................\.".....\.".....\.".........................................\."j....\."T.]..\.".....\."..B..\."H....\."..B..\."..>.)\."..J...................;........4...4...4.."..............\.".\.".\."..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........\.".....\."....#\."............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001B.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.1492130408406505
                                      Encrypted:false
                                      SSDEEP:48:c0n0jesEVL3Cu0DmtbwSEsWCjtsXs9F9OifTokrdSrpIRdXPwxMCLeMHRBh:9sjDmdEsWMmXs9XvTRRK4+l
                                      MD5:42EE14909B4F9BD5A95B110904908F25
                                      SHA1:A6A3489FC077F300916C9CA85DF295420D42E5F2
                                      SHA-256:CA6E03F0B4A305365EE135CA888A1380B7C70116ED13ED72F2D3A08B76150ED0
                                      SHA-512:7D9E4EDD206491EF36FCA1B3272DD81ACF6A507B91D4EE44472EA9E17D571C556A16BEB6A5895BD612D15B00770F144553C315EB2253AF9A8D63C6E101D51F9E
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.u.......u..(G.....c.....u..(G.....c.....u...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............c....|..............N...^...............D...8.@.q,.V*..........f........................................I.qk..B.....LZ............c....|..................c....|....................u.......u.......u...........................................u.j.....u.T.]...u.......u...B...u.H.....u...B...u...>.).u...J...................;........4...4...4.."...............u...u...u...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........u.......u.....#.u.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001C.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.110796340370887
                                      Encrypted:false
                                      SSDEEP:96:Rsl4X0tGonJER3cWtXQt9wzfTYRKYvCyn0tB+5JPppyWIL:RslG0tGo2xltXQt94URKKr0tB2JP
                                      MD5:D3FFAE40AB8AB9E8772966506AF7298E
                                      SHA1:42E03151AB7D01B9463FF3B88881E3DF366D7FF1
                                      SHA-256:821A950AB9C36BD21FCDC1CC3C1BBEE7A85059A74709A76305BE96D5F5739083
                                      SHA-512:3FD8CBD2D976DBB5197D4EBE58CC336614B1FB93FCB298B2D72E93F2D7ED2BED32AFC219D03AAEFF20A1DBF85CF32A28707BF3A726149D6B43E251787CB11574
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZe.C.....e.Cv.....Z..;(=e.Cv.....Z..;(=e.C..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............7P0.3!L."..-..F....N...^.................y9..I.a..............f........................................I.qk..B.....LZ............7P0.3!L."..-..F........7P0.3!L."..-..F.........e.C.....e.C.....e.C.........................................e.Cj....e.CT.]..e.C.....e.C..B..e.CH....e.C..B..e.C..>.)e.C..J...................;........4...4...4.."..............e.C.e.C.e.C..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........e.C.....e.C....#e.C............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001D.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.162018813204546
                                      Encrypted:false
                                      SSDEEP:96:EusxwNtGCWhENA1s2TXg9exrTyRKsi0lMl:EusPCTyTXg9S+RKsi
                                      MD5:E794E05051A93FB8F9EF37836675FC74
                                      SHA1:3E2BE6B94AF46789414A5E354B2C66B66434F840
                                      SHA-256:85BE9B017BB961A849B8142A3018A87D8567031F5F791A6B3DB39BFC175A9189
                                      SHA-512:7951E12B33D3314E7EFD3D32D4FBE4E14CEAAB3606D078509AA6BA196134B419D4624004EF0CD260AB3ED6F151DFE0840B6F95EE693D0786E258710939A170A5
                                      Malicious:false
                                      Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ_.h....._.h... ./.n...._.h... ./.n...._.h..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............W;.........{.....N...^................!b..NO.G.Q=.@.........f........................................I.qk..B.....LZ..............W;.........{...........W;.........{.........._.h....._.h....._.h........................................._.hj...._.hT.].._.h....._.h..B.._.hH...._.h..B.._.h..>.)_.h..J...................;........4...4...4..".............._.h._.h._.h..z...y.. x.. ...........$........4......7...7........................;........4...4...4........._.h....._.h....#_.h............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001E.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.0012030586861
                                      Encrypted:false
                                      SSDEEP:48:KTN1MsEJeryIAYcatlUsEyrCQOXs9HURxmTodrdSrlITSdXa10QfK/1:KTN1MsRyFYcaDlEyr+Xs906TsRKn/
                                      MD5:840DB02E396956D3A38E0334EB2A2C08
                                      SHA1:8FB64512D49E59B7A759CAE83CA2F89F795527F9
                                      SHA-256:BD02BF4D79EA78FE81266F5867591468F6A5FE40C4955BB048070259C4E0FD1B
                                      SHA-512:FEC29334B8B2C7D10849A92E56FA8846B8356EC3AD2622AED0E005BECC2323342D3AEF7EAD61858CC613CBE457DF5D65BEAED3A2DEA6FF0A2F77D51C8CA7D49E
                                      Malicious:false
                                      Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T.......................................1d..5E..Q.g.I.......I.qk..B.....LZ....1d..5E..Q.g.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................'....,..6y.S.....N...^.................]`..B...S.J..........f........................................I.qk..B.....LZ...............'....,..6y.S............'....,..6y.S.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001F.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.138384636582309
                                      Encrypted:false
                                      SSDEEP:48:Dsn8TAWslT1U6UtDMEJlCDQXHDm9H7mV5U9ToprdSrVIedXicmNWPPH/xi1f:Ds5l5UbKEXpXK9bmnU9TgRKjXdc1
                                      MD5:C75613CDE046FB155B0683FC72230767
                                      SHA1:9F7C58421DB9224D81692ECB2C4EEDA48639BF04
                                      SHA-256:BAA6F50803D8BF4AAE0A020380266DAC82A392ADC9DBACADDD7A7F1A2CAE11DF
                                      SHA-512:6DC6B66CBE8CBBFE76211203105DA99C38F91D33536B0F374980F984256AEFB35D1325359E8B3657979B1E7AA5E540ED13807EEF46904972DDC7B6274020AF60
                                      Malicious:false
                                      Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZ...........0.....D(.lW.....0.....D(.lW.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............h.....4^.r.H......N...^............... t.3._.E....L..p........f........................................I.qk..B.....LZ..............h.....4^.r.H............h.....4^.r.H..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001G.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):3.5264487415908166
                                      Encrypted:false
                                      SSDEEP:96:woV6zgZyh4LCS/qYooK5EG4I8PE8c4I4pBjH4IkoGtU4a:hyh4N/qYonmO78U4pNX5Oa
                                      MD5:8A40D142173A16F674C72464D55306C1
                                      SHA1:157924E64C4FF7737294A96AF4080C3CE9B8D270
                                      SHA-256:C19692B3898FA04AB7558A47FF47FAFFDF587F28C8AE825B30CB8B1017D51191
                                      SHA-512:60A09033DFE3B0ABDD24D34F29780CDCEBC2B86CD25EDCC5045769AD5AF96EAE4CE0E9B5E974BF2C35ED6116C444527B09D953347AC701CD440B20AF696BC696
                                      Malicious:false
                                      Preview:\...L...............................................................................................?...................................................\...L...............,........................................#..4u......Tb......Tb.M"..B.G...Fe..o".z.#S7.b...e.....U.....v*X.SW...U..?.].....z.j.)j.?........................................................................r.......r...J...$.................-&..!.r[.q.2...........^.......0...........Tb..-.G.1.f...r.e....J...?.......Tb.T./..-.GT.v..1.fT......rT)................".......n.....T)O......1.f......J...c..,0...e...B4.$...........GP..A..}.....J....................Tb.M"..B.G...FTb..(.....F.b...wb;(...1.fG..H.(.G.K..1.f.....>................?.].....z.j.)j.J.e...;<..}o!.1.fG..H.(.G.K............0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001H.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):4.626340019860702
                                      Encrypted:false
                                      SSDEEP:384:+5KRkdYnK8HXCdC/i/C73fRtyD/BGuJS7mpmack1wmG+fuNIXW+RPEn162:+5KydYnK8HXCdCEC73fRwD/8wSqpmacB
                                      MD5:D6E47456ED17338B4BBBD4B5AAF09114
                                      SHA1:D1E6673483F4AE65685184F19E676DD35AFC6D8B
                                      SHA-256:4468E62B52F0B322B93FA8F92644B70F5A2E5BDE5BAF61600E24B1B3ED7E0DC0
                                      SHA-512:50EE1F45485AE6160C8F61FA72F9484A151875D5DFA377413F837125E7FF8BD1446C289DEE02C70E86C8608F4735B5A69E9EF06202C2A64BC32A8535AB18D9D1
                                      Malicious:false
                                      Preview:....>...........v........@..( ..`J..........>...t...8...v........H..( ..PI..................................................................................>...........v........I..( ...I...............I.......I.qk..B.....LZ%.......%..e.`k..C..8...%..e.`k..C..8..q%...'.<..A......<..'.<..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'.............~2..UK..=1+!.Jh.....N...^.................4D(..A.$.....i............J...............................4....I.qk..B.....LZ............~2..UK..=1+!.Jh..................................%.......%.......%...........................................'.<(.6..'.<(.z..'.< ....'.<$....'.< ....'.<(.5..'.< ....'.<$........%..3%..8%....z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001I.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                      Category:dropped
                                      Size (bytes):22203
                                      Entropy (8bit):6.977175130747846
                                      Encrypted:false
                                      SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                      MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                      SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                      SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                      SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001J.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):3.969610327941933
                                      Encrypted:false
                                      SSDEEP:192:1m2s2+Fei30Ng0Xf5xWR/3zMpst9EvEJItuFaqSN:8t0C2xgR/opsvEviI
                                      MD5:86ACBF76E1E0C682BD235E690F05B832
                                      SHA1:B0C3A87A335C51E6C5A63B670DA0EB007342C377
                                      SHA-256:967788B07BD926B5BB623E2FC91D63573DF94011B84062619AD2BDDA6BCABDC4
                                      SHA-512:7AA63FDD810A29458F06185D196C88F6269684C49B4A77EFE8CFBDDF2A3763CA302CA5068C9B87F995D5CC623209465108127066CA2240DD8EBD7872AAA58772
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZ"9f.)..."9f...z...'....."9f...z...'....."9f..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................. @...ysM........N...^................`%..>.A......Z.................................................I.qk..B.....LZ................ @...ysM................ @...ysM............."9f....."9f....."9f........................................."9fj.h.."9fT)..."9f....."9f..L.."9fH.].."9f....."9f..H.."9f..}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i.................."9f."9f."9f..z...y.. x.. ...........$........4...!..7!..7..............."9f:"9fF"9fG"9f..z...y.. x.. ...........$..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001K.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):52945
                                      Entropy (8bit):7.6490972666456765
                                      Encrypted:false
                                      SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                      MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                      SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                      SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                      SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001L.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.524909270426115
                                      Encrypted:false
                                      SSDEEP:192:is8owTD1NiwrjFxAXadcUGvRtvvxzMQEYZXXa1M75gNDA90Fr+kK061d:v8LiwrjFxK+cDvRtvN3w1M75gND80FrG
                                      MD5:9F941626ED000A3BF529F1DDB6907EC4
                                      SHA1:22E7D5003C64D280381AD533A70E0F07CF1B4E8A
                                      SHA-256:3473A0BAEE04682E223C4FB76726172FE345D490A80DC64AA908FEE804124B0D
                                      SHA-512:28ACC7A834BDB26F74999912E9B34A35A7468DA7CBC4339BE8F48D8F2C01A5009D92FF8AD705A8CAED41ADE3C4932BB313396070BE1658CD10A7AC10F364FB0A
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZ>...9...>..]7^..4%6j...e>..]7^..4%6j...e>....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............l.R+.p...JGhn.....N...^.................Y...D. ...,b............................................r....I.qk..B.....LZ.............l.R+.p...JGhn..........l.R+.p...JGhn..........>.......>.......>...........................................>..j....>..T.H..>.......>....\..>..H....>....3..>....O..>............Z4...........................................4../4......p...............C.a.l.i.b.r.i..................>...>...>....z...y.. x.. ...........$........4...!..7!..7...............>..:>..F>....z...y.. x.. ...........$......

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001M.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):25622
                                      Entropy (8bit):7.058784902089801
                                      Encrypted:false
                                      SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                      MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                      SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                      SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                      SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001N.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):3.182105440559077
                                      Encrypted:false
                                      SSDEEP:384:a+odMx/GCEeOaYQOO9Ta8Da5ERSbeqljnhjqS7Pf:a+odMx/1E0YQOO9TbDa5ERAeqlThjqST
                                      MD5:D1B98211F800822910EEB63CAAB24804
                                      SHA1:9990926464C22C0A807E4225818BA118BEA3FDA0
                                      SHA-256:534653A09F24D599EF528BEBC5A4D500EEEC6ECB95AC320F559A629860A0F259
                                      SHA-512:BE8C682E33DB33BA9CF3CC96BF97064DD8ED52805874703C04507A3D43E733CC48F0CF07DFDB5A3D22767F726122BA0017458CEC5887E85403E461E9BD9BF09A
                                      Malicious:false
                                      Preview:2...>...........v.......0 .../......9.............K.........9.............K......I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8....................I.......I.qk..B.....LZ4..T...4..v,X..5.,....4..v,X..5.,....4...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............9.............K.....N...^...............9kF(+..@....9L..........................9.............K.........9kF(+..@....9L..............9.............K..................................4......4......4..........................................4.j.e..4.T....4......4.....4...a..4......4......4. .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................4...z... ..$..............

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001O.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):15740
                                      Entropy (8bit):6.0674556182683945
                                      Encrypted:false
                                      SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                      MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                      SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                      SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                      SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001P.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.7633585513843895
                                      Encrypted:false
                                      SSDEEP:192:dsT8JW0rSY+cHsopXGtrCCWRtLYJywaO59me24X85Tp9pYIl7ekp:ig40rSqnpGtuCWRtMJyDOWsX85TzpYI
                                      MD5:7EF897AE1733EC3BC2F33105740CF8EB
                                      SHA1:8C23EE37EFD6363768B7E1F69D69ED24C3BFE380
                                      SHA-256:A9C582D93E574EF4C24E37983641E4839BF09C8EE111FE327415CC699036BA5E
                                      SHA-512:ACDCCBC219661C90C2EA818CC5E83CA3A6A394BB1BA5AB05A3BE40EE98C9A3AC4FC626439AC5F5A16FDB701789377E7FB0D4D31705880074C9F201FEF5D6A4D9
                                      Malicious:false
                                      Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ...9......\Ts..C\.j......\Ts..C\.j.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............`!.p....,.8.$&.....N...^..................g.KE._..o%..................................................I.qk..B.....LZ.............`!.p....,.8.$&.............................................................................................j......T.Q............n....H........9......V..............Z4...........................................4../4......p...............C.a.l.i.b.r.i............................z...y.. x.. ...........$........4...!..7!..7..............'..%......z...,4. ...........$>........4

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001Q.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):55804
                                      Entropy (8bit):7.433623355028275
                                      Encrypted:false
                                      SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                      MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                      SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                      SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                      SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001R.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):4.656231952753496
                                      Encrypted:false
                                      SSDEEP:192:rsCn/Lwpi1i/Q5Fo2IVGEqoqMoyekU8g7HybN4eXTpl6S9RtrIluNAKqTZ49+nZW:Q8UpiY/Q/ovGEqoqanXg7y6QRRt8lCAA
                                      MD5:C39DB50101139689746A4FEE9D8E48ED
                                      SHA1:7C851457C123D8A1F6E86F3E1682EBE85FFCBB5D
                                      SHA-256:C14F2183A4CA34229CE5D9C4E50E044E6C55C26405E44876FD4E2E7949F22651
                                      SHA-512:1C669D1D7D25D98E32E02BA5EEAF4565EE5E76EFB2696B97443B9D64A1022ADAF38CE3036A49A3FA3D47B81975111AAD4589F00C021E5C700E6A10CD79471AC8
                                      Malicious:false
                                      Preview:....>.......>...v.......0 ..h+......>...........v...Z...@...X*...........................................................................................................................................I.......I.qk..B.....LZ..................a.5.S...........a.5.SH.....I.qk..B.....LZ.I..T..ne..E.[7~...T.............I.......I...................................................I.t.....I................................................................4..'...'..............bj.7!.G....<.^.........................=W;c..H...3M.B.....N...^........................................I.qk..B.....LZ............=W;c..H...3M.B..............................................................................................T....|..T..(....T..(.z.....j.N.....T)................b..... .......'...8.....z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001S.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):41893
                                      Entropy (8bit):7.52654558351485
                                      Encrypted:false
                                      SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                      MD5:F25427EFECFEE786D5A9F630726DD140
                                      SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                      SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                      SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001T.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):4.537333699855513
                                      Encrypted:false
                                      SSDEEP:192:vshpszTX9F98c/KMXdUZ7fav1vqdOHc5OgLXQfa/wclRtfpntlGdwql4kwL9Gz:kmTX9H5/KWUZ29vqd+6pjLNlRtxtl+w6
                                      MD5:AE431AFA68CF5922432738ACCAD6B8EE
                                      SHA1:E8E5B142363DC541D0AAB62807702833B21EA087
                                      SHA-256:F9B4BDEE32A3B20F7A74441A17DC8433BAA88195395D4D5C5C8125BA4A76EE3F
                                      SHA-512:BDB58C4920A50A8A544376A4A6C7DA93F5A28C742F23EEC9D8133FDE4D17675D099D611A4A49E458880F20FEBCC640483D2BCC97B21CABFE150D04FA1151B054
                                      Malicious:false
                                      Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*..........................................................................................................................................Qx..G...Qx......0..Y5..p.I.......I.qk..B.....LZQx......0..Y5..pQx...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............f..*".F.3{I.ogr.....N...^...............S.8".D.@...h.F.&........V...x....................................I.qk..B.....LZ............f..*".F.3{I.ogr..................................Qx......Qx......Qx..........................................Qx.j.A..Qx.T....Qx......Qx...r..Qx......Qx. .7..Qx......Qx. .........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................Qx..Qx..Qx...z...y.. x.. ...........$........4...!..7!..7...............Qx.;Qx..Qx...z...y.. x.. ...........$......

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001U.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):14177
                                      Entropy (8bit):5.705782002886174
                                      Encrypted:false
                                      SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                      MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                      SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                      SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                      SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001V.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):49152
                                      Entropy (8bit):4.676889025715574
                                      Encrypted:false
                                      SSDEEP:384:Wv0Tg3iXNJuVAY6Esk+/xfw2YLW67B0fPW83KebIH18m5iQQl879DXMRbtN8zpo2:WdeNsV+dw3TcoEsm2/fhe3QVBm0B
                                      MD5:ADF46D8243A99C24F4304BF565BBBD52
                                      SHA1:A102B2FF719A7AE64A5CD2B9647133044E359FB8
                                      SHA-256:E673531D7556869C8C9E9300C0F71994620278F974A8FE8DADA62FC837EEF1EA
                                      SHA-512:E3E74A54BECB812008820510F26FBD301B7B0ADB822D0420BDCEE666C023DA7B7FFF0F793303C6D5E2897D28EC7FB9B4688F5A77F5DC6B4C733326CBFB66938B
                                      Malicious:false
                                      Preview:2...F...^&.......%..v&....... ..H@..0`..........2...F....&.......%...&..8.... ..H@..0`..................................................................2...F...&&.......%........... ..H@..0`.......................'.K.Nf..R...V.......V...5....qKK5...J....0i.LD..t.J..J....+.;..D..O..J........1.3.&..S%..............Z.S.....Z.S....................................................T.5....T.7.....T......T%...t..T.U...S.T.C...&.T......@T.+...........0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.........-o......-o..(.....G.../$.&.......&.:}D.I.....23E2...v.......(....................V...Z......t......_....&...........n:......_....c..,0...e...B4.$........{p.....G...^...?@kO....................=[......=[5l.5I.=.O&.<...f.......f.Qm.J.?.5...E....I.9cr4q<..E..-o..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000020.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.34429536358552
                                      Encrypted:false
                                      SSDEEP:96:josNIG3HUsrz11FE8nXpd9FwJ+RAnVJGNTFPM:josNIGEOzm8nXpd9M+RAVJGNTFP
                                      MD5:2D4F018526B05FFE00B91E581068F2C7
                                      SHA1:A961433534D208AA70F4225E4D865952642F5824
                                      SHA-256:A17976D3DE54DB253142C4D864B2E2C03F12A5018A5563430B1C12945066038F
                                      SHA-512:30AA4056AFD688F681FBD3B1F5A578E8421BABE20B65F7B6A33542DA75D46447ABFADF636F15A15E21A094DEC1C5AEDECDCDDCBA59F84C89E1975906818B8F98
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZFk......Fk........10.tFk........10.tFk...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............L..................N...^...............v4.;&l.D................f........................................I.qk..B.....LZ............L......................L.......................Fk......Fk......Fk..........................................Fk.j....Fk.T.]..Fk......Fk..B..Fk.H....Fk...B..Fk...>.)Fk...J...................;........4...4...4.."..............Fk..Fk..Fk...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........Fk......Fk.....#Fk.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000021.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                      Category:dropped
                                      Size (bytes):12654
                                      Entropy (8bit):7.745439197485533
                                      Encrypted:false
                                      SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                      MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                      SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                      SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                      SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000022.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.350777899896445
                                      Encrypted:false
                                      SSDEEP:96:AsinMjvsJYEp5XTUZ91lI8RAnBMD0fZk:AsinMjv0Fp5Xw91lI8RAnBMD0fZ
                                      MD5:F453D7FBC86F78DAFD56243F883CDB36
                                      SHA1:7795547BDEF32B7D04FFF9C4375414BF515A708F
                                      SHA-256:D4686445F7BEDBF4D979166F0D7B1772CE7256DA757E7D34B5A4D70C1C3D38C9
                                      SHA-512:60C9DEE0B48A27671D7BB7835672BB5F7FA572DBE79A0E4B42B7AED5168A87FC4E6DF37F9E373F84C9BE1EF9DE35AFA751B97BCFBFBC4DC65639BB857048546C
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ6t......6t...+......u.BL6t...+......u.BL6t...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............s../....7...!iv.....N...^...............#...QyD.;#f.MP5........f........................................I.qk..B.....LZ............s../....7...!iv.........s../....7...!iv..........6t......6t......6t..........................................6t.j....6t.T.]..6t......6t...B..6t.H....6t...B..6t...>.)6t...J...................;........4...4...4.."..............6t..6t..6t...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........6t......6t.....#6t.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000023.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                      Category:dropped
                                      Size (bytes):2695
                                      Entropy (8bit):7.434963358385164
                                      Encrypted:false
                                      SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                      MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                      SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                      SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                      SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000024.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.329188149239823
                                      Encrypted:false
                                      SSDEEP:48:tyxsQpHaJ7FBty/PE/Et/2X9299fKcpXrdhSrrOtXZ5zUr9LwAV:tyxs8g7bqPE/M/2X9299C+XRAi7+CA
                                      MD5:511163DC7695FFE0FE769860316B6865
                                      SHA1:9D4CC0A6099406A965FC3D3139D3702C5CFF6B37
                                      SHA-256:40B9C8539D877FAB4AB29000400FD2A112D0B698E9CB6F2C5CBED830BDDB47C7
                                      SHA-512:B9E422639A4B4900F3D54FB68501C7D8F98A5294813CA91FE3C05CFA14728CDBA5F428C31BB2047DE568B1F47560B7DE0B90517FE8E6EDBEB8ECBC91A68C48BD
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.A.......A...@..........A...@..........A...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............)..#....0...B.......N...^....................uO.|U.7w..........f........................................I.qk..B.....LZ............)..#....0...B...........)..#....0...B.............A.......A.......A...........................................A.j.....A.T.]...A.......A...B...A.H.....A...B...A...>.).A...J...................;........4...4...4.."...............A...A...A...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........A.......A.....#.A.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000025.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                      Category:dropped
                                      Size (bytes):11040
                                      Entropy (8bit):7.929583162638891
                                      Encrypted:false
                                      SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                      MD5:02775A1E41CF53AC771D820003903913
                                      SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                      SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                      SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000026.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.502156421000456
                                      Encrypted:false
                                      SSDEEP:96:gnsCWkqfSH9aWEP3FkX69i43RLVkUrq+yjUrd9:gnsCWkqfSd6/GX69i43RLVkUrq9jUp9
                                      MD5:159C5F073AD81517A2727BEF30BD3BF7
                                      SHA1:64DE5BF78A007BBBFFF1FF17491FCF375CE13C64
                                      SHA-256:A8F631FDBBDFD92BB21031C565B7AB24CD02357D7A5D0D8E35A66638B754000E
                                      SHA-512:3F3712A9A4AEEF16FE6E59D2C8270B365B486D77B4B245523AF0E44C20E7E6ED18840D514F5A7073B912B2CB81A499EB322C37354CACAD10F20D78A4869773FD
                                      Malicious:false
                                      Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ..Y.......Y!.......%...e..Y!.......%...e..Y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................U..9.^.|.e.....N...^................"./y8.@."d.............Z................................... ....I.qk..B.....LZ.................U..9.^.|.e..............U..9.^.|.e............Y.......Y.......Y...........................................Yj......YT%c....Y.......Y..G....Y..H....Y..>....Y.......Y .3...................;........4...4...4.."................Y...Y...Y..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4...........Y.......Y....#..Y............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000027.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                      Category:dropped
                                      Size (bytes):2268
                                      Entropy (8bit):7.384274251000273
                                      Encrypted:false
                                      SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                      MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                      SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                      SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                      SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000028.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                      Category:dropped
                                      Size (bytes):784
                                      Entropy (8bit):6.962539208465222
                                      Encrypted:false
                                      SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                      MD5:14105A831FE32590E52C2E2E41879624
                                      SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                      SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                      SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000029.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):2.7320819893247523
                                      Encrypted:false
                                      SSDEEP:96:VsVBd+Nv/GVkBoKXWE6rXD9EtERQ5CWDaYAoD/l4y:VsVj+NvNKW6rXD9EtERCC
                                      MD5:D4D893D9CBAEB7A8B58170ED223F5EF0
                                      SHA1:18EB8C1CC7234FFF83912AB105140E7E2508A0E6
                                      SHA-256:18938F6088D4B170B3459A4B5FAD989DBE55E312C82C055A241B36AD0EDE8D47
                                      SHA-512:B3CD5B0479C73883E97AB5468EE6B8819548D4847A38BB91DFCF3D08B37456EFDF38E89667A3C61A3212A3AE9F8277AF33841B4B09E8A6CDB895030273D9B38F
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZ.,.......,.'.1..9. ....{.,.'.1..9. ....{.,...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............N..VB..+[U.X.aj....N...^................A._..FF..h.-|..............................................^....I.qk..B.....LZ.............N..VB..+[U.X.aj.........N..VB..+[U.X.aj..........,.......,.......,...........................................,.j.....,.T.l...,.......,...Q...,...Q...,...>...,.......,. .3...................;........4...4...4.."...............,...,...,...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........,.......,.....#.,.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002A.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                      Category:dropped
                                      Size (bytes):3009
                                      Entropy (8bit):7.493528353751471
                                      Encrypted:false
                                      SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                      MD5:D9BD80D40B458EDB2A318F639561579A
                                      SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                      SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                      SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002B.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                      Category:dropped
                                      Size (bytes):2266
                                      Entropy (8bit):5.563021222358941
                                      Encrypted:false
                                      SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                      MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                      SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                      SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                      SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002C.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.316230984159809
                                      Encrypted:false
                                      SSDEEP:48:Yul0sVd0hfNtA+xltTfvqWEgQX/uxvJ9OAoBrdQqr2x6Z5BX2VzUY9:Yhswm0lPEpX/uH9OAwRQycmgJ
                                      MD5:68C8939F2BB0CB9D9298C502DFF52C30
                                      SHA1:42FFCDED6F9E41B9DF2D7A259849EFC642C17840
                                      SHA-256:0FB5D950D63CBF9B3172D5DA13AF183A02DE8EC797D624F07EDF8FEDFA9438BD
                                      SHA-512:C69B186587FA44D3102F481B3B644C7A351AF1BAF1E71C8D0FB3ECE95A668AFD1A3062749CBF4FB0EDE3CF8D71EF9E5CC051D3B19D4230339B321130DC71562A
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZe.X.....e.X.............e.X.............e.X..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............w...=@....3=#.....N...^................A....K.3a".wBs........f........................................I.qk..B.....LZ............w...=@....3=#.........w...=@....3=#..........e.X.....e.X.....e.X.........................................e.Xj....e.XT.]..e.X.....e.X..B..e.XH....e.X..B..e.X..>.)e.X..J...................;........4...4...4.."..............e.X.e.X.e.X..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........e.X.....e.X....#e.X............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002D.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):99293
                                      Entropy (8bit):7.9690121496708555
                                      Encrypted:false
                                      SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                      MD5:EA45266A770EEA27A24A5BB3BE688B14
                                      SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                      SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                      SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                      Malicious:false
                                      Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002E.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.338213410533771
                                      Encrypted:false
                                      SSDEEP:48:Yu4jXsrnTUOFQ3tu155sEVpyrXta9mf0oxrdQqrzevsBXcbV3EUVYy:YFsHNQ3KgEPcXta9mcYRQynu/VY
                                      MD5:E284F1AF9BFF0258D8D13106DDF8D51B
                                      SHA1:3FB5E1806416D2FD020D5D03F9304820BB6409FB
                                      SHA-256:DAC4C3B58E9F8F0EDAC442A7DAD0831446301CE1D7B539D346C6C706C1D30E65
                                      SHA-512:235C4716A73B2F981AA3CF6AC3FDEFF8255BE544840DA066C6EA56A4D0A91A525440D973C5395182DA365ADF10869B05CAF7C6ACD7FE602814351BDB06C33F83
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..f.......f..1..7.W9..X...f..1..7.W9..X...f..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............31b.H./.#.....O.....N...^...............O....>K...i..........f........................................I.qk..B.....LZ............31b.H./.#.....O.........31b.H./.#.....O............f.......f.......f...........................................fj......fT.]....f.......f..B....fH......f..B....f..>.)..f..J...................;........4...4...4.."................f...f...f..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........f.......f....#..f............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002F.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                      Category:dropped
                                      Size (bytes):2898
                                      Entropy (8bit):7.551512280854713
                                      Encrypted:false
                                      SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                      MD5:7C7D9922101488124D2E4666709198AC
                                      SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                      SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                      SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002G.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3048783686644825
                                      Encrypted:false
                                      SSDEEP:48:mjxsAlmDrhPtyUWOESh7VxXr1/9+3oNrdQqrRWXhQkBXMCsnN8g:mjxsFfhPUOESh7Xrx9I8RQyRKQkmX8
                                      MD5:4F28E1F27058B61CDB6C0E675627BBC4
                                      SHA1:AB51DC107A82DBF43A4D1B1407A582684244E247
                                      SHA-256:BCC515891339CCD81157FF0FF4104C94FBD14618ECDB5BA6D539DC08D96AAF39
                                      SHA-512:73180A1334AA42F4595D2FF1B0C267BF96B2C6CC96DFBF5C6EA5CB844EF3AF2524416CEBEB16D572F5F5F43F44251559DF9FE95CFFB140AC91BE05523CE8CFF9
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..,.......,u........<6...,u........<6...,..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............KK).1.p...&..j.:....N...^...............?.t..B.@...@...$........f........................................I.qk..B.....LZ............KK).1.p...&..j.:........KK).1.p...&..j.:...........,.......,.......,...........................................,j......,T.]....,.......,..B....,H......,..B....,..>.)..,..J...................;........4...4...4.."................,...,...,..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........,.......,....#..,............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002H.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                      Category:dropped
                                      Size (bytes):29187
                                      Entropy (8bit):7.971308326749753
                                      Encrypted:false
                                      SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                      MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                      SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                      SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                      SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002I.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.340062171145647
                                      Encrypted:false
                                      SSDEEP:48:ws0lNcVuqt+tqdwEYYOt73dXc9KNIovdrdQqrOdg+wBXw89Hv31:wsXVuu+0uEYY6RXc9j0RQyOXwd
                                      MD5:7B50441F7DB81729254C45E81CDDAAEE
                                      SHA1:F177F47AAB2762F0A75D9E62D28CDF60C8BD430D
                                      SHA-256:D234B9E8E2341C579AF038840B787F358DA583110852899CBE394E0C9F18001F
                                      SHA-512:3E685E8C255840D579E6CF95D13CC3E19DB3E5A7E5E0DFC0CA49BC0E6E54F6575A26939CC3569DE3CF4209CA411B5277907B8FC19DBCA8959177B04FE126523A
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZP.......P..2 .W.0.3.r.,.P..2 .W.0.3.r.,.P....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............4g......t.0.......N...^................|....E.k.).:u.........f........................................I.qk..B.....LZ.............4g......t.0............4g......t.0............P.......P.......P...........................................P..j....P..T.]..P.......P....B..P..H....P....B..P....>.)P....J...................;........4...4...4.."..............P...P...P....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........P.......P......#P..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002J.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                      Category:dropped
                                      Size (bytes):4819
                                      Entropy (8bit):7.874649683222419
                                      Encrypted:false
                                      SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                      MD5:5D6C1F361BC04403555BE945E28E53FC
                                      SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                      SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                      SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002K.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.377057677231575
                                      Encrypted:false
                                      SSDEEP:96:is9E2xstmToEVoZX83k9luBRQyMuutY/:isFxstKV+ZXWk9lERJMuuq
                                      MD5:47C24268510FE90193A89301AAC29D66
                                      SHA1:BE0279AD7CA7592EBF209E963AD17E45B65D53D8
                                      SHA-256:A67A01669A2F7F066B2C6A5EA0ABF155483B297B69DAD3A9BB772DE9F3031A1E
                                      SHA-512:7F321D7FFD261D411435F6CC8C1B85A0E33AB0A807DA6E8EF6B41205E11CB4F9205A254A212D9784424C4DE1D2CAD18AADCC28829D1D911CAC260463552A1AFB
                                      Malicious:false
                                      Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ...........7.F..2.......7.F..2.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............n./G.5.(...,8b.....N...^.....................YI.NK..1..........f........................................I.qk..B.....LZ............n./G.5.(...,8b.........n./G.5.(...,8b.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002L.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                      Category:dropped
                                      Size (bytes):1717
                                      Entropy (8bit):7.154087739587035
                                      Encrypted:false
                                      SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                      MD5:943371B39CA847674998535110462220
                                      SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                      SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                      SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002M.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.303948846701295
                                      Encrypted:false
                                      SSDEEP:48:pGNsP64nvzfntQM7EKd79yXy+59GxboFTrdQqr1IlRSBXfg5f8g:isrz/xEKd5yXJ9OkRQyyLSS8
                                      MD5:AC4DE3C75AA39DD3FA1EE1BD5F7AF130
                                      SHA1:3A952660428F048B2F5DBFAC817E11CEE99802AE
                                      SHA-256:58341CBF06EB9650D8BC0491268BDD57135E6CFBF7F4203124FEAC811B90AE19
                                      SHA-512:313D2EAB629D89E5929678309C504B3AD0E13EBFE8CF2A863BA7AF108B8DE7DD8427D1164D87C5303EB2B8BB49433F8769884F1C01D870ECF87F9E693A7816D6
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ../......./..g..;...Z...../..g..;...Z...../..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............aj.xr...J.I.L.....N...^...............sm.....J.....).........f........................................I.qk..B.....LZ.............aj.xr...J.I.L..........aj.xr...J.I.L............/......./......./.........................................../j....../T.]..../......./..B..../H....../..B..../..>.)../..J...................;........4...4...4.."................/.../.../..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........../......./....#../............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002N.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                      Category:dropped
                                      Size (bytes):3555
                                      Entropy (8bit):7.686253071499049
                                      Encrypted:false
                                      SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                      MD5:8A5444524F467A45A5A10245F89C855A
                                      SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                      SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                      SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002O.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3738698847136295
                                      Encrypted:false
                                      SSDEEP:48:AsVcqzdMnEXtw5WElW/X4P9evaoHBrdQqrbwa6I2BX+Q9qwF:AsyEXW8EM/X4P9VYRQyEXD
                                      MD5:5AAF8B1F0E26732CA245A1D965223BE9
                                      SHA1:74CF488841C31A11B4CCB1B4B6B5C6CDDC714696
                                      SHA-256:3070CBB3819D2DAF319F9777AA20249EB411C95A72778782012644EFBD25FC23
                                      SHA-512:9927B184068DD1E10E84DB321C32ACDDAB725A37EF819FC3043B22FE83942A68D0C6172364810B4D9B1FA80A9709F5060093E4CE25CBA5693F45C2329810C719
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.........U.Cj..p...S<g..U.Cj..p...S<g....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............`t.Ehh../..........N...^.................m6...J..(H.W..........f........................................I.qk..B.....LZ............`t.Ehh../..............`t.Ehh../..........................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002P.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                      Category:dropped
                                      Size (bytes):3428
                                      Entropy (8bit):7.766473352510893
                                      Encrypted:false
                                      SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                      MD5:EE9E2DF458733B61333E8A82F7A2613D
                                      SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                      SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                      SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002Q.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.373553035745973
                                      Encrypted:false
                                      SSDEEP:48:sPsKQz4lDLtixEXNrx73tcX7c9abo9rdQqrpHVBxBXZtW9g0due:osj4lDL4EXNrxTtcX7c9IcRQyV5m
                                      MD5:631B2E84DFC6C3D3236F2EE0029B9E55
                                      SHA1:DE85117F6FA57DBEE194B4A28B7FEB4049755C7C
                                      SHA-256:1298DC05776DD2DAD0C50832DFDC8D380D8B898516106670F593C20EB5B24882
                                      SHA-512:A5DED3C64ABA89D5E5B3DFD9E6CC5CDBB81CDDBBB482BA9F4AEEDB50341FADFCE4E601C59B2A9D86F52AC047084B23DDC786D58AD18B10F7A7842EBDCF7CE797
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZT.......T....c..-.x6}i.T....c..-.x6}i.T....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............iZY&O....4..L......N...^...............r./;...J.9..{..:........f........................................I.qk..B.....LZ............iZY&O....4..L..........iZY&O....4..L...........T.......T.......T...........................................T..j....T..T.]..T.......T....B..T..H....T....B..T....>.)T....J...................;........4...4...4.."..............T...T...T....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........T.......T......#T..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002R.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):65589
                                      Entropy (8bit):7.960181939300061
                                      Encrypted:false
                                      SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                      MD5:8B48DA9F89264D14B83FF9969F869577
                                      SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                      SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                      SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                      Malicious:false
                                      Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002S.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.369992138429253
                                      Encrypted:false
                                      SSDEEP:48:APs9RlQMto+mEmdPsCXR9q6odrdQqrsDiBXiGUk7Qaak31:qsNQMAEmdkCXR9tURQyeiiiH
                                      MD5:5E5F8B834CFE14B77EFE611B3BEF2B39
                                      SHA1:69402BB4644E4D3C519B25C11572D3412C2BDDEB
                                      SHA-256:269F401716B44FA8AE4E6F59E054FC458D3F09816D6CFF0789009738F38D30A0
                                      SHA-512:721C2D8B8858621722D8D47261DA053ECF15CC6F538CB333D8CE56D43C9838E8F6C6274C0E43BEA38347AA3D8457103705B2115CFC8EFF7F08DBDB2627195EDC
                                      Malicious:false
                                      Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ7B......7B.T.,..2.~a2#B.7B.T.,..2.~a2#B.7B...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............|c......(....%.t....N...^.................}[.Z=N.B0r...........f........................................I.qk..B.....LZ............|c......(....%.t........|c......(....%.t.........7B......7B......7B..........................................7B.j....7B.T.]..7B......7B...B..7B.H....7B...B..7B...>.)7B...J...................;........4...4...4.."..............7B..7B..7B...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........7B......7B.....#7B.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002T.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                      Category:dropped
                                      Size (bytes):1873
                                      Entropy (8bit):7.534961703340853
                                      Encrypted:false
                                      SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                      MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                      SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                      SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                      SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002U.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.486093532702645
                                      Encrypted:false
                                      SSDEEP:48:WBsGR1lL7tUEeuXox9Ty7oardQVrumWBXtukVFl:WBs6l/WERXm9MHRQ543
                                      MD5:B4D8B510584ED20BBAC69FB3755447A3
                                      SHA1:63C105B7AB2DF9766D6E0AB05228C65864ABB59E
                                      SHA-256:3302A49D003F403FFAF34BB9AFE7DF52F165BED13C3B6A04DCDB5FC9FCD0D896
                                      SHA-512:154A187495FAD9E6D33C1CF21C255383D5F74FF3FA3689B25BC1915617E0B8EFFA9BC3045A1D5ABE3F1A3D6DA9A40934A5036CA824E8FC764D1A6283845CE5BC
                                      Malicious:false
                                      Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................9.......9.t.0:.-L....._.I.......I.qk..B.....LZ.9.t.0:.-L....._.9...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............H....O..R...!"\....N...^...............,.)&..m@......-........Z........................................I.qk..B.....LZ.............H....O..R...!"\.........H....O..R...!"\..........9.......9.......9...........................................9.j.....9.T$c...9.......9...G...9...H...9...>...9.......9. .3...................;........4...4...4.."...............9...9...9...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........9.......9.....#.9.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002V.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                      Category:dropped
                                      Size (bytes):5465
                                      Entropy (8bit):7.79401348966645
                                      Encrypted:false
                                      SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                      MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                      SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                      SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                      SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000030.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                      Category:dropped
                                      Size (bytes):3361
                                      Entropy (8bit):7.619405839796034
                                      Encrypted:false
                                      SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                      MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                      SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                      SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                      SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000031.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.346587154884703
                                      Encrypted:false
                                      SSDEEP:48:yFLsS1DuFQ+zi9XKtOMSBED5uXFL9ydeo9rdQqrPf1me6BXS9mQBvKVW2G1:KspgKCE8Xp9yM0RQyPCc9
                                      MD5:F599E09EAD9119E0B0B54FBC82F75C74
                                      SHA1:1540DCA1859C5234427B990C80C3564F3528283B
                                      SHA-256:AC5BFA891381D5563C6354EA959624B358535F625B772C50A0F03A6E9434A1F4
                                      SHA-512:598CC1BEA2CBAEDC5797EF11891930B0F18ED6F725640994CB8DBE3FE147BCD18D4BB701580C88582F18870A90AFF6B94DA20122BA8C7DB087B6E700CB3A0200
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZGb......Gb..h)...GdXQ...Gb..h)...GdXQ...Gb...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............6..H.$<.(Z..x.`.....N...^.................lq.M.F.HCkZ.c8........f........................................I.qk..B.....LZ............6..H.$<.(Z..x.`.........6..H.$<.(Z..x.`..........Gb......Gb......Gb..........................................Gb.j....Gb.T.]..Gb......Gb..B..Gb.H....Gb...B..Gb...>.)Gb...J...................;........4...4...4.."..............Gb..Gb..Gb...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........Gb......Gb.....#Gb.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000032.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                      Category:dropped
                                      Size (bytes):140755
                                      Entropy (8bit):7.9013245181576695
                                      Encrypted:false
                                      SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                      MD5:CC087700C07D674D69AFDFDA0FA9825C
                                      SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                      SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                      SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000033.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.352342097785993
                                      Encrypted:false
                                      SSDEEP:48:YufqsQ0X/6deu8tUN8EuVLRXpC9ieoFrdQqrzUWBX/0BKOt:Y0qsAdeu8ymEuVtXpC9ieMRQyDJC
                                      MD5:6C66C1377C6694588A355291A34B6E0B
                                      SHA1:8BC9C61C8336CD047B6B1C033247445CE88F59CA
                                      SHA-256:A38D95CC9F3B619C58D39FEED30C91BE2BDFE129752A26F5658C06FFB7825C37
                                      SHA-512:05FE07CE5CAFFAC77D2179ADCD9D74327D59ECDC515F6C20D880D45FA61940FFDCAE666DEF467F745DBB5428E66979D732809CED3E72943DF618C8D53292F429
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZd.......d..g.=.-Ee..{.d..g.=.-Ee..{.d....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................]i......=H.}.....N...^................&U#DHzK.E@R|...........f........................................I.qk..B.....LZ...............]i......=H.}............]i......=H.}..........d.......d.......d...........................................d..j....d..T.]..d.......d...B..d..H....d....B..d....>.)d....J...................;........4...4...4.."..............d...d...d....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........d.......d......#d..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000034.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                      Category:dropped
                                      Size (bytes):129887
                                      Entropy (8bit):7.8877849553452695
                                      Encrypted:false
                                      SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                      MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                      SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                      SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                      SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000035.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.350176362284015
                                      Encrypted:false
                                      SSDEEP:96:YVsu3X+gnowjEr78XI92Re0RQygYihLUXxiLY/w:2su3VnoPr78XI92Re0RJgYihLUBiL0w
                                      MD5:4DF378A82493685F30FD029BD3794A9F
                                      SHA1:A4C54D624BDBB4414F2383A6A3D27E708F120814
                                      SHA-256:44B6A2EBDEAFAA1A26881A64D16177FC5706CB6FC81FA8599B0129AC4B64FA67
                                      SHA-512:3215E2F1B9948D3F8767A0DD7627764C2CED06610EF204FD835C1AF9CF3045C95041331C48F61E951022A99C2A1B4020E57DD8CE1FBC34BE8D70675D8C88A371
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ...........}..L..4..a..Z...}..L..4..a..Z.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............._..r&..}.S#.......N...^................m..T..O....X..........f........................................I.qk..B.....LZ.............._..r&..}.S#............._..r&..}.S#...........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000036.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):84941
                                      Entropy (8bit):7.966881945560921
                                      Encrypted:false
                                      SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                      MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                      SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                      SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                      SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000037.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.311087768770338
                                      Encrypted:false
                                      SSDEEP:48:YuisU+moucwfGBt+zEe+h8XXO/9+3o5rdQqrjxzHBXrKSrNrW48LHSrf/5rJ9:YNsWZfeKEPCXe/9+3oRQyFzF/j/5
                                      MD5:390255383BAB1808DED5F010A00AD19D
                                      SHA1:72B3D61D4D3559AF0DBF84C80141A42E4E19467C
                                      SHA-256:F80281E3FCBA90E0CFB26F6FFEAB639311600701ED4E4042DE9620B873EF029B
                                      SHA-512:01178AE99D5B46A2978738098478512B4AF8A7B717BBECB975499A88D2EA445CDD77734AACFC5798B48DDBD46ADD49AC002B78189C2C002D8530439FAF9EF7A5
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x...........................}.......}......16U.SV...I.......I.qk..B.....LZ}......16U.SV..}....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............E.J....;...-.....N...^....................Z.N....T.$.........f........................................I.qk..B.....LZ.............E.J....;...-..........E.J....;...-..........}.......}.......}...........................................}..j....}..T.]..}.......}....B..}..H....}....B..}....>.)}....J...................;........4...4...4.."..............}...}...}....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........}.......}......#}..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000038.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):1569
                                      Entropy (8bit):7.583832946136897
                                      Encrypted:false
                                      SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                      MD5:07DB3F43DE7C1392C67802E74707DAA6
                                      SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                      SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                      SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                      Malicious:false
                                      Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000039.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.361027999651294
                                      Encrypted:false
                                      SSDEEP:48:8seQilHPHtSFJE+YlLvXGatE9ujoVrdQqrzp5BXLU9weZ:8s6lHPHCEplLXvE9ujkRQyd5w
                                      MD5:6993E74F3312C6AF4B9CE56818753BB3
                                      SHA1:9B6DAED3F2D201A59B048ABDBE58C4A1F92CC6EB
                                      SHA-256:34D6EDC0DE680FBA80BD8A82A87939C0C284AA51A9991A6E1871BC01AE8CD4A0
                                      SHA-512:841484123804CA1C474FE26EF18B015E0695FBDAA75EBA8BC6F742E13EA96C40C0A528C4F17C30E7F12C38EF57EC87E6C3E0D66D2DB4C9612B9E54D7A0490B09
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..}.......}]............}]............}..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............vd;....2-..E._.....N...^..............._......B.._..l..........f........................................I.qk..B.....LZ.............vd;....2-..E._..........vd;....2-..E._............}.......}.......}...........................................}j......}T.]....}.......}..B....}H......}..B....}..>.)..}..J...................;........4...4...4.."................}...}...}..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........}.......}....#..}............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003A.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):40035
                                      Entropy (8bit):7.360144465307449
                                      Encrypted:false
                                      SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                      MD5:B1DDD365D87605F96D72042CB56572F6
                                      SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                      SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                      SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003B.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.6223362512522055
                                      Encrypted:false
                                      SSDEEP:96:l7satCoxiPmE3/OXB98PuMRQy39gCJ6xne:lsatCoxib3/OXB98PuMRJNgCJ6xn
                                      MD5:A3DA6C429455FCAA3C1CF815F9822362
                                      SHA1:CB325BC62A9F39BCE955D7E83475CF2264E7778C
                                      SHA-256:34BD6C0DC87B30DD5C853A99A88016D63F4ED6845737B0FF4056497055EB9EB2
                                      SHA-512:FABD232C5AF38A2A03D2A82DD96B818D7AE70807ACB7A6C0C57AFAA190D16932E9639C6181CEE1A0CC0CBE552106306D7A763DEE4A6B0D1E2C80344BC5B8F993
                                      Malicious:false
                                      Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZ.........9.......gDH...9.......gDH.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............`.*k.B..)^.|.H[.....N...^...............i.A....J..A..@.........f...................................:....I.qk..B.....LZ............`.*k.B..)^.|.H[.........`.*k.B..)^.|.H[.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003C.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                      Category:dropped
                                      Size (bytes):242903
                                      Entropy (8bit):7.944495275553473
                                      Encrypted:false
                                      SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                      MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                      SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                      SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                      SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003D.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.329181497125768
                                      Encrypted:false
                                      SSDEEP:48:YuSsJj5vxJ/tviDEXMRLYXp/weIX9erorlrdQqrHb3wSBXLtq1MB:YlsPv7/lgEXMR8XNIX9er+lRQyUSYM
                                      MD5:15477B4D0C53F05CE7E65E7F3E80F337
                                      SHA1:3A094E2D812C346D7AA38F8C8F503EE5C9F2C0F2
                                      SHA-256:C72556C3C9FAFE1996B1A6503CF90EFE67A31E8F8F03DDF768AEC9819ECC26B5
                                      SHA-512:B3A3AF7D97AFC5FAB6FAEFE683ADD6CF6E0046F9F35AEC775F5EDAE365B501051FD823B612915BC606793E87AE0C66C9077E673FC8C4F9DAA0193C9777290E63
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZDi......Di. ..I..%{1..Di. ..I..%{1..Di...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................W..)......M....N...^...............O7...B.O...b...+........f........................................I.qk..B.....LZ.................W..)......M.............W..)......M.........Di......Di......Di..........................................Di.j....Di.T.]..Di......Di...B..Di.H....Di...B..Di...>.)Di...J...................;........4...4...4.."..............Di..Di..Di...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........Di......Di.....#Di.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003E.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                      Category:dropped
                                      Size (bytes):70028
                                      Entropy (8bit):7.742089280742944
                                      Encrypted:false
                                      SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                      MD5:EC7811912ACA47F6AEB912469761D70D
                                      SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                      SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                      SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003F.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.325866733725053
                                      Encrypted:false
                                      SSDEEP:96:WsymWxjYE5VyXuq9W2kRQyZUcibbTcMMZ:WsVCpXyXuq9W2kRJZW
                                      MD5:B6D347256E81370FACA0F51A7F89FAA2
                                      SHA1:53B9EC6F2AD1C6E81F92ADD82787F37F4DC50C9A
                                      SHA-256:37B0CCE2B42C44EB816A4AB84F0029A8F81FF53B96A613D952D28D6912B38972
                                      SHA-512:3E18BA8C74CD28ECB5B1E410A64215A4BC9138C9879B2F3EADB315DE15D404A6ACEE2F7A70328825D07410F5C9C39692E8E9A91CB2781DBCECCA629CB9CEB455
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.........F..].,O...{B...F..].,O...{B.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................YT....J..W......N...^.................n0...D..,.UV..........f........................................I.qk..B.....LZ...............YT....J..W.............YT....J..W......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003G.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                      Category:dropped
                                      Size (bytes):24268
                                      Entropy (8bit):6.946124661664625
                                      Encrypted:false
                                      SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                      MD5:3CD906D179F59DDFA112510C7E996351
                                      SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                      SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                      SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003H.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.316030820155276
                                      Encrypted:false
                                      SSDEEP:48:mssSN1Nuf2bz+t46rEr07Xf393YTroBrdQqrDdC72BXjN4NCVUm3oWr9:msCf2byvEOXv93ur4RQyE2Xf
                                      MD5:D35D3E57013B1A695BE10F5D93F292B5
                                      SHA1:B2AA547B9AC09A28674D4964EA464892016F9D97
                                      SHA-256:2A010969691EA14E7CAEA5EDA2B3F1E6754B701448F21DD2FB2C086DDF0AE859
                                      SHA-512:FB0DD2B37079ED5318D0268E88237896CD5A3715F5D912BA03551FA7935E32FE627BDE8880DE67276091F5451A1B17BBF4AC951DC59DB7B391846F618E76551C
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.e.......e.}.?T.1.uA ...e.}.?T.1.uA ...e...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................00#. a..R.......N...^................%.}p.1K..z..H.........f........................................I.qk..B.....LZ................00#. a..R...............00#. a..R.............e.......e.......e...........................................e.j.....e.T.]...e.......e...B...e.H.....e...B...e...>.).e...J...................;........4...4...4.."...............e...e...e...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........e.......e.....#.e.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003I.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):47294
                                      Entropy (8bit):7.497888607667405
                                      Encrypted:false
                                      SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                      MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                      SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                      SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                      SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003J.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.465713540000981
                                      Encrypted:false
                                      SSDEEP:48:9ysL11eI+a45XtgUZEwLvFLFXTi9e+WoGSrdQqrX7BXR+C8C4kH+aMKCWjYeBC3Q:Us85XKEEwrXW9eB1SRQyreHCJcHojO
                                      MD5:A7A10C7BB2BD779051CCFF43E96C6F44
                                      SHA1:A3EE1EE121BEAD904FA07000C8074283756AC7EB
                                      SHA-256:0E8B318FEB0E212BC5CC449D03D442D16AFE3AA4EC606F1AD08C5A26126612C5
                                      SHA-512:7F50BA8599281BD0ECE68096EF5EC112C731F26C5F31A480C5867D4D3AF81581DE65DD2DBE7705CC9356C15137BED5303DFD69EBE896AA4A74F498C6B16EEB40
                                      Malicious:false
                                      Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.ax......ax.l...#.Y.5.O[.ax.l...#.Y.5.O[.ax..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................!^c..&.....N...^.................Y...8A...............f........................................I.qk..B.....LZ....................!^c..&.................!^c..&...........ax......ax......ax..........................................axj.....axT.]...ax......ax..B...axH.....ax..B...ax..>.).ax..J...................;........4...4...4.."...............ax..ax..ax..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........ax......ax....#.ax............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003K.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):347
                                      Entropy (8bit):6.85024426015615
                                      Encrypted:false
                                      SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                      MD5:78762C169F8B104CB57DFF5A1669D2DF
                                      SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                      SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                      SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                      Malicious:false
                                      Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003L.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.349336745090841
                                      Encrypted:false
                                      SSDEEP:48:07UesJ5dmpItp0dE6xXw9MzdorBrdQqr8inDLdBXZbo98Wkc:07xsVmpIDQEmXw9MzduBRQy84LdDK
                                      MD5:7D795259B2ECA6E696524A652642AD92
                                      SHA1:D79D38AF097321490E06DAD6C08DC14C9C2F72F4
                                      SHA-256:6EB5DBA51F18EDDD39223C497092B54C63C83A7C79BD8CF5AE4AF34DE4DF9514
                                      SHA-512:A82D6B05556E218F1F15D370720CBACBD287907C5890868693A40DBB4ED70BC04FE380C1C3B493F1E5E5D0DBA8FD38F5436B3DDC779BE406617911B2DC738983
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ................".9.<.P........".9.<.P.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............RZ.p...7.B..gD....N...^................!.|<.@...............f........................................I.qk..B.....LZ..............RZ.p...7.B..gD..........RZ.p...7.B..gD........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003M.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):827
                                      Entropy (8bit):7.23139555596658
                                      Encrypted:false
                                      SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                      MD5:3E675D61F588462FB452342B14BCF9C0
                                      SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                      SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                      SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                      Malicious:false
                                      Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003N.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.313626815228004
                                      Encrypted:false
                                      SSDEEP:48:s0esX23L7MtRrPEX24L8X7b9uDoxrdQqrsdxBX9550Vkp:KsU7M/EXnoX7b9uDwRQysPOk
                                      MD5:679F0FCE06F1C55CECACA5C6402E5D45
                                      SHA1:35B25F5E8E91042AA80BFAAABAB8F61B8187E0AC
                                      SHA-256:9C81332454FEAFD1785C54DF7AEE10D4EEE24FB85F728AA2D06EDFCFC9C6493E
                                      SHA-512:59DAF1C7CE28F73F2014F24C8D08F33375861077771E63F3F639761A6E1297465B2B97FE465F8484C5DE49F7BFDA67E00EB6063CE081820A5C4C2409BD16AFA4
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.y.......y.....wD.2....y.....wD.2....y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............k..i....=?.qi.aV....N...^..................`..mL...).e..........f........................................I.qk..B.....LZ............k..i....=?.qi.aV........k..i....=?.qi.aV..........y.......y.......y...........................................y.j.....y.T.]...y.......y...B...y.H.....y...B...y...>.).y...J...................;........4...4...4.."...............y...y...y...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........y.......y.....#.y.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003O.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):4410
                                      Entropy (8bit):7.857636973514526
                                      Encrypted:false
                                      SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                      MD5:2494381A1ACDC83843B912CFCDE5643B
                                      SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                      SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                      SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                      Malicious:false
                                      Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003P.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.279050185208988
                                      Encrypted:false
                                      SSDEEP:48:YuRGvbsLs3dcY5bGtm5EZUncf0LHQIXrQI9+xoKErdQqrxVwkBXnxpuyh1:YUGvbs0RJGsEZnf09XN9+xkRQyQkpKy
                                      MD5:B2D97B5D05393101C7AD974BF9083416
                                      SHA1:1EB309639BC51DFF511AB5FA0899D7069F2E3F8C
                                      SHA-256:B0F836C3CA3E2585C57EA936E377DF83A05435F2F3004DE2D009EDAC993888D1
                                      SHA-512:ABAAAFBD734457EDC6CB38E100F64C5BA2E8DC5467EEEFCD6C0A665013F4CF4088ECBB6987D0DB408214E002DE6FB3D1DF46C6D2F83AE8CF6B4C2C595B63E8F5
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.............r.7_..k`i.....r.7_..k`i.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................dFJa.0....N...^..................e{.J..@G.h..........f........................................I.qk..B.....LZ....................dFJa.0................dFJa.0........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003Q.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):136726
                                      Entropy (8bit):7.973487854173386
                                      Encrypted:false
                                      SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                      MD5:4A2472AC2A9434E35701362D1C56EDDF
                                      SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                      SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                      SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003R.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.335215944341873
                                      Encrypted:false
                                      SSDEEP:96:2sGTs/d19fp+JWEKHpcXmbJY9CVgRQy2T4Hl/QFKEPi6wHOdK:2sG4/d19czAuXmlY9CVgRJ2Tw/QoEPi
                                      MD5:FFBAB486A9FD421D7B0C6FDA030287A5
                                      SHA1:04D8695A52941B0F7514B5A7D0F11794DA6AD0F7
                                      SHA-256:4F4808F70CC76DD932757E10F20A6113EC10AE090769FBA79B63184F3893622C
                                      SHA-512:5183323AD797444C63DD504A6C00EE55D1D8A2DB855696574570B734551AEB1115F32ED0411E6A60A6DD0EA512BDF9E8203BFBD836E1DEA93FC60EB9AC1E8D37
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.P.......P.8(t....=.R.A..P.8(t....=.R.A..P...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............9y..).p.7?.@...?....N...^...............[m\...fB...K.,Y.........f........................................I.qk..B.....LZ............9y..).p.7?.@...?........9y..).p.7?.@...?..........P.......P.......P...........................................P.j.....P.T.]...P.......P..B...P.H.....P...B...P...>.).P...J...................;........4...4...4.."...............P...P...P...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........P.......P.....#.P.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003S.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):5136
                                      Entropy (8bit):7.622045262603241
                                      Encrypted:false
                                      SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                      MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                      SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                      SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                      SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                      Malicious:false
                                      Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003T.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.423335002381969
                                      Encrypted:false
                                      SSDEEP:96:ytUsCbxUJJaAEUXw9KNMRQyoB5Wt6Q86w:6UsCbxUJJUUXw9KNMRJA5Wt6Q86
                                      MD5:AA11A2219DBCC402CEA930E62302DD66
                                      SHA1:80FFEB0610493D1DB7623AC1319C3FBA8653E34B
                                      SHA-256:DFF76EC06965D0108A87D7324F0209B5E36D5D6EA3527A69D17428E4686560BD
                                      SHA-512:F17E788D5C3CEC6177DE641A7FFD7CB4A3CC4789094253D294F3D2E48066A352876FF43DA081BB00D0CF5C66CA5BB75DC0CC72B3C1CF589A3082221EAEE0297F
                                      Malicious:false
                                      Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ7.N.....7.N...........i7.N...........i7.N..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............\..../.;..wD.....N...^.................#1..zF..,............f........................................I.qk..B.....LZ..............\..../.;..wD...........\..../.;..wD..........7.N.....7.N.....7.N.........................................7.Nj....7.NT.]..7.N.....7.N..B..7.NH....7.N..B..7.N..>.)7.N..J...................;........4...4...4.."..............7.N.7.N.7.N..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........7.N.....7.N....#7.N............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003U.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):52945
                                      Entropy (8bit):7.6490972666456765
                                      Encrypted:false
                                      SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                      MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                      SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                      SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                      SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003V.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.4210209986632565
                                      Encrypted:false
                                      SSDEEP:48:zWvHWsX74vtRthQnEbLRXX4XYm9Wo3LZrdqrbWAnBXjjgN2QLEp:CWs0vPmEbmX/9WoVRytnRgS
                                      MD5:15E3588C5672D32099A672CED5149755
                                      SHA1:85D983316EB076D7951221499ACB81F8398FAC85
                                      SHA-256:7544D41DFCD3EB12BB72B4EB580A7A5494FF50EBA50F9624E11D41C842DD986D
                                      SHA-512:5DAE39F058ECA4605382B3F17AFEBAA76D349980A577AE73E56D800A602ADF7121BD73B9D0D0507DCE6CE60EBC401D25B6B96F9EEC0F0B54E3D3D4F32AE4E92E
                                      Malicious:false
                                      Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v...............................................>.&.'K...I.......I.qk..B.....LZ........>.&.'K.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=.....6.......E....N...^......................I.tP...j........f........................................I.qk..B.....LZ............=.....6.......E........=.....6.......E........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000040.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):79656
                                      Entropy (8bit):7.966459570826366
                                      Encrypted:false
                                      SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                      MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                      SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                      SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                      SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000041.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.479507841697745
                                      Encrypted:false
                                      SSDEEP:48:mVsiIa3EQRbM+t3dUhEWniqlCgXyTf2dJg9LqoNrdqr2Z6D5JRXxkYbykH0fYrRz:ks6VRbM+tdMEwXrdG9LqMRy24D5JNH
                                      MD5:48C584442CE64EE17CF727B8D5228D09
                                      SHA1:49E64232034841F589DC1F6056607B461BB640A6
                                      SHA-256:1D78CD8B2260D14DEA6A963B3CF76CFCD33D9BF75311219E2A056C2D20C46806
                                      SHA-512:4259E602C3872B410377A34559D2CB7D615C40C154BEC3A62B1C6D2897C35588BA7B5087B52EB72E6F54BD16315350024211177BD271BA21DB5C16C2AEDD4604
                                      Malicious:false
                                      Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ.........J..Q.8..b.-.~..J..Q.8..b.-.~....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................[`sl.=...m.......N...^...............Y..aH.C..).8.nr........f................................... ....I.qk..B.....LZ...............[`sl.=...m..............[`sl.=...m.......................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000042.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):40884
                                      Entropy (8bit):7.545929039957292
                                      Encrypted:false
                                      SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                      MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                      SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                      SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                      SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000043.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.366935736222218
                                      Encrypted:false
                                      SSDEEP:48:Yu+shrWOrNapUxtemEfM+3XH5C9ZtLoZrdqrvfRXOtfrNRie5kStF:YJs6pUxTEE+3Xs9nLwRyXwl
                                      MD5:3211EBDD1411C63BF47ABE122CAD5C02
                                      SHA1:A49B76C0E390F20AB53499F05581FB8CCCCB05C4
                                      SHA-256:B0541138CF28BA5408C08FC41C1C32FB348B664C05C603A49C6CF8A1DB1B915E
                                      SHA-512:4C33254C02A4FBF9337D6B3927BC11ECEFFB7F0332075B602A425F1F113E15EA57DC2009D928820BEED014A926846DCC5CA3438A6E8803B2EC25514219AA2184
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ........... ...,........ ...,..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............HS.3@.n..9c.3.......N...^..................6.}.D....D...........f........................................I.qk..B.....LZ............HS.3@.n..9c.3...........HS.3@.n..9c.3...........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000044.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                      Category:dropped
                                      Size (bytes):68633
                                      Entropy (8bit):7.709776384921022
                                      Encrypted:false
                                      SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                      MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                      SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                      SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                      SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000045.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.4568194268541905
                                      Encrypted:false
                                      SSDEEP:96:5msjJUySCKGdEg37mXEcXbfc9TZrERyOInkm0Q/:5msjLSrG6g37mXBXb09TxERyOwk
                                      MD5:87800359686BC7BBDA16BAD8E74A542C
                                      SHA1:4E950BF9CE87407F27291AD340DFC3EA6254644B
                                      SHA-256:1F75EE01E131EF9334BD8457FD9DAAA4616876769B7AA3E872A549C579B79EA6
                                      SHA-512:E5B0AD332841621D0A01137BC7576CA1F7886810E75129983929EC1E1EBBFCC0CC4D7BF15E944236323D4DB935AEBEFE083A0E81D5D95113DC58D9A42C973741
                                      Malicious:false
                                      Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZNs......Ns.......Q.....Ns.......Q.....Ns...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............C..w._o.2[!v..3.....N...^.................Z.A..J......m.........f...................................$....I.qk..B.....LZ............C..w._o.2[!v..3.........C..w._o.2[!v..3..........Ns......Ns......Ns..........................................Ns.j....Ns.T.]..Ns......Ns...B..Ns.H....Ns...B..Ns...>.)Ns...J...................;........4...4...4.."..............Ns..Ns..Ns...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........Ns......Ns.....#Ns.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000046.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):11043
                                      Entropy (8bit):7.96811228801767
                                      Encrypted:false
                                      SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                      MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                      SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                      SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                      SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                      Malicious:false
                                      Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000047.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.349838190723826
                                      Encrypted:false
                                      SSDEEP:48:Hwsv+scxtqSEQLBXZG9vLXoNrdqrWYLRXu4F9hZ5:Hws3cxvEQlXZG9jXMRyXL7
                                      MD5:4C59D5090A04773AAFF870909264EDFE
                                      SHA1:3A7B73E3FBAE9211CA3E5EA583290C97734C54AF
                                      SHA-256:B12FDED3EAD35A2E576CF100F26EF8BAAEFD25388F6398E360539A2AC96C760A
                                      SHA-512:6D74855C322967D31855471ABBCFA5DB576F659921B683A7C1C4D943381DC93FAFCA41BB754A33F8DF02F2AE83DC8A35EF769C6A3DEB8118A13D3CA196ABDD7F
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.4.......4.%.6..1.#..%Q..4.%.6..1.#..%Q..4...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............B..R.V....c.9d....N...^...............;.....A....@R.n........f........................................I.qk..B.....LZ............B..R.V....c.9d........B..R.V....c.9d..........4.......4.......4...........................................4.j.....4.T.]...4.......4...B...4.H.....4...B...4...>.).4...J...................;........4...4...4.."...............4...4...4...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........4.......4.....#.4.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000048.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):647
                                      Entropy (8bit):6.854433034679255
                                      Encrypted:false
                                      SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                      MD5:DD876AA103BEC3AC83C769D768AD39FB
                                      SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                      SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                      SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                      Malicious:false
                                      Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000049.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.335322504089309
                                      Encrypted:false
                                      SSDEEP:48:8w6sEu8jxyIV6UtDCEjFL4XVl59b3olrdqrKn/vBRX2IUglcg:8w6sWxnEU8EjFsXVl59b3kRyKnBjlc
                                      MD5:FFF95A646B2240C28BCCD5D0310C1100
                                      SHA1:3AA431A199C8534DAE0C8A28702CB089A16B5607
                                      SHA-256:148795362F0CDB6C4A8CF4A26DFB100C244F71724061C0C2EF647F3858484965
                                      SHA-512:5E15D5F008EA71B5E45227974D5C8FB1667C9CDF09BD8910E573F19D9868C2DEE5B42E771BECF7428197ACBFAC96504E42B1AFAABB3A4362A44A3320EE868D9E
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.,.......,.x.2..?...(...,.x.2..?...(...,...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................R.. .........N...^...............>t.F...M..G..T?}........f........................................I.qk..B.....LZ.................R.. ..................R.. ...............,.......,.......,...........................................,.j.....,.T.]...,.......,...B...,.H.....,...B...,...>.).,...J...................;........4...4...4.."...............,...,...,...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........,.......,.....#.,.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004A.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                      Category:dropped
                                      Size (bytes):52912
                                      Entropy (8bit):7.679147474806877
                                      Encrypted:false
                                      SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                      MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                      SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                      SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                      SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004B.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.289663224583287
                                      Encrypted:false
                                      SSDEEP:96:BYssRJ6UM05EktX39T38RyhTPgeorjbeoqR:BYssf6U4ktX39T38RyhT4eorjbe9R
                                      MD5:DF88AE931C9A4FAE70A4C0FBED3FA9B9
                                      SHA1:4902DAB0291A113C8D3E11DC1C950BC5FD10830F
                                      SHA-256:E1E39AD6455253F47D20781EB539ED93A41C9CB0A285BCD83988A6AC54604528
                                      SHA-512:BA1B979DED44DB3D453DCD6D0CCDBB9215D435B273D00720464C75BB77477C3A53837D0C5807CCBE4576821CE34CE8B7003FAEC3D17E3D5A5420603ABBF91E7C
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........5.."...'...-....5.."...'...-......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............e.J:....&.s.0d....N...^................7s....G.gr.}.).........f........................................I.qk..B.....LZ..............e.J:....&.s.0d..........e.J:....&.s.0d........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004C.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                      Category:dropped
                                      Size (bytes):27862
                                      Entropy (8bit):7.238903610770013
                                      Encrypted:false
                                      SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                      MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                      SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                      SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                      SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004D.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.461161359154362
                                      Encrypted:false
                                      SSDEEP:48:+sENOBoyE+u1RMtVME5zmOXN99XJoFrdqrDiRXcMBgB6NqBkiBDBgBrRBxB1:+srBZ+qkE56OXN99XJsRy+zKxH1KrHn
                                      MD5:F1118594207BE323E024366108539090
                                      SHA1:969A09AACDBDDEFF2A257297E52DE21F7F16C355
                                      SHA-256:1691F1084D8DA8005FD03B6A2A3A56C472477F03ABEF3486377D81DBA25AB407
                                      SHA-512:41704A72351E9B11F5ECF5AEC2249E5D4ABC69A91928972DA4203BE18B8A4CA39C7EDBCF2FE0AD67D778F44A1BB804BAB74CF72E34567735F4E1A5E1C383DA4F
                                      Malicious:false
                                      Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZ...........#H.B.=z"...}...#H.B.=z"...}.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............D.l...........S....N...^...............]d..o..D.....K.........f..................................."....I.qk..B.....LZ.............D.l...........S.........D.l...........S........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004E.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):977
                                      Entropy (8bit):7.231269197132181
                                      Encrypted:false
                                      SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                      MD5:B7F74C18002A81A578A4EE60C407A8D3
                                      SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                      SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                      SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                      Malicious:false
                                      Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004F.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.335701930971071
                                      Encrypted:false
                                      SSDEEP:48:DjAsvEuAyp2RD5Wtt8lE3VpLCWX8/9/TSoZrdqreNYRX5ZC9fyPpX3hspt:DjAs72RD5WzEE3TzX8/9/WARyeYG
                                      MD5:4F40F2BE461A4C2EB2263C5323F775F7
                                      SHA1:7B4973964A6198092CAC15ADDFC6FE437966465F
                                      SHA-256:CA8E2F48BC20B21E314EC512CCC3515C0E2E06C0D758D93FDA6C6259FC6E836D
                                      SHA-512:F6D3F27D3A2C379B669A2E0C544A445E3FCE57D8788D058599FB7E2DA3B5AC4F71DA6D1E621EFBABCBECE3959F54FE93A7154C2855131A18FCD7FF133C4DEAAD
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.............Y......U.......Y......U.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............{x.....;+.tA.:....N...^...............X.o....L..2W6.A.........f........................................I.qk..B.....LZ..............{x.....;+.tA.:..........{x.....;+.tA.:........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004G.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):34299
                                      Entropy (8bit):7.247541176493898
                                      Encrypted:false
                                      SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                      MD5:E9C52A7381075E4EBC59296F96C79399
                                      SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                      SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                      SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004H.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.347136339740023
                                      Encrypted:false
                                      SSDEEP:48:WsLmbdtWOMNtKksXEHSFLhXJYQ9ltZolrdqrU3m8RX0BuZKB:WsLOtpMNUXEyFFX79DZERyULDK
                                      MD5:27758955EB29FA1CEAF8AD8397CD1683
                                      SHA1:C1F920EAD099EC7744CAB3226771F98823C3F78D
                                      SHA-256:71996D7F41D26D1F2DE6784D7C456C8710819CDF7DD181F5FF7A0A9C3BD35FA5
                                      SHA-512:034DA9A13D4609F92AB3AF440442B62084C155F9AB2DB33DE659D2BDD09964F00B09D6F257769CFF6FCF2FEE07B9373ED8C7E42CDE844200C2823C4625B5A30F
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..@.......@.ud`.25.......@.ud`.25.......@..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=...&...:J}E.B......N...^..................S.".C.......-........f........................................I.qk..B.....LZ............=...&...:J}E.B..........=...&...:J}E.B.............@.......@.......@...........................................@j......@T.]....@.......@..B....@H......@..B....@..>.)..@..J...................;........4...4...4.."................@...@...@..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........@.......@....#..@............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004I.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):10056
                                      Entropy (8bit):7.956064700093514
                                      Encrypted:false
                                      SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                      MD5:E1B57A8851177DD25DC05B50B904656A
                                      SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                      SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                      SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                      Malicious:false
                                      Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004J.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.347993628850824
                                      Encrypted:false
                                      SSDEEP:48:ysXwZaKbNnttNbEXh2aLFX919LzKo5rdqrQvURX5RwXRK8u:ysCbNntbEfBX919LzK4RyQMSK
                                      MD5:473BB948350C7B4372934E2229BE823E
                                      SHA1:DA553F9E0D09E49B5BE171C662A8278F4F73ECEE
                                      SHA-256:CFBB15FDE30DDF91F930934260FEE82CE1F38ABF34D2AAA76319C3895D2FD9BD
                                      SHA-512:8DD0E51BA9D35235BCEC2F367E53AEF304A34C239C6846371646F4C8CA93012EA67606BD402B945C14043DE6DDC6044FC5FF8EF3D0D3CF16336BE19F6C107ABF
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ6o......6o.nD...$xw..1..6o.nD...$xw..1..6o...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............e..;t..%.[.S..+....N...^...............D].G...N..`,............f........................................I.qk..B.....LZ.............e..;t..%.[.S..+.........e..;t..%.[.S..+.........6o......6o......6o..........................................6o.j....6o.T.]..6o......6o...B..6o.H....6o...B..6o...>.)6o...J...................;........4...4...4.."..............6o..6o..6o...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........6o......6o.....#6o.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004K.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                      Category:dropped
                                      Size (bytes):84097
                                      Entropy (8bit):7.78862495530604
                                      Encrypted:false
                                      SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                      MD5:37EED97290E8ECB46A576C84F0810568
                                      SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                      SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                      SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004L.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.297369932694852
                                      Encrypted:false
                                      SSDEEP:96:XsBgh2WAE+Xxbl9XWQRymOMFNHT4FBcm:XsBghD+Xj9XWQRymnFNHT4FOm
                                      MD5:8D6771EF9F0B780C45B3DA10217DB9E0
                                      SHA1:4BBA29B08F650D6D6FE400D360BC3FE6EB5524CE
                                      SHA-256:1CAEF8533BE0AD5C0E39EA341D8BA6F36F50408E845ED638B5B2B970CEBC2771
                                      SHA-512:3363574711303C602DE31F8AE6A0BFC34C5CBA6315F2E4417529152BF2D86BCFE3065071A504114AC757E5DD16AE96438BBB2AB85FCF2755A0E68A193DA38F24
                                      Malicious:false
                                      Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZ.L?......L?.i.*....AE..~.L?.i.*....AE..~.L?..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............X.. .i.....3,U.....N...^..................8.#!L......,........f........................................I.qk..B.....LZ.............X.. .i.....3,U..........X.. .i.....3,U...........L?......L?......L?..........................................L?j.....L?T.]...L?......L?..B...L?H.....L?..B...L?..>.).L?..J...................;........4...4...4.."...............L?..L?..L?..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........L?......L?....#.L?............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004M.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                      Category:dropped
                                      Size (bytes):64118
                                      Entropy (8bit):7.742974333356952
                                      Encrypted:false
                                      SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                      MD5:864EEA0336F8628AE4A1ED46D4406807
                                      SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                      SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                      SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004N.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.347334407941662
                                      Encrypted:false
                                      SSDEEP:96:is8i7tPLyjjEpXTj9jUQRyv7b87QhqYFAGp:is8i71LKQpXTj9jUQRyzw7gqYFA
                                      MD5:FE8FBAF8C52A4C226F2B797599370DA1
                                      SHA1:EEB68F5CE0051E2787C67721083D1B2C9ACF411F
                                      SHA-256:18AC9DE79F437377EFE93FBB7C6D66A554ED85F64FFC936D02FCB674A1A2203D
                                      SHA-512:842D4ABE87CB74F5D987E0B4D88A1EB594AF9A01ECB10B441B1D4ABC9EE2AE0E9F7254964FD90CC4781C6691095DCF1DC960D17EF6A89B602BA7BD550823D506
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZDI......DI......|+.=...DI......|+.=...DI...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............E..oY.7....SqN....N...^................\+f[8.G../:w...........f........................................I.qk..B.....LZ.............E..oY.7....SqN.........E..oY.7....SqN.........DI......DI......DI..........................................DI.j....DI.T.]..DI......DI...B..DI.H....DI...B..DI...>.)DI...J...................;........4...4...4.."..............DI..DI..DI...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........DI......DI.....#DI.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004O.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                      Category:dropped
                                      Size (bytes):65998
                                      Entropy (8bit):7.671031449942883
                                      Encrypted:false
                                      SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                      MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                      SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                      SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                      SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004P.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):3.2547258745815197
                                      Encrypted:false
                                      SSDEEP:96:isE5Gl5b+WEcgqy8XtA189TG14q0oR0PqwDc:isEGl5Kc48XG189TXoR0Dg
                                      MD5:5ABA4E32AA64C3DD23A0992E6278244A
                                      SHA1:1FA362A66EA29DCD092C1D2D16E1BEC46B5FA55C
                                      SHA-256:67CCE17744ADD77B062197C4C2A87D69D60E7390B761947D723DE4483BE87248
                                      SHA-512:CD877BB225DB69E510B6AC9AF2FC1713BA47D516DF6C541FE7779CA7C356AC79115766987C145391CB6A15669B163C1C4B2B8F4B44B501D75627E2A9A13B28DC
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>...j.......v................................I.......I.qk..B.....LZ.........~..~..~...q...~..~..~...q.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=^1..`......H.5....N...^................E..^22@................&...................................>....I.qk..B.....LZ............=^1..`......H.5........=^1..`......H.5....................................................................j......T.a............D....H........N......?.#...9...................;........4...4...4.."........................z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4......................#..............................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004Q.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):32656
                                      Entropy (8bit):3.9517299510231485
                                      Encrypted:false
                                      SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                      MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                      SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                      SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                      SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                      Malicious:false
                                      Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004R.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12824
                                      Entropy (8bit):7.974776104184905
                                      Encrypted:false
                                      SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                      MD5:2628353534C5AD86CBFE57B6616D46DD
                                      SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                      SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                      SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                      Malicious:false
                                      Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004S.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):32656
                                      Entropy (8bit):3.9517299510231485
                                      Encrypted:false
                                      SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                      MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                      SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                      SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                      SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                      Malicious:false
                                      Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004T.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12824
                                      Entropy (8bit):7.974776104184905
                                      Encrypted:false
                                      SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                      MD5:2628353534C5AD86CBFE57B6616D46DD
                                      SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                      SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                      SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                      Malicious:false
                                      Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004U.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):32656
                                      Entropy (8bit):3.9517299510231485
                                      Encrypted:false
                                      SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                      MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                      SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                      SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                      SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                      Malicious:false
                                      Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004V.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12824
                                      Entropy (8bit):7.974776104184905
                                      Encrypted:false
                                      SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                      MD5:2628353534C5AD86CBFE57B6616D46DD
                                      SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                      SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                      SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                      Malicious:false
                                      Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000050.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.326544245605176
                                      Encrypted:false
                                      SSDEEP:48:YuusgsAZu5VJk1UStPONcEya7NOLXzccL9/kjdlrd3rRxORX09LVJ:YzsgsvEyS5OCEyaROLXzccL9/kXRbiI
                                      MD5:88023CA8ED1FE41DFFE0E904BDFDE5A0
                                      SHA1:D1D169A082633A28E6C6834B04758BBA1986D21F
                                      SHA-256:56FBEB337B104394097D0A5810C20E06B44B171B0EB436C8AECED11ED2D200AE
                                      SHA-512:AC95D81452E95387268C3D06F59B6D4504BB64A1B1CECBBD3A1ACAC8BAF7BAD939BF2E2C7811EC280F0069C8EAE876FB011B79D6006AF24B3CE95E240B74842D
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.....................svI.............svI.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............-..1.1...R._...~....N...^...................XH.@.B.q.I.........f........................................I.qk..B.....LZ............-..1.1...R._...~........-..1.1...R._...~........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000051.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):39010
                                      Entropy (8bit):7.362726513389497
                                      Encrypted:false
                                      SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                      MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                      SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                      SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                      SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000052.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3717233558774
                                      Encrypted:false
                                      SSDEEP:48:zWesx7cTx4teBEr+sdXzo9E7j4vlrd3rQxnHdXUCY2qGB:FsqTx44EndXk9E7wRbEUG
                                      MD5:C15B81931DA73ECC63170EDF23BC6DE3
                                      SHA1:4A93EC63D17147452F7B1F8F0893B28079074915
                                      SHA-256:6C6046E1D88AA1065C6981D878F98E6DCF9A0ACD1BFC524EEB33215AFC321F80
                                      SHA-512:EF4C4C89E42B8C5B790852A17A72674874E9E58C48839E493155AB317E016CDF50EE57F764A01A3B9C05CF9EFDE9A8FEC6C43ABD57AC2A854AD91FD268878FB3
                                      Malicious:false
                                      Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ|aD.....|aD?c....u.N..Z|aD?c....u.N..Z|aD..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............=i.Jp..&...+Up;....N...^...............`g4....K.....^p........f........................................I.qk..B.....LZ............=i.Jp..&...+Up;........=i.Jp..&...+Up;.........|aD.....|aD.....|aD.........................................|aDj....|aDT.]..|aD.....|aD..B..|aDH....|aD..B..|aD..>.)|aD..J...................;........4...4...4.."..............|aD.|aD.|aD..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........|aD.....|aD....#|aD............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000053.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):25622
                                      Entropy (8bit):7.058784902089801
                                      Encrypted:false
                                      SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                      MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                      SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                      SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                      SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000054.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.354474887467266
                                      Encrypted:false
                                      SSDEEP:96:YNs7DgTTyttEmgXU9gtWgRb8mKwgv+HJr:us7DgTTyImgXU9gtWgRb8mKwgv+HJ
                                      MD5:9B395AE4F241CB22C4E963A54A69BE15
                                      SHA1:B41944122F3557492E2444DA625BE7D69F7DBC52
                                      SHA-256:69FEC2DB5931A5F0D921B9EFBCB697E96BD02038298AB6D69046849A12914E84
                                      SHA-512:A8704BF0CCD44D832D6727105A365CF8963916DE71868001DB9A331A726ACCAF6B1A2621A054E9868DE6B68AB1F5D42CB454A90005E34A3C6B6B8691E0E3557A
                                      Malicious:false
                                      Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZY......Y.g....J....0Y.g....J....0Y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............uf.U^6x..`...W......N...^................V. .6*L..3.&.K.........f........................................I.qk..B.....LZ............uf.U^6x..`...W..........uf.U^6x..`...W...........Y......Y......Y..........................................Y.j....Y.T.]..Y......Y..B..Y.H....Y...B..Y...>.)Y...J...................;........4...4...4.."..............Y..Y..Y...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........Y......Y.....#Y.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000055.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):2033
                                      Entropy (8bit):6.8741208714657
                                      Encrypted:false
                                      SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                      MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                      SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                      SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                      SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                      Malicious:false
                                      Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000056.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.232205307201387
                                      Encrypted:false
                                      SSDEEP:96:8hswK4qYUWTjE82Xb9GbNkRbek4xji5k8M:Ksxnh82Xb9GbNkRbexb
                                      MD5:576298A526ACA9833A66846B87933FB2
                                      SHA1:C2B7E906F0E3D85957438B34955B674B894E68D9
                                      SHA-256:CDE3A450312B2744F65AE08C096270A6EDB0245328E107A91C06E3EE53669847
                                      SHA-512:9A1D6F004F5F9AB71253945488D6C1FCDD43DCE24E9D4CC4F2FE598624F312B6C949CB75CAF9814F39B7A5D4397FE9079831C7609F91E5A1E45B5E4DC280224F
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v...........................-p......-p.$N?...(g..r...I.......I.qk..B.....LZ-p.$N?...(g..r..-p...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............R...v)...G+X?.......N...^...............j.>.bRL.j.c|...........f........................................I.qk..B.....LZ............R...v)...G+X?...........R...v)...G+X?............-p......-p......-p..........................................-p.j....-p.T.]..-p......-p...B..-p.H....-p...B..-p...>.)-p...J...................;........4...4...4.."..............-p..-p..-p...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........-p......-p.....#-p.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000057.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):55804
                                      Entropy (8bit):7.433623355028275
                                      Encrypted:false
                                      SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                      MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                      SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                      SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                      SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000058.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.473254365603751
                                      Encrypted:false
                                      SSDEEP:48:nMsxrsGN9Gxgt7RBW9EbzRXxBP9EDj4OmlrdMrToPYdX5gWwkPeFxPrWJHNX:nMsxuxg1RB2ERXxR9EDqlRM8YOx4
                                      MD5:6BB0B5BCCB5DC1483FB72BA955C66776
                                      SHA1:83BEA31C567E56347D56411EC46E610060E4E630
                                      SHA-256:099BCD33AC9CA9E291339EB9FFDAE81D50DF2B78E0CCCD0AA3FF3F9F3D04C4B0
                                      SHA-512:4BBC567498C4B9383A3ED24F4BB7E621760DF712F07AEF72648BD71C7FB961C6CEA9537F2C14D1FF594B7CCC57218EA14580BE9B9986DF167A537C5009B3B731
                                      Malicious:false
                                      Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.............4....(v..'".....4....(v..'".....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................v.... .....9.....N...^...................ey.I...u..-........f........................................I.qk..B.....LZ...............v.... .....9............v.... .....9.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000059.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                      Category:dropped
                                      Size (bytes):59832
                                      Entropy (8bit):7.308211468398169
                                      Encrypted:false
                                      SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                      MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                      SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                      SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                      SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005A.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3414886611855055
                                      Encrypted:false
                                      SSDEEP:48:3s48A4qs2ktQXdtUEQ2b8XEaBc89eoe7j49rdMrK5dX3YCgEZaEg:3sPtQXdWEmXtf9eo0YRMeZuE
                                      MD5:4ECE277AD18E37C01B621FD79FF73CBB
                                      SHA1:47D55369BE2A3B3EFB740B7460973E83141B22A2
                                      SHA-256:62D0C34F2156E332FAC25A4AB22D53E3466DE8C3DED04DDAA706EDE357C39E1E
                                      SHA-512:1FB4AF961D32FDB1C8620302CC50E7AD809101A24B060753482CEF2808FF1F6DF29EE44ED265BCB311342CCEB272D589B1CC43250D0A909C4B862B7DADECC88B
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ7.......7...W....A..-..7...W....A..-..7....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............._v.N....(-...e......N...^...............).m<2k.O.&.^..T.........H........................................I.qk..B.....LZ............_v.N....(-...e.........._v.N....(-...e...........7.......7.......7...........................................7..j....7..T.^..7.......7....B..7....C..7....>..7....|..7.. .3...................;........4...4...4.."..............7...7...7....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........7.......7......#7..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005B.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):33032
                                      Entropy (8bit):2.941351060644542
                                      Encrypted:false
                                      SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                      MD5:ACF4A9F470281F475EA45E113E9FB009
                                      SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                      SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                      SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                      Malicious:false
                                      Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005C.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12180
                                      Entropy (8bit):5.318266117301791
                                      Encrypted:false
                                      SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                      MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                      SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                      SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                      SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                      Malicious:false
                                      Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005D.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.329226941588233
                                      Encrypted:false
                                      SSDEEP:96:i1sepd2Km6SYIg1EsAowTcXPsgHc9UP9RMqRa:gseHbm6SR/sAowTcXEQc9UP9RMo
                                      MD5:CB53AD8F059330D822D773F07EA705D2
                                      SHA1:BE5AE8C49B71A7FE9CBFE031E46DF0D4B3AA5BA8
                                      SHA-256:1648160B9927089CE7D0B6373A2462381072DA03EF06093A027CCAE571060BC6
                                      SHA-512:FA954E3C7591B098B25F4E7EE12C93DBFADDF508A472ACA50726C421A1874AB100BDB8AF013D2F1735FA2A2A32678BDEF34CD61FAD1EE28D68C6C3AA26C9608E
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z.........................................I...J.'N"!.I.......I.qk..B.....LZ......I...J.'N"!.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............!e.9...)..I%......N...^...............N...ghM..l39@..........f........................................I.qk..B.....LZ..............!e.9...)..I%............!e.9...)..I%..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005E.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):2104
                                      Entropy (8bit):7.252780160030615
                                      Encrypted:false
                                      SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                      MD5:F6C596F505504044DF1E36BA5DA3F09B
                                      SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                      SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                      SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                      Malicious:false
                                      Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005F.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.350971356009752
                                      Encrypted:false
                                      SSDEEP:96:OsR7groQE2cIX+dI9xNcRMViianyXn3k:OstgryvIX+dI9xNcRMVNanyXn
                                      MD5:EF8EFCEE9D13AB6EEFEDEF056065F6EB
                                      SHA1:C73BC3DDE19A43D31EDC1E2635E6C4C1270E8396
                                      SHA-256:8A5D609DEF67B4D7B28B172683DAD24E26F500D3EE5763D566406BD0A378F2BE
                                      SHA-512:D79377DAEBE04AD89551D90EB6689EE322581842D33903868AA4F4D1BC55CC55E8B8D885EE92CAA55ECB7B805960F60D7F6CB467D8D64E9CE3EE7987CBE0ADA5
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|........................................,e.......b..I.......I.qk..B.....LZ.....,e.......b......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............V.C....."W.n.......N...^...............7.....J.R..s...........f........................................I.qk..B.....LZ.............V.C....."W.n............V.C....."W.n...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005G.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):14177
                                      Entropy (8bit):5.705782002886174
                                      Encrypted:false
                                      SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                      MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                      SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                      SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                      SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005H.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.3479786443337405
                                      Encrypted:false
                                      SSDEEP:96:L0sD2h89V6Lg9qjykhEQtXQ59JFDMRMfMBc8f8sHtbuBtek:L0sD2h89YLg9xjQtXQ59JF4RMfMBc8fk
                                      MD5:C7EF90C8A55CF8F820DCE700E4A3F1C1
                                      SHA1:1DE4FF25AB8D9C9C0E62A1CE65F9C65EFD5F15F3
                                      SHA-256:D3C71544C08B87A64565E877838ECDECBBC31078954C3E53A425A88D234586AA
                                      SHA-512:A7670623AFEA1E340A0464E5AA512C094821F76880E3FF48E73E56CFFDD2E0D282AC87427E8231D245FA9E2424604CFC1C8650E6AEA7CBA02564F799F878F3DC
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ#.......#.......8.2.*O.A#.......8.2.*O.A#....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............J................N...^...............S.?....F.8..V.H........f........................................I.qk..B.....LZ............J....................J.....................#.......#.......#...........................................#..j....#..T.]..#.......#...B..#..H....#....B..#....>.)#....J...................;........4...4...4.."..............#...#...#....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........#.......#......##..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005I.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                      Category:dropped
                                      Size (bytes):36740
                                      Entropy (8bit):7.48266872907324
                                      Encrypted:false
                                      SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                      MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                      SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                      SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                      SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005J.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.379744473953329
                                      Encrypted:false
                                      SSDEEP:48:hsY4bxjkHkjMthPmELLYdX6lpa9BssDpy5rdMrrHuzpEFX+hkSdhKsg:hs9xjkHkIOELoXv9BZcRMrOC2As
                                      MD5:63CED3F8B0BAD4EC811AA5F99CCA7A03
                                      SHA1:D66EA7DE288ECC79AE0FEBB9A262DAC77A7B68E8
                                      SHA-256:875A406F3D2073C084BCACC784AA698FD0CB489B7AAAD8E8C64836E1E2300EF0
                                      SHA-512:E5221516CA6F160D47056DE6A326F64433CB87E2FE0638A08B80E069C7265F5FEA931BD14B7B5595902D9DEAD820E628A8F26021832490DA644E05F9E6210F91
                                      Malicious:false
                                      Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ.............-..=h0 <"TN.....-..=h0 <"TN.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............^.t.ZN........'p....N...^.............../V?...I....sa.........f........................................I.qk..B.....LZ............^.t.ZN........'p........^.t.ZN........'p........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005K.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):53259
                                      Entropy (8bit):7.651662052139301
                                      Encrypted:false
                                      SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                      MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                      SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                      SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                      SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005L.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.318576518184481
                                      Encrypted:false
                                      SSDEEP:48:5ksztdLs14FItWZMZEXDJXeXSsiT8P9RsLJpyLlrdMrhU6k8UFXFNP1YoLE+//F:2sLzFI0ZoEXgXSsy8P9R4JqlRMq8UZH
                                      MD5:951534BA80023E8CA4A34FD5CBC5184D
                                      SHA1:876AA2D792A5CE5A20722758B2038938BFB6A835
                                      SHA-256:38F1CD59C35BAC16A7AAC23BC9C5BE944D0F2150E7262633D992ED203EF32EA9
                                      SHA-512:C7E325CB7FD75F784AB5834B6E6F952C04C76E10DDBB7DEC5361702C79F95BEF2ED71CE1EAB2603534299014733CC236220253B4A9417E94A477B0CCB276B784
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.'.......'.nS.n."\.Qp.Hi.'.nS.n."\.Qp.Hi.'...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'....................8..m..@.....N...^...............M"..iKF.L..n..........f........................................I.qk..B.....LZ...................8..m..@................8..m..@...........'.......'.......'...........................................'.j.....'.T.]...'.......'..B...'.H.....'...B...'...>.).'...J...................;........4...4...4.."...............'...'...'...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........'.......'.....#.'.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005M.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):60924
                                      Entropy (8bit):7.758472758205366
                                      Encrypted:false
                                      SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                      MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                      SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                      SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                      SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005N.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.334749232064487
                                      Encrypted:false
                                      SSDEEP:96:Es+HNKRacEjX7k9JZeURM82d1tTCdejs:Es+tKR4jX7k9JZeURM8
                                      MD5:692A8D4AB838D5A58FCC3B6915DE5E8A
                                      SHA1:854E1F88DCA9EF5B951A208213A5873BF9FC9624
                                      SHA-256:E5BFE8528AD04AD54DF1E2609360D64225DADEC5005F3DA3D9A8EB92355A1E1D
                                      SHA-512:6F767F7BE2B1FAFAE2A36A80ACD555ADA18C8C3BBCD019346102572B7E1C974DD894271705E90F635CDE02D6867E4CFEC98DF9E178EBB8268144FA973EC19DA1
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZG.......G.......71.^...@G.......71.^...@G....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............._`.... .6Mu.......N...^...............L.....A................f........................................I.qk..B.....LZ.............._`.... .6Mu............._`.... .6Mu............G.......G.......G...........................................G..j....G..T.]..G.......G....B..G..H....G....B..G....>.)G....J...................;........4...4...4.."..............G...G...G....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........G.......G......#G..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005O.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):515
                                      Entropy (8bit):6.740133870626016
                                      Encrypted:false
                                      SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                      MD5:E96BE30D892A5412CF262FEE652921CA
                                      SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                      SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                      SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                      Malicious:false
                                      Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005P.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.362518953107034
                                      Encrypted:false
                                      SSDEEP:96:2s+xtp55dPEP3XQdi9pY0RM7/ILbcqMbr2WI:2satpfGP3XQU9pY0RMrI
                                      MD5:368201BBCB79926A60DC271C3A8D4CE6
                                      SHA1:37C3C39A4EDF384D46C5BECF423C8C86E494FC62
                                      SHA-256:F9E995E84E1749BFFED61B5CCD10578CB6FD091A0FE748DD1F52EBC5094A0028
                                      SHA-512:4BC9CB4BCAC7D195E18EDCDB65ABD99AA406748276B7B7E89EAB443C1D09E5A077ABC08CA387EDE34E8C4AD7227B9366CE6644E941D8259E06E5E29EB5E28174
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.KG......KG6.&9.(......KG6.&9.(......KG..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................x...?Y.V...G....N...^................p...A.....Z.f........f........................................I.qk..B.....LZ................x...?Y.V...G............x...?Y.V...G..........KG......KG......KG..........................................KGj.....KGT.]...KG......KG..B...KGH.....KG..B...KG..>.).KG..J...................;........4...4...4.."...............KG..KG..KG..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........KG......KG....#.KG............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005Q.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):1547
                                      Entropy (8bit):6.4194805172468286
                                      Encrypted:false
                                      SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                      MD5:0BA36A74DFBF411FAB348404CCEC3348
                                      SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                      SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                      SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                      Malicious:false
                                      Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005R.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.324023969212709
                                      Encrypted:false
                                      SSDEEP:96:WsqhN9JXz4autEJXb9WnoTgRMney2JA/eH:WsyJXz4LKJXb9G6gRMnf
                                      MD5:1EFC82C67E3E2445E6743A4AC59DD5CB
                                      SHA1:DED84DB7930F22F4EC337A97907C84315A9E7042
                                      SHA-256:7EFE82E5BC404C2CD896E47DE946DE8FD606802A02CB4C73DFC64A9555668500
                                      SHA-512:14EBABA6CA55648169819C935106F41067EFEDC7C8C6C373F43D4EF723D3B2153C8F40B442C2A6434B902EE9C638BF5E90F97E71227D8574F96EBECB7DE97027
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ8.......8.....X.......N.8.....X.......N.8....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............C.Pd9.....*.0.....N...^................;.D..I.K...*..........f........................................I.qk..B.....LZ............C.Pd9.....*.0.........C.Pd9.....*.0..........8.......8.......8...........................................8..j....8..T.]..8.......8....B..8..H....8....B..8....>.)8....J...................;........4...4...4.."..............8...8...8....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........8.......8......#8..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005S.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):95763
                                      Entropy (8bit):7.931689087616878
                                      Encrypted:false
                                      SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                      MD5:177DD42CA99CAA2CCBF2974221680334
                                      SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                      SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                      SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005T.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.334261046736482
                                      Encrypted:false
                                      SSDEEP:48:uslr1oeNXqn0t/hnEyLg0eWXVIW9r1UxpyBrdMriNmFX/FpNKNsEZEou:usbDqn0bEy0fWXuW9rGxERMTAmo
                                      MD5:3CE73FD0EB6CFB6CCB51F636A599E55C
                                      SHA1:60DDFDEDAA11CA559D854CA7351C829997ABC766
                                      SHA-256:8B3E5A63250DBC4FF4956138A33B5AE8946B28FFAA99B006C487A0EE65830FBD
                                      SHA-512:6F33E77316FE4EDF09EE91C61EC825ED55266164E650A6309BF2728EF881BFCEF806CF4BE576DEF80355750BE72AF5A4E9A94B50FE3BE4D2747FC0E314B2E86A
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........#.nD..-w/;x.....#.nD..-w/;x.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............I....&`.8...N8.d....N...^.................o.~..A..pQ.z.$........f........................................I.qk..B.....LZ............I....&`.8...N8.d........I....&`.8...N8.d........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005U.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):67991
                                      Entropy (8bit):7.870481231782746
                                      Encrypted:false
                                      SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                      MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                      SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                      SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                      SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005V.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.32484260755133
                                      Encrypted:false
                                      SSDEEP:48:gsiO/IrEJto1qdrMhIEvlL6rX0tLydrO9VUupyRrdMr7k/JCEFXstc9iTEJd:gsxIIJoqdrGIEdsXHdrO9muERM7EAEr
                                      MD5:61804151D3F91299958C2DA991291A11
                                      SHA1:CB4B18291C3CF3E55B288E2EA2DB96F1A8C3F977
                                      SHA-256:A2486D257F980027521C0082FB84851ACAD71DAA72F9AC7DCE1975AF801E8F50
                                      SHA-512:228290EC4EF25579FE0EC1D601D1CCA502263396DACD7CEAAC73D3BD93BA7C83EAD4A7A06AD36FA414A39EF0D2B142196A297A3642FAD507C38E2C7D483898CF
                                      Malicious:false
                                      Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........(......[.......(......[.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............2..D.l..H..(.e....N...^...............$ps....C....h..+........f........................................I.qk..B.....LZ.............2..D.l..H..(.e.........2..D.l..H..(.e........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000060.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                      Category:dropped
                                      Size (bytes):22203
                                      Entropy (8bit):6.977175130747846
                                      Encrypted:false
                                      SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                      MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                      SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                      SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                      SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000061.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.429591859247591
                                      Encrypted:false
                                      SSDEEP:96:hsYrbuV/MK1EDYXxV9CY4RMu7LRfPiRObox:hsqmjCDYXxV9L4RMu7C
                                      MD5:4D9C0750492064B230673C98CDB31471
                                      SHA1:50D0F3D070232CFD0B192DCEFF1F104F758AE7EC
                                      SHA-256:DB7483E3BCB10A53CDC412CC673CEAE1A2FC106E14F0DA16E46C0EDB0417606A
                                      SHA-512:C6705D6E6F7EB3BC3E2F3E72F4DAB19C8081A41E56173F1B42F31C7B3B987C975917937D195353DEBD3FE80B1D293D303C0934ECD304D46BDB35F51E9931AAC5
                                      Malicious:false
                                      Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ.........k-@{..._..W60..k-@{..._..W60....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................~......=.cY....N...^................$.LI..D..............f........................................I.qk..B.....LZ.................~......=.cY.............~......=.cY....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4......................#..............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000062.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):15740
                                      Entropy (8bit):6.0674556182683945
                                      Encrypted:false
                                      SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                      MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                      SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                      SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                      SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000063.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.334728715210755
                                      Encrypted:false
                                      SSDEEP:48:x2TBsXJqwiJiJbsMIEgtpqlmrEAkLxEjnXPz9xUvxpyPlrdMrEkpU0vFXHd7JiXM:+BsKM3gv/Ej6nXL9yJOlRMEk3VR
                                      MD5:CD797236935129076A5DE5429A2BBB85
                                      SHA1:0042584CA096FB6F881C9F6FAD9541D5A329DEAC
                                      SHA-256:7AC3C7F3FE07111663E7E0499E23D44954D5B20DC427D24D842647BDE58826C4
                                      SHA-512:E83991422870146156A6F0462B463C450197A61C7B8BF41AB2EF51F2339E4BE22673DF2965E9C2E097877A395951AEABA96FE4B3E4E01F7393FFA10722EEFE19
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZks......ks....o.(.%....dks....o.(.%....dks...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............nC,..........V......N...^...............K9.....K....).;.........f........................................I.qk..B.....LZ............nC,..........V..........nC,..........V...........ks......ks......ks..........................................ks.j....ks.T.]..ks......ks..B..ks.H....ks...B..ks...>.)ks...J...................;........4...4...4.."..............ks..ks..ks...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........ks......ks.....#ks.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000064.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):86187
                                      Entropy (8bit):7.951356272886186
                                      Encrypted:false
                                      SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                      MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                      SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                      SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                      SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000065.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.665735176309732
                                      Encrypted:false
                                      SSDEEP:96:YseWnfPT9rhEtUnJ5XjQ96JURMtjxy59WoFu59w/Ec:YsdnfP1+KJ5XjQ9yURMRxr0
                                      MD5:1F5EF0E75FAAC319763E01D09105A89A
                                      SHA1:31E8C60293DA88CDBA61F682B24FCA69ED3AE4AA
                                      SHA-256:EF3EE26403C09E58419A707CF7D05AE1A76C33D07BB8452993997AB1E691FAF6
                                      SHA-512:BA7C658BEA2517FCA65EC0D8DB65971FEDA31E8A0687DE9D86C5C0E35DBFE176691C900BF75D9CF8CF5851D6C34025B6142D04E7F0BD1B4D47504A6748C6E6AA
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ.l.......l.t+.i.;...e..q.l.t+.i.;...e..q.l...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............dd..^..6d.S.?>....N...^................BYz.PA..=...".........f...................................H....I.qk..B.....LZ.............dd..^..6d.S.?>.........dd..^..6d.S.?>..........l.......l.......l...........................................l.j.....l.T.]...l.......l...B...l.H.....l...B...l...>.).l...J...................;........4...4...4.."...............l...l...l...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........l.......l.....#.l.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000066.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):11197
                                      Entropy (8bit):7.975073010774664
                                      Encrypted:false
                                      SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                      MD5:DDC3CC30794277500EFE4BC6667EC123
                                      SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                      SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                      SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                      Malicious:false
                                      Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000067.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.31991611080456
                                      Encrypted:false
                                      SSDEEP:48:2sY/as8wxPwt6VgrElLrsXeRK/9vCWUtpyRrdMrmeKIXFXzDP/S2ccp6ZBPK/S2V:2s2PwMyElEXw09vytcRMNJVSR7vKJh
                                      MD5:916C97DEB8FC71F58823BEBACC0B4BBD
                                      SHA1:2A75C6AD5D66D9306A52309525DF01F615494987
                                      SHA-256:C3C02C4D1278D7424BC3FB03228DF701A9DD5F2986EEEC432E042C70AA664F4E
                                      SHA-512:BB16975FA47F7842AB5757FB28EB8D24DA6360B66083276BF71D48B013B4FF586BA94C413172EA6855C43275F5427444E5C9F07B898CF3157EE5B657B51416EC
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.U.......U..-...:1..2.o..U..-...:1..2.o..U...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............x.......:.#..?Ek....N...^....................^vM..7:...........f........................................I.qk..B.....LZ............x.......:.#..?Ek........x.......:.#..?Ek..........U.......U.......U...........................................U.j.....U.T.]...U.......U...B...U.H.....U...B...U...>.).U...J...................;........4...4...4.."...............U...U...U...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........U.......U.....#.U.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000068.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):19920
                                      Entropy (8bit):7.987696084459766
                                      Encrypted:false
                                      SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                      MD5:1BDAD9B3B6DE549162F9567697389E1C
                                      SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                      SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                      SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                      Malicious:false
                                      Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000069.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):2.9131586733746055
                                      Encrypted:false
                                      SSDEEP:48:JsV+u8EiVuXtu5/E1Lc9NVSL6MhwIKXD5K9ps+pylrdMrH3iFXgxXzwuY9:JsiTuX8E16N0f0Xo9pLYRMHSUE
                                      MD5:B8F3CA508A2C836973CF6AFFE8501979
                                      SHA1:278D3BED0002DB617D0F168D1C9FD8F6CCF41DCA
                                      SHA-256:5D775E96A063CD04A8666C156D936B784590FD36E6EAFC0EF1CBCD1247BCF50A
                                      SHA-512:1BF4D202899B47AC834CA122BF204A249B5BA56FC0D76869D14F20642A3AEE5C841ECCB18930FC42530E0A1C4C05594D395A46717623FE2C4C56E6B6DFCFBAFA
                                      Malicious:false
                                      Preview:2...>...........v.......................................................................................................................................2...>.......H...v................................I.......I.qk..B.....LZPZ......PZ.k.e..?p..w.+^PZ.k.e..?p..w.+^PZ...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................{....5...p....N...^...............o`.O...D.!..,.>.........f........................................I.qk..B.....LZ................{....5...p............{....5...p.........PZ......PZ......PZ..........................................PZ.j....PZ.T.]..PZ......PZ..B..PZ.H....PZ...B..PZ...>.)PZ...J...................;........4...4...4.."..............PZ..PZ..PZ...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........PZ......PZ.....#PZ.............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006A.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):179460
                                      Entropy (8bit):7.979020171518325
                                      Encrypted:false
                                      SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                      MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                      SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                      SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                      SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006B.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.358008746224462
                                      Encrypted:false
                                      SSDEEP:96:ysJS1PA/FJmpEFpXzFJm2p9JsURMjmq0ZSg:ysJS1ormWFpXzrm2p9JsURMjmq0
                                      MD5:C79693BC28C9FF2D9BCB6FD7EF5DFA89
                                      SHA1:F2AD8F8F2E70D593BCB285B3DBF28D1ECA7DFDC2
                                      SHA-256:C18FBE66FA4068329080512F7980D0C93B825BFA1E258B630FE2DF9A3E5F3E0D
                                      SHA-512:6AD9930E09801E5AA85A22F6169496E625BD24546AF60C51634386B39E6BE88CCCFD632FDBA9A1FE359C04CD0234A6A93F76A7A1B66332F50DB6BFEF68AD249E
                                      Malicious:false
                                      Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ`.~.....`.~2..]...Y..XC`.~2..]...Y..XC`.~..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................@...].?.LA.....N...^..................e.o.J....6..........f........................................I.qk..B.....LZ.................@...].?.LA..............@...].?.LA..........`.~.....`.~.....`.~.........................................`.~j....`.~T.]..`.~.....`.~..B..`.~H....`.~..B..`.~..>.)`.~..J...................;........4...4...4.."..............`.~.`.~.`.~..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........`.~.....`.~....#`.~............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006C.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):109698
                                      Entropy (8bit):7.954100577911302
                                      Encrypted:false
                                      SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                      MD5:8D804A60E86627383BED6280ED62F1CF
                                      SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                      SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                      SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006D.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):4.349167753665361
                                      Encrypted:false
                                      SSDEEP:48:KsOKds06pvFt9zj1E3yMZXNz99hsZpyZrdMr9bf6FXBmFWK9ZBkj+FOPsi:KsP6pvFHlEXXNZ9hgMRMJ622
                                      MD5:70CAA889194ABF20CD283B9AC30FAAF6
                                      SHA1:E701B563AF7DC310F4DE75310B704A33E196197A
                                      SHA-256:4FD81B270386729CF6B0B246C2A0FA6E2B51B9EE19502C20016C94D0A26DACA4
                                      SHA-512:CA1F5B9B69A5D913A200B2436FD400FD1F0842843AC0D48980682F414E7B73963426C7D3A1E755BF21E0D06A380BE952C4274BD58DC4B9BF9F41BC400C19A108
                                      Malicious:false
                                      Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..-.......-.|.....:...#1..-.|.....:...#1..-..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Z$...f...^....p....N...^..................^...@.I.Q.^.?........f........................................I.qk..B.....LZ.............Z$...f...^....p.........Z$...f...^....p...........-.......-.......-...........................................-j......-T.]....-.......-..B....-H......-..B....-..>.)..-..J...................;........4...4...4.."................-...-...-..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........-.......-....#..-............................................

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006E.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):41893
                                      Entropy (8bit):7.52654558351485
                                      Encrypted:false
                                      SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                      MD5:F25427EFECFEE786D5A9F630726DD140
                                      SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                      SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                      SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006F.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):2.4595042851259943
                                      Encrypted:false
                                      SSDEEP:48:NwYvLsNdCNDlLZTRVlEKvAgAlXdxtQ0ljLlz:NuEReSe
                                      MD5:6CE0540E0E22A8701F8ACDD8F320EFBA
                                      SHA1:C49C552DA83C54FAC6604D944F4A5CFBB421576E
                                      SHA-256:D4D21939813297136C7150C44C7AB8926DB330A462310D1C950D35E48A7326FE
                                      SHA-512:87B716628E6A967BF57034F51EE7BA39B5A420CFDE2D6D93E3845F7C309ED22D76B21299F96837CC35BF4D8034D376A8AD4C5559C31F4AFDE48D4CD22E626618
                                      Malicious:false
                                      Preview:...."..............................................................................................................................................................................................................q.#.(f..k...x&......x&..S......s..|.Lv..<...#...\..Lv.....q.#.(f..k.......`09......$....n.`09...........................................................................k.....`.........1.......A.......W.......^.......o....................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y.....................c..,........................1... ..$....S.t.a.t.i.o.n.e.r.y.....................c..,0...........J..d23SJ.,.............................^H......'............?...6.......2...H...............................Lv..x&...............................x&...c..,............................1.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006G.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4096
                                      Entropy (8bit):3.326200585360994
                                      Encrypted:false
                                      SSDEEP:48:f2rmPmKZM+lUoewDT4m8j0TnEDbPUErl7k//KulUHi4UeVVqp6Yp688X9b:fu/wCCnEDb8ECabTVop6Yp6xX9b
                                      MD5:B60D77DADE8F5D1189CABD952E7F51D3
                                      SHA1:C78220BE2F97B7924CF51198DE7E9CFE72691E7C
                                      SHA-256:7B96CAAEE5D84868F806FD21B9AB634459E1D8FD0EE578B90EB599124BF6C976
                                      SHA-512:E3C18566F68CD6EE46BCE315CBA5542E14B0A80E51AF7E0DD2FBE9B499B5878FCB7E4A47B7F54D6839E270F1185765C376918064039DCBE0588A69E1191E3F06
                                      Malicious:false
                                      Preview:........0.......................................................?...............................................................................................h...........................................................`.#..W.......WG..M.T..Y.......4mg..s...8".......o%..(jMs.JF....%..e....@^../..%.............................................................................w.....X.........4...............$..._RT(P....WT.9.....T&d................4..(.....x.(.................4mg..s...8"..W.......WG..M.T..Y...2...v...4.................................W............................W.....%....c..,0...e...B4.$........[.-...I.......9..................................4[.A.g.kT...%.......%..e....@^../......4[.A.g.kT........_R.o.uE.~...ns5._R...WG..M.T..Y..0..W.....>..................o%..(jMs.JF.%..e....@^../....................................c..,0...e...B4.$..............E........................................0...........e....4..................T.o. .D.o. .L.i.s.t........s.)..O@

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006H.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):3.916521231142521
                                      Encrypted:false
                                      SSDEEP:192:BsijFSVLNRpiEw/mLXgcTsqgDRzmqz7yKjPtiPfrt9n1de/3FlG6LlhLJZJxJNJw:WSUVcojd4xRzOTXGJZJxJNJDJ0JxJ+JI
                                      MD5:EB59A1898832EE13D98517E20A3C0CD0
                                      SHA1:733EE2E4ECF6C1FC35FA7BEB938B19D2AAFFC7F0
                                      SHA-256:7CB2C5254C2EBA382344C8A7D335E94EAF316C59E5C5D38A12F0B95869FF319E
                                      SHA-512:3B3932C0F9CC938854A5E487FD9912F8222AE0D6306B35E12ABA9FA0DBFA4B784F76184676CDD420DDE159A70EF5021F40E1A334255B43D6D736E4E89D1EBDEE
                                      Malicious:false
                                      Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ....;......0.....?........0.....?..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............X..r....v...V.....N...^...............s..Q...M.sT. V.E........h...L...............................D....I.qk..B.....LZ.............X..r....v...V.................................................................................................j.......T&n....................H.........K.............$...........-...J.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(...#...8.....z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006I.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                      Category:dropped
                                      Size (bytes):68633
                                      Entropy (8bit):7.709776384921022
                                      Encrypted:false
                                      SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                      MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                      SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                      SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                      SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006J.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):4.0785592936011
                                      Encrypted:false
                                      SSDEEP:192:lrGoW6G2wE4beoZaiktt4S3nMPFw/kQL3OZIDezfEHY7iXaxoW4tDbRJg6f38Vg0:xHajZw/BEAY7cRRJugLmcncDfmc2a
                                      MD5:4FF8E6EBED4F2AED9E8370E807F3A8BB
                                      SHA1:DBD573242F1D0DDCF74F2CB11E6F4CDFBBA7E8E2
                                      SHA-256:3A5F50244EDCADED0ABAC8A908B14D89D3BC67F402AB497710BDFD0B7FC7BF6E
                                      SHA-512:61F66316BAD366DC051B32BEAC0ACE8CC4B1212072BCEF8CE0F2B0A96B5CBB804AF19D3F702BB980317D34D90AAFA2DEF9B6A5A0E6E3BBF83C835ECD90E13148
                                      Malicious:false
                                      Preview:^...>.......L...d... .... ...9..^...>...........d...h...@...@;.....................................................................................................................................................>...........0.0..1....0.%......e..P.....>...........0.....0.%......e..P...0...I.qk..B.....LZ.I............0.......0.......0.............................................$....... .......$.........)..... .....0. .N.&.0.....'.0...@.....'.0.2.0...z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y.......................0.:.0...0...z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3................z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'.0.%.0...0...z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1........0.*.....0.....%.0.#...'.0.&...9.0.....

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006K.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                      Category:dropped
                                      Size (bytes):59832
                                      Entropy (8bit):7.308211468398169
                                      Encrypted:false
                                      SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                      MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                      SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                      SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                      SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006L.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20480
                                      Entropy (8bit):3.2501737225556955
                                      Encrypted:false
                                      SSDEEP:384:z/jAuSwGNenh1f+IkawruHPRJGk4RyAaAC9:z/jAuSwGNeh1f+IkaKQPR4k8yAaAC
                                      MD5:319E4CC57BBFD19BBA153773F6D157AB
                                      SHA1:B1B762D3AB27641805228D4E7F443774948C30DE
                                      SHA-256:D428EF1B2953144752D44A1E7276D478B747EAC0FBE18710EACA91B81F606FAC
                                      SHA-512:3EA47BE9CC2CDBCC7B510DEA0FC83FCC8DC73867688682B4A9671DAF63E801B284FD5DEA064C7EEF7EB4FB7DC0E55947F6EF453CE2DBDB0852300B26EC4E381E
                                      Malicious:false
                                      Preview:2...>...........v........ ...-..2...>...B.......v.......@....,...........................................................................................................................................I.......I.qk..B.....LZ|Y..P...|Y......!D.E..1.|Y......!D.E..1.|Y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............c..}...Q.p.......N...^...................l..N.*cF.WB.................................l..N.*cF.WB.............l..N.*cF.WB...........c..}...Q.p....................................|Y......|Y......|Y..........................................|Y.j.^..|Y.T'...|Y......|Y.....|Y...-..|Y......|Y......|Y. .L......|Y.3|Y.I|Y...z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6.............|Y.3|Y.9|Y...z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o

                                      C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006M.bin

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):53259
                                      Entropy (8bit):7.651662052139301
                                      Encrypted:false
                                      SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                      MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                      SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                      SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                      SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                      C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2278
                                      Entropy (8bit):3.846818152682132
                                      Encrypted:false
                                      SSDEEP:48:uiTrlKxsxxLxl9Il8uFJKyCqCxluMSc70xsi7cKljXRjd1rc:vvYjUqCxmeBi7cKljhE
                                      MD5:1326697540C067E2C8593D89295D8F69
                                      SHA1:02D9E8CD9A1B5801BFA7ECF6EB3329EDCD201922
                                      SHA-256:90F25AAB20007C35AB2A1ABD24A6A20F6488B52DD97F32E33F9B1E6639F98C3F
                                      SHA-512:A048F1F478E1818307402F58722A080351FA01484DDCFD7D708C37E4AEEFE729DDCF9F2D49450D8FAC5D261F62F1C01BAB215CBA4EA53F34F3BE4651D415F218
                                      Malicious:false
                                      Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.D.G.x.d.J.E.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.M.6.r.3.P.E.

                                      C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:modified
                                      Size (bytes):2684
                                      Entropy (8bit):3.9010080270926464
                                      Encrypted:false
                                      SSDEEP:48:uiTrlKxJx0xl9Il8uuHiigq0QrHrO+GPdgL5Uf64aazbTn+d/vc:JYOir8HIqL5Uf64ambTnr
                                      MD5:550275412422ECE16A0C69082B2488B6
                                      SHA1:03B7D687E03C2A221C8A8B755C7B7EA958467813
                                      SHA-256:5883CCC1004475963A957FAA21C1F77665ECFD84E36243B3C71A31393E212273
                                      SHA-512:40DC468D1F9A40D8E5336374EE684DAC05FB8CD41F406E2B77A65427CDE2D9B1AF64D1DA095A4F0ED69D136C62DF09B23595106E2526A4BBF125530F58A8C662
                                      Malicious:false
                                      Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".q.P.8.r.j.F.p.Z.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.M.6.r.3.P.E.

                                      C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4542
                                      Entropy (8bit):3.998126555410031
                                      Encrypted:false
                                      SSDEEP:96:CYWE0L5IavIt1kNMY2JlpTbJrYH+Gd3mD:CjLDwyaJzTbJr4+aw
                                      MD5:C22974D31CC01AFDB91F4E6D379A9D85
                                      SHA1:955DF9AB24C14F8553A1A02015A8061F9B775533
                                      SHA-256:C19B7C32EE85CFE4CD7A02D23F3D752BD0F63138EEC2B447FB14CAFA7FD13FBE
                                      SHA-512:98FE0027F3C41A60DCA5CA3B46A079B339E6DF010696E80CAF2B035578A682DE2DFB26864995F0DF66CC65346B43F99DB66C1E300A03B7E65FA32C86092874E3
                                      Malicious:false
                                      Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".e.T.G.j.W.o.k.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.M.6.r.3.P.E.

                                      C:\Users\user\AppData\Local\Packages\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\Cq5i4H6.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.975403723742162
                                      Encrypted:false
                                      SSDEEP:192:o87c0oSip/E0lG45cOwtyLLJuTX2XUkGgoliHLmtP175:oUc0ojp/EkGOuDdZR4mtP175
                                      MD5:3644F692038E12B4078A0C17E0FCF7C3
                                      SHA1:2F01FACD1AE25F8D20B687540348402B60FF31A9
                                      SHA-256:550DF455B976F45B21BDE66453B656CC154A60C48AEA5BBD942AD8A5521713C5
                                      SHA-512:40D80EEB5AE319E7E1962202BDC7E1AD7A06105EB6AA2A270037EA4C31FAD3CC3E54B950223E0D7AC13ADB1287A7835AB850FAAEA9BAF6684AFD913984506291
                                      Malicious:false
                                      Preview:..f.K..\~.,t?X.V[>._b{... 1...b+.U_.].$ u..P..x52.8W.S..L.~.......7H.....X......?gl..e1....7......O..d.V..ZBe..S6l..W...H.a@.....$K......&3..}a.....C"...(z....`......%!..........}.....1T..4..e..X.n..["..v.e..}C0...6.z.89.B\......:.(.9-..^'.....m...<.....Ff...........v*..i.}!.;..@.....Y.#_$hb.W..!...VrR.n'..6.0Wd.0....s`.F0D<...9..p...2(.(...........N.*.=w.=..L..*+...47Y.X..#.u..p.G....r-..Y..,.......B..G. JQ$.t...y.......VB.^i..s8k.....,..|[.ID.C<.g&.......9-.<..M....2..0......~.5$p].D6.+Vj...^.u.....%.v.._O.....f.Z.....Q..!R[[ \....".0.[......nV...~..4...p?.L..Q2..c.]....7.u3/......3....*..,d$`V.M..k...a]..T;..U......o.OWm.IF.........iq....F..E&6a5...W\.^a*...#V][X...q..%;..}_yp.m..r.G..o.>.^<M. v...../E....._,..~~...m....A...'n.eb...z.Bg/.d..7..}..Aqk..=.).F........:...L.O..........=O.20(..%.0Z....^c`...I..AT.l.....u......(.[...Tx..9...7..j...S....=.b..D.qh.q...)...45....#{./4^...L%.DK( F_m.O..pv..~.0._.].@/.G...1' .c.v.....9^qxw`Id.3

                                      C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\meZowQH.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.979917358341756
                                      Encrypted:false
                                      SSDEEP:192:9Zn5XXfM8GogU8Xq0ey9G2zG6EaQFKRUznUJpQmnZx0qDkwcc8i78jkQ:9Z5XBXgtXVey9TFPUz7kzVt78QQ
                                      MD5:E12EDF7A50AA349E6374A699A3603E15
                                      SHA1:78AAE89ED26E19D3670967BF39DACF900F172050
                                      SHA-256:7612A0219C649A59A9F44320341F9BAC7EAD64FE47C03E4ABFAE216C3CCFE347
                                      SHA-512:68F2316DD541ADFCA5614F653F7210BE247739338D15D2C30D0ECD2705E02664CE99362FD390A46C2BDC89BD6634CC1E6BE0C920B5327E66371B5515B7C4C079
                                      Malicious:false
                                      Preview:`.y...Q._A.n{n.#*M.U......*...xP......X...d.{...x....)....2C..k...+......O...o.%R..:.6..)...l...%.#gi]..................Ih....T..S.[.[.d......<.>.>.}E.......Y..._.P.....u..I......3.8u!..../...>.. .. 3`0.~/..4.k.....584T.f.o.I.1.Z._:....&.7.#..O.v...v.:......r.b.x.y..R.....$..!..s....(..".K.Ou".x.5.b..^...{..4.)..`..W.RG..e4._..>........ GZw..2.V....F[K..>W..v.#.v.,*An..p.9...[GsXD...{]...zc-....".........).4S..k....M>...O.3..zNF?.@..}+.%Q...P4..!K..9.Dr.T`.Y.!..zw..z....R..:.H.3../......-W.....D....jj|r.x.;Un.`...~H/+..."V....[...&.6....V$._..xp...@..c"....F...;...#s..gEkj..2.....Y1.mi..6.(u.......5.^7.I..h9..../..).b..D;.......Ld...uS...m..t.b}...C.*.i6Yp.X.l..M.fTT.....?:._1..5|........z..Qx.....jie..b....k]........".@.mH9....x$....pcHQ...&..Ih....w..:..#.qfv..HG......VG..Y....y.Y.<..M.}....]).:.h..t..&....c.C.h........-...x..s4.^.VY{E5....d.k..87].WU..g..{..;.C..y.......B.$...Og..71....(,`......s...t.....4O.;.fG.....#.o,!E-)_>...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\XMcfUn7.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.976691934728947
                                      Encrypted:false
                                      SSDEEP:192:6OWEZ2xYnvjSwZeURfqNJftc4S0pZq00VU3Bd3Wonv:64ZLSwZeDb3pZqnaxAonv
                                      MD5:75AB7205EDBC1B523DB5A6994E3AFAD8
                                      SHA1:6004FDAAB1269B8799BE75CA0F987709408F7699
                                      SHA-256:983E74965F76F165031F2CD8DE4C682DA5A97C65ACE727E7ABE7B98405D298F1
                                      SHA-512:3584516D51C75268F9835F3D7C207158897BD5D5E7B2CD3CFE86F1A0646D74DBF56F67118433212C9F968A3F86151933BB8BF15D4582AD8C2FB728BBFB45979D
                                      Malicious:false
                                      Preview:...c.2lH.8.E7....@...6.h..(C...s%...E?....-8.g}.. @.... .....$.l.V3q.G..h$R...>c...Y...J..V.Gn%1.Iy.r....=r....r...E....v .o.&l....t..t....w...N.c..a.H5Mf.......;",h..].".:.n$Jq;..b.<rW.2......a.T..-..G..M.*=F...P.[fU..F..w._.A...hNr\1K..0....0.k.B.D..^..7...c.f.....wyB...~M..|.J6X.2.(..q....gP.k..I.Q......)....4-..Iz.B".ES{...>...f......`.R.:.w.B.y...7B..7d.....A1M7.D.@C...N./..f.=.xnb.....I.g.%L.3'".....2.6....LC.Z.j..v{..a..\...E.Gve..{N._*{..g.;....L<.:G,...E....<{\.....2.<a.e.IC.9T.c.....@SRy5n.=...Bg....uz.W...G.l7.........qA.0.......A...6.... ... ...;.(....2..m2....T.7.Z...B....wx.c....-O6....'(.........9+/...h..B.ns.....&.?=t.Eo.(dK.O.y..../..ff=.~........lSIlt..T..k.g..ln,Q...^...v..r...# ...|.R.}.t.....0T.i.....3.2.L.E....|...y......*6.>..!.=...Li...K.z.....b.aZ~..x..?N.."..,.^..:r...o.X..;.>n..c..."..-4......f...|.0..t...d&.......e.P....d......T.HTo....K.[......O...:M.t.@.PU....~.....c^|.i..]9.Cb...Q.A.mI..NI..!5{...3w..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\X8d9K55.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.979940867560051
                                      Encrypted:false
                                      SSDEEP:192:9I2gUhK1M9GvxPULAyMo04YkHHtQiRiQOCowERzEQ8lUfaF:9rDhWM9GvxPULFMo0mHHOiRl1owEF8l7
                                      MD5:41251493C8AA65D41C2A187824C01DF8
                                      SHA1:AAC2BD6066D98628ED049A95D0BBC00760472B41
                                      SHA-256:1C896624C24577E0952C81170099F1E5E763038F13D4F6E7DA99BB86202A4E60
                                      SHA-512:DFCC2AFB6F64710F65966C25C63A3B3B7B38AC99D8003DA6CD0DEE5EC0EAB3812D848BF075F929B51D8634C56206D7AD7361BC129C911CB344ADF5AC2FD87629
                                      Malicious:false
                                      Preview:.G.5..5.G|.7sZ.I..h.Kv'..&.W!@A.....6.y.4:..9@....).2Bi........f..r..GF..k.9...>P.m...[`..!.w].=%90q......PRW.......i"...d|....=...,..g.%...cX....b.........K.qD..~....g..D>,:..z..-.z..U.n.(.nD..mW..........`7.....$L.i...k...:..=...&.`v...B.99.....!0{....x..-..{=...b..Y...a..+!v....;.....T"...z..N].`.R6.W..R...N.zS...?0.7e.y......=....aB....w ..8<.) ...Q......8.....E..&.l.%....T+....W...Q....|..s...v.<\=...V.1...F..c..@..o_.N....D4.=M.l)+=...>......8........;...z.b.I.T2I.D.Nu......I.v..l....[.l..6ZS+.So.4c....I......3....n.ybM?~...~#.3......8_gP...;.......}...ws...C.......r...UB...y.o..5^`R<..4-........jo.............h....y..VR=.G.Z.....n.Z....d4.M..8..|P\0b/._}.2..=FX{>v:=.E......?..p...;!'O8.7.{.2;v.T".&.ul...?.....*y...q.c.>..P.C...LqySl...-.Oe.C....".;.......13.F.G..[...Y..f"...e)..-..\...!.7..$.Y.H.B.mj.N....Y.....*V....A].T..d....."h.p86U....r"....t.1.......Y....`..]..F...,Q....).........?.T..9....+l^.td........).59...9.%f.B........l.,.]..U

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\WzSJykd.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.976351302109562
                                      Encrypted:false
                                      SSDEEP:192:5JbR52f1/T4tDwpXDJ7e/1FrAMxpbPpJ6NzQ5WLP:5JR5kb42XDJ7e/zLxh6NE8r
                                      MD5:F5FCF698B6B5E22F136184E82ADDC296
                                      SHA1:5CD16099042F045829E2C8401784F348BAF9C5DA
                                      SHA-256:047DC0747AF2F4A97D7FD5951E7071854915F1FA5EF4FB66A5D4606E94FD8278
                                      SHA-512:340BBA9AE69EE1E666364329C56626B9767F916B25C8D1E767DC6DABF2AB93D00B0C7D4A4F574224733B4AA390CC83A8ED90C9B7A007BD27D72CC78D1BEB498B
                                      Malicious:false
                                      Preview:..c..0.6z.B.r.....h.K....l.....G......<..E......Q.....(.I.FS.....`..j..o..bX1.....Z........C..Wp kU..c.eP.H..8.%..........Zcs.~/e.cT....u.o.9.M.`.?..C.........^nKp...U..{VP...quc..A.T.n....uiwO.u-.yG.].........Q....j.R...2~vD..].dN.N.....o..G;.nC.....n...U...O._.......5.a..Wg[..."Q.?..k.}|ps.A...=..%.p....Rn.._._k...+,.^q..T.....T.......}?.g.6..eG..|...X.....1.*D..#.$.Q..C.h.....E....+.q..N....7..|..E.&B!.`g.....R......JC.x/.>Mq...U.$..>.....0..."..,v......_.4..B...D..~-.....r.&.V.!..&.Gvuu$vB.R.QK.94.)....4^..Ha..a.H6"..[....d..q......Ovb)o... ..s$....X...to.-%S........ .$...^..q.s.Y..R.ux.rc.D.T..G.2....{...^.=...r..c.b...H......2cL._......1~e.l..0[......a.l.lB;..W.Fq...U<........5.~%....|.a(.c7..G.g.+E..QS..ew.$.y..#.....!.Xv.VVj...hq....6WK.._...#:.u.q3.3.....GR#..Z.3].m..!....L..@&...b..R....?Oj..[......N...k..hK6c9..#{`Np....a...^-...y.rtQ.....j8e......H]....2...~%e.s4.J...L....D.|..P.;."..L..Lm..G.......np.*..\r.*Yk....18h.2

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\3BZFGQm.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1866
                                      Entropy (8bit):7.8973741724518876
                                      Encrypted:false
                                      SSDEEP:48:uemKuh3MD9r9MeYkZCJ/42mF4icBvnHVQ5G:uhKI3MD51R0VGt6vnB
                                      MD5:2F2A369CF4FD087DF99381F6CE4E7497
                                      SHA1:8320A8321C59C096510052C0AE56B73402F7B7CA
                                      SHA-256:06C74174ABFFA2093C21C4A54821717815562382217DC263B600E3036663DFC6
                                      SHA-512:097CC738111709A92D6B04EBC876F631A03D892C2C920F8E3E52E59115EC6BB6F54BF0104495ED5BD3CA9795FA2A280C42A50924CC3626AFBB8BB50A0FA7ED7F
                                      Malicious:false
                                      Preview:....T.....G......p.L>.R..{,....'+u!.........d.|...F27....C.;5..,......u..D_......nr10.`.4...R-X..f3b.].....[.]s..t{B.g....\....R...'....[.m..hQ.L.wQ...N."'.../D.......M...Q..wP.p'.w.>.*w.G...~...;.....o....eB..8Kae0..........2.=..z.]..Q.>.>...>....G.s@*}...D=W.]-.T... .|....FsZ]McR.zS[.\.?.........V....c..a.5[OO.......#2.A.....rK....Z...p..v..j#L..%-.(....)..8}.....y...M.3{6.....I....[;....w.a.@....H. *.........t...J..=.....%AT.....%.....K.z.2S.${r}.ek`...Fg....4..?.....`=b...nv.'..^..0..c...?.^U}...+....^=.......D..Ck.'........ ..p.b.s...0..{......O.G..`.Q.ir...o.?.n...X.....V.@.:M.0.z....V-|x.........C.O.l.J|g.L.7Y.....".~g...]6...x..7H@.)..u.&.Z.H...}..inFJ....v....(e..z{#7..7.=..M...M..mMf.5.D...Z...t......Bd.m%.8.......5.~.D....2C.B19.^..?qO..zi3....,.YH...ttu.....y.7&M...q.'.6.`.7.........H.d.@p.v#..q...).}j.wtF.Mk.......Pqc..6.....B..x."2.*.yu.t....>U.6$.....~..R.N.G.N..Kg..^....u2J..0..?..r..eBP*..#.p....scC=.1.~%.Du.NyMf...n

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\WWrjzVm.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2639
                                      Entropy (8bit):7.934969628678726
                                      Encrypted:false
                                      SSDEEP:48:KH7yVGvMPc5UGVjicfT6kzTFe0xOS9zup3LXUkNUE4Eq6Yff7UPOLjwz5G:I7yVGIc5UG1rf22pNOSqkeyG5B4
                                      MD5:5975914F856269257427D47E468E440F
                                      SHA1:5A94CF18C6B1C0F6098F6CE331E436AE71CF2A75
                                      SHA-256:3F37EAC1463EF0C44EB642EBEA3EE9243B15AD9A2168D8C3E87065EF1C9AF89C
                                      SHA-512:5EFD4B50A66A2157EB69309E02A5A2EFAF945684AD53B1421CA7380C3F0C682C870AFE3DFE6EAFEFA57401C7C3BE4D41889C8A37E9E7BCB08BAA005911B19333
                                      Malicious:false
                                      Preview:.M....B.Ee..Zr.cI.....62Q.o....qh<T.%P).z6SS!i..*..B.......x..u.4.s..U..q)..~..T..9t.....~f..G.$ ........q&.+...W..-..2."$.'!.........O?S.s..L..;.Y.)..T.zWjQ.'m...W..&<t.].o;.w./.BU..;..>.{...u.9T;.#s...=8....p;4.v..S.FF.6V...!n.*..9.%.H.BP.VB6.m^\...B;.P*.#.D.....h...b.. ......)..-*bKX0v....L....f#" .16........s...21...~.x.^L4..8.G.. .<.|./#..,. 4a.l..5.P.|.F...j5.iy.5.).....#....Jc..k..Y.Zd#6gxqE...Y~...V{*U.|.....J..N..{U..<U.|e.. .EX....#..G...Q2.6a........D........md.8...S.x.C.....G@.y..p)..x....&.;....@.r..g^...7.?...g..1.XY....d.>.5..A....]....w..}%4..5..;...$.).y..3...a.........:.Q..[b.`........*...dg..5I..[H..7.......M.@.?.....hU..2~..R.Yt1.q....@.....S.}.c../.l..5.......]S6...Y|. .9..,A.\e....m,#...C.3.0....H.cx.m..;U..!-..28.>......5p-.}M...N.a....2.8.i;.T?..:..=...F...m...z...j0.3ONs...>_...*.......o..>N.)([...E.f..B..A..k..t.x.k..3.2c....`..I..v[1....v..B.........+..c.^.....N.UvS...n.i[...8u.7...Q.V.:.=...A..........^Q

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\SLK6fHb.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1816
                                      Entropy (8bit):7.882335712037945
                                      Encrypted:false
                                      SSDEEP:48:J9Yy2PpebLZt60etHrtqkwwtt0eSHX+dPpr5G:Jiy2xebLiFHrtJ0eYMu
                                      MD5:152B1D179176A2DC215BAECF47A5D7CF
                                      SHA1:12D764D44CFEFCF5B570AF88695FCBD59BC12A6C
                                      SHA-256:C7236CE3AEB11C5434FD01C65F37FF2DD30C0E7488F081C75A94E7A29E6C8335
                                      SHA-512:67AEBC9E9EB9E9C7DE7BE179C2A397FD5C2D757AF20697987ABBAF1F7B7C3EF56AA2148DBF553EA512C87ED641D9650C4297C23196EACCCF6A9DE08ACBC209B0
                                      Malicious:false
                                      Preview:X.;..9=.*v.WX.-.f..:...b.....H9.h.......E.B..lu.....P..?I..Z..>Q.?.%.e.x.V*F.`....Ac...l.gB...&7S.YH..&.O..:Y\..K8.G.1...8.9..t... .(.ub..,I*3iMJ._...Kz A..3.#.VE.'..E...-.xv?<...>%.;.t..O.HMQ.....x..P.x.z...N...Y.}<QI.i...g....r..G...(.h..]..?.`..\......?5....`..A...T<..N..:.Q'.".;@y..+U....W..d..}s...3.0...;F.<&.c...7z....e....CH.ouN.4.Vc..p.v....N.Kv./...Zq_.w...W....Hw.V.|..8.k....}2..?6u..*.w.s.Md.KH..8.c......zK.....v..k..~g........'....u...L........e.......=.YF....I.{.Z.@i...=.c...}jnDvc+.....LD/B..B...X.._..l.E.gn.g..BL{l...n..Fm.........E]..,...@..>.q.....*..D_........w..1..7?q...T...).I.l.......g.b..a..T..u...Y..L.......V}..LLd.l.@C..U@.T.I)$..y.*w[....O.{..F?.rD.....Q.*.l<M-|.....U.._.........Q.U.9....w......%e_.!.g}U......N._.7..<...my-.....)u.o.......l...ez.~.....I.P....dd..D...U...t..cm...V].J..A.d]..u.v]..4..~l. ...k..\..m..='.....V....88...so.Z..eU.:....ge.Jx......BD..l,p..KU..^P....Uo.l..]M...C|\....RPNu...8..@

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\yOnBLSy.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2647
                                      Entropy (8bit):7.915416176779036
                                      Encrypted:false
                                      SSDEEP:48:07MzfI3lt/rwlzIeukCZmYrYQ9VKj8y0jEWC97Ge5G:S6fIrwlsYrYcoy4jC9S5
                                      MD5:ABBA08514A99FE99A8CECF7EF8BB7597
                                      SHA1:855649085991092B3048BE997F2A32C53FBE6581
                                      SHA-256:44174404C66D0F91DB489C01D889191D2442FF8411CE8CBF967C32AF592D5A89
                                      SHA-512:76B126A4DBCEFD3E0A0417A399BD261D43FC4B46456732B09F6D8F5CF8564EF18DE89648653E7D1E9A84E8BFD92709AE2C0485373AB39FCEF7EF9BF7B135774C
                                      Malicious:false
                                      Preview:...C.&h|.C0a*S........]t..o..)....!..c.#......bQJ...]G.'..1l.TE~mkUe'.P......v..3.>...;....ZB.C.]'m.L..!@..L.:SY..t~y.V..WU_..k...).G..2S.jJy.V....<...<..>.y... ...$4.Y(.T.&S.m.(.Q6w.6....49|..R....=.{...v/F......wcF...:.....7.......s.1.".._..U.r.....kSd...>+?.".IM...P....z..+."..z.x..&*..g@..f.].w.....,w......^H....$G...bU..E..?30...6r.H|....]_>.Q.?..PQ.[.Z+`..^..G.....\.+..\.x..c.M.!......Ohb.K..=i^zh.y....n...X..7..l..t$...46Hk.dV..0!.[cM.J%..B...........5..qy...|...8..ji.=<..&...........wFUt..@.3.....'kw........s......$+.........n.....%...\.rT+.H.H.+S...2Vr..\..g...........*\2>.^...d.?.c;.O..~.{.@. .*.%...e..0P;...kNI.v_..q.uP.|..rQa(V+..eD.cM.G..o.u....)#.;^d.....f3K...._..S..e...4.G......vsKs..3.4&.[vrW...... ......@w.{..c<sq.x].x.(.x..p....e<.[7.D..9.'.q.....m.>H.....:r7aM.._.|Cc...t...e*........n<..,M>w.......>.6..po...Y...i..`...:kpt.8.`./.....h.t..u...c=..|.......zS...\s6.p ..k..".]B.uv.rj..2.........P...2)....JfT"X...6..C..<.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\5HVgz0w.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1799
                                      Entropy (8bit):7.913420238213398
                                      Encrypted:false
                                      SSDEEP:48:aHoSuPgxGv9iwoKKqe339eRd81OnkPT5G:JSuYEvY2gnMdUOnkPY
                                      MD5:26DAB8F5A5473BA030C3AACA5D1E5F3D
                                      SHA1:AC981F3E956C57482FBBAA809C35C6FE3FFB8CFB
                                      SHA-256:CCDC43AEB9BEAA657CCE4EDA39E0E96714A58E98324540A2FADCE56D0A66DF43
                                      SHA-512:20AA348FB99F12A72C555B660DC942733EDFD8D4602D02E66FE428A16F0BBD7E7F52FA08A25B9CCD6A5C2AEEED49F40DA102A3885B255CFFEA8582D4E279DE06
                                      Malicious:false
                                      Preview:F#...l."r.{u.w.H?..;......9c.&...-'h.....w]...S..z...}&..`.%.-........mY.l.......s...'..!......x.H..ML....inh=....sa.../ E.V.(.`...-..=&w.e..JO...s.B...r6.T$....r...^G......i>0.K.>""......kq<>.~o.s ...k2....+p.I...3.P...k|.(;......K9.$.T.?...6m....0....3.z..c..,...&./..=3...V.L^...)%....x>~"..$.0...T.Tv.BO.:L.0.....|..h...o$....i".0.t.y.....EEX]..@...u..8........#...lh-B.s...........-.sF.>(......b.5..90.I......_L5,.. .u.q.....$..kf..T^L.8.X...p.m.".!hq...B..n......I.P/M...i....B..}...).....Q..X.pc.....`....|3W.<z..@_.Ce...M.H.wu.C......).H (....t.O....K....V..}...KA.c..|.......?.}..<r..W*.}..EW"..... ....2]..}y...Q..t.NZ........m%.3....c........*pL......Z,G.9O.~.U4+.U.L&_Fl..C.. .E..l..4;6.]3<......V._...:..W.k0C.......Z..ym(..D.W[DU.........$.&...A@.r.`...GD../.[e1.I.G.m!....+$..V.2'=E.@`.V....N..F..+.TP].Ay..../:=..u........S!..w.-...O.g7..cz"@~1..h.Azs..w...(.....j...1O....S.\....4..7'......Jpx........[&.tI'.c.a.....(.n.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\uIHfT7m.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1352
                                      Entropy (8bit):7.848116925469463
                                      Encrypted:false
                                      SSDEEP:24:SCDj58ZgUmCdu6UoxYjovE57FMj7MzNY2U9U7Ix/cKfz+G006H9G:hDj57UG6UAYjo85yj7MzNYxXxTf65G
                                      MD5:5C395D4DCE3606BDF6679BDBED17D35B
                                      SHA1:9B3368E4C486C94C1A3F8018CBFBD975E15BE79F
                                      SHA-256:0B02E97EEF2EF8A2FB9873D448225EDAAEDBF69BCF97924783049C1923EE6753
                                      SHA-512:1CD6728A9C7BE7F74EB0C4866455D904D7E294CBB4E311ABF2AEC54ABDF41E2E6BBB6D601531BD5AACE42E72BB3CE047B9213145808F060EC6AA5D5F8EFB650B
                                      Malicious:false
                                      Preview:.3%..._...).....y.X..){3.7.P....!..1+.t....P.......i.t1.O:.1|...MP...7...Y.I{.....,.`....w..=..I.~.U...3^....`p..A;.a...`...d.G.....x..G...NC.M1.9n..........3.1w...f....B./L>y.pwZ.}~9..ci.UDmg..I._.\.k..o....z.m../?W...;...Q....V..".(r..f_yG....K.....F{..f-q$....z`.........].i.[.k...]5v...h....=..%.8y....Y....(.)...O....++..'.3..n.8m7.X^..4...A....s.Z..m.co.6Gr..+!B...N..P.y.....'_Ua.R./\..[t..6.........8...H..tf...%?V..=m.Ka.K.GB`..@*.B......r.....$...LL.x.+.1.....]1.!..K^..u.C......._..$3.\.....Y|p2|..z..e...\...<_l......E.'NAq...L..(...OKY..O....9..,.YM.RD....\....F..mN.Gj.ppG.k.+.3.)G.(.N.t.*.P...W....O...Jy..Cg.r.Y.....U_......h.5g...`.....f.z.H...c..C.~...ipP............0...Z..<N.3u...6..E@%..h..F..c"i.......N......._p...ExA.2.....hE...H.,x.V>I..n..?=.].......zGo............"....E.2.^...._..!......G..R.S&y..Y..%..{%........V..<z..$.X|U0...v n..m.... b5=.V.r[Rq.J.S.(.(i.ZC.I.Ls.....7*)..M......<..5../..d=...:IT@.J..[.....c.p1D

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\a9h8s4L.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1695
                                      Entropy (8bit):7.888195792955898
                                      Encrypted:false
                                      SSDEEP:48:Ai74+yctmDqh1f5QirSF8EeONluvdBv8pvE87yj14ld5G:ACZp5QKEwayj11
                                      MD5:4CC9A44FB46E48BA49FBC7B8D144DD1B
                                      SHA1:CE30C8F20C556F6CF4BB2F8F4BA20A28245650C3
                                      SHA-256:A58DC5C0C249C98B7C4292684679AE61B5F4CE463A03344CBEC313D5A85578D1
                                      SHA-512:E8BEA7DC1BA1D64230AB33031BB96F8EE6901945ACA010F93231A595CA97065238AC3DBD1C9F1BA1337E2861EE4CE26D7D430C2E579F01C4DD1FE9854E9FB68A
                                      Malicious:false
                                      Preview:.U+'.v.2B..;f5..}.E..@...Y.lC.K.F..._q...$e.D.;..b...$.`......F.4..BlG..`..*.i!...*K.KV...B/..=.....r..*..S..0.T.:.....,.H.O|...../...-u.r:......*...6.f().......FW.~@ ......0q...s&..F.i8. I.tMN...C.<v..>...}'._.N.<C...0..e0{..qa.....D.}.3.{D...:......o.,.r.J..[....-...."....vs.....-...3DQg=...G".k....i........f.v6.....<.))3E.."......y........v.&...+x.Y..Y.....<.......G|e..{.U..H.pf.b...vd#........v.....\T...G..b1EDO.=..Y`tpO...........J....`a..z...L..[..@.D..A..F...PC..>..y...CC..........2.9L.....f1V.i..{.......Cfp..Pc.(:Q=xp..1..v.7F.....p..0......!0:...."..w?.>.....NP......!..9.8.7~(.....f....kFch..[.`..]..Z.N..H.....n.}....:....wU&..{.wl.?....9f*P...]..w.....V1..].....L...m......U..E2J.....{D .>.{...q!.......e=..~7...%..Y%(v...}uP8...R..... _.`.7.@`...=..S.c..v1.)u.....O..h...X.......!....k.}..'.Zhw.:..r.........T.e.P..V_..Hq&|.....]g..Y.ijV...3..E..mF"v.......}......d.3..k.oKF.k...B./jy:..[q.0T..c.\....U<1..%.F....]....;..pk...2}.,.....1)R>.>..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\uN4Dc0V.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1299
                                      Entropy (8bit):7.864234325543859
                                      Encrypted:false
                                      SSDEEP:24:5KHizEuHSbncai/Cgj/2TKwuPlfcM0yJmUpDhFzY5Vjd1UcT/sQ2U4gG006H9G:CQN8vYdpPlf50svhFEfjPjVNn5G
                                      MD5:7676E89449FEF52324E933C6A0DA0C9D
                                      SHA1:D7A7E2C7BB702BC64EC25982265F75D903A830F5
                                      SHA-256:F451F7D34DB2BB967B55674D2B9C8C0B0DC287255A4229D2C3F9BE02FB1AFA39
                                      SHA-512:BA04484C979B2BBB12843CD4A1C6B6A40FF2DE6CA810EAC39056A79D9C4E0C24FDD4751EFDDA50E6AF6341D2AD03DEB559066F4AA3E25FD2214521D3E886B7D3
                                      Malicious:false
                                      Preview:wb.5z_._....ei.gvP.....c.@v8..m.......*....A.I..jNN(...XRW..09GCv.a8...gy..;....X..V.V...R%^4.lAD..a.e.......~.8..CM..........).:.>2.-..f...@ L..B......<..4....`$,/...NL...w ......%.7. .(....&`<+.<.....F.M.....).u...TH.h*.a...S...~..t...RO{....N.....[.\.,e....`gQS...k......;.L/.!D...W6.|j....>....].Yi....W.+.u.r...IN.N.#VJ...3G.T......g..'..l.2....Rh*.(...t..-|..g...v".6.....9?...cw-^}{.j..n+.q!...jE......Z...F.../....t..u5.4.9E..._Y.8...Ef=.x.#.W....l0....y..I@...Z._..n7..t.IK.3w...B.A...j]&........=..ZyQ..iS..:Dw:....dc..9x@.s.....=.+..9..D.o....5........JD>I..-.L.>...8.x.+g....E...=6..n.5...?.nC-t.......`a.]...9v..!mA`.z[0..$..M....DT.'~..........'. ...f.U..Sd.....i.......rL..g..0e^.t...G....a#.n.....U....rb.t..s..6.Qf...+..<7m.........#....K*.>..L.v....W:..~.........s.q~..%"#:..$...7c...E...(........d...X~s#t:.g...\....O?.Mvv.S..7.........*N.ns.M....3hZQ.D.fR`..ZJ..)t.......]...s{...@g*..7..3s..M..KEx..r<.:1..=[-.....+>.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\SYC7CgG.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.980811040948745
                                      Encrypted:false
                                      SSDEEP:192:hlmpxY1qB7izrf5Vg7n099Q4WrpJ29j11C8vbO/fC/S:hV1u8VYnGQl2tHC8vy/q/S
                                      MD5:48000EF20A90989E490C93FB25BF391E
                                      SHA1:8FCBF93A136A8DDD410A0911C1CB02187BC8410C
                                      SHA-256:BC56E0D47A6E4B1D34BE47C920B9CDCEDA88806AAFABE001764578C7FCCB21FE
                                      SHA-512:F91334A6FF40BDFDE3582DA797FF4092854944F070883A4B9CBB7E258A97BD6366CA132AC13DCBE3A9BCA9883ED7E9146D0D48275F2A303D37BF95FFD2406208
                                      Malicious:false
                                      Preview:..\..........o......s.zx..jy...Y.I..a.dE4N.......0.....#V...z/...ja.D..p.U...t\..:)q....B.....ZH........p.........K..c^H..".Yy........e...pd Q.ITp.....=p.7....c.......u.(.l.+.?......2.i4.10g.X8.5....d%A.k.._..c.......q...%`..e.....Y.^.5j/k.vtT.Q.m.A.?.U1..D..4...n...P....P..6oG5.5(....o.d..%.y.._A.j.@...6R`..w..`.+.....-.....M...J%V.e=.7.@.Ly.i..}e.wH....vDU8...p9,.[.K&...5m.{U...9....f..v5sq..}...J..`....*v...Z.N.[.].RY.QA.A.....3.....e..Z..!n;...L-.vN...O6..+2\...R..q.%..._..5...!.#B....Lf....x..S...\V... ..5U.;...*.........'...?.Z9.a|..u9.cH.kn...vN0...%K.FpF....x..0.gm..L...5X}.[D..=....%.,.O.x]0^Ox....v.e..fP......FgO.....a!..hd6M..v`(.cb....#..C....7......E.Sqq.%.|.../...A..W.[^=...;G........)VQ.').2........&..@B.3..4.0.....-ul..h..s..D..#.^.$...).4.[.J...Vm.L........E..........T..=.$,:...>......t~&..T.w.5.a......X..Z..1X.P..z....Q+.&....2|6.k5.......9..S...: ...U...Y.......5.....v...R-q./..W.<.....6O...fK..y.JX2.....W....v).9~.).0.g.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\7dSmsn8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1573111
                                      Entropy (8bit):3.619966467363483
                                      Encrypted:false
                                      SSDEEP:12288:kMqpjZEWk20uY4PBx/ltButUDHbKGwYt8kS4b38zgE6jEmK3:k/KxuYIx/Mt473XSVmRK3
                                      MD5:602A31CBA08F5F75FC8C93561A343A88
                                      SHA1:D2C14990FFA11D88B530E8064A333FE3FEDB4B9D
                                      SHA-256:767E386B2727307B8765DACBF4EDF7EB79ADA385B27F0F63F4CEAD5F26550930
                                      SHA-512:C6E88D598A699B015FEAAB1F2A4D0DE4DC72EF87A1838022FF948A8AD140F6C3F4D685154DF3018CAB2B634BD060BE511D255F7B2BDA39E7DE0746C2A790AFA8
                                      Malicious:false
                                      Preview:/."Z..L...R......N.......m...]&.q..7N(.2...^.!......5...1....a%....{...h4N.S...z..|]....u8.0..4..@I7...C+...;......N..f..e.h.I.A.M...".^......O.'.Y.G.3.Jx.....J.............51:.N.(...G.....Q..a>6.OU.P..../.......D..^R..V..O..R.;.Tq[...t|J.Q.T..)1...k.z~....k.4pC....F]...<$_s.f}..G...S.Z...@Ad..F.N......eD...x..=..i%.y.J..^...][.....&yl.....}i..$...h..u..}J.z9%<..2\D.b.8...k.4Z.........,.[.$..g....6.?.k.A6~;.....0Drz.ZyF.[ ...w.........Y1.D:$.T.f.s'+...B....?v..L*......~".W....(X= ~..t.l.Z..T8S.e0..t..c..*.V:..e..q..E..\.~.TD.d..o...\A.x.S...........A..[SY.t.....<`.;@/=...W7.?.u..Y.......:$...].}....c.i.....P..8..`.......=V.....6......@...uH.......9.....{..;...%..?.....OA.N.........H..5.,..f.....t...D.Q...O.D.Yg.8..G.fR..<.u3._tP2r\..p.....l ..f.........W.....6Y.$H8.[p..N..)..*|..t....{.S.......E....9..}.Y...UX.B...GN.......\.d6...i.....?..x.d,..DZ.[....'....@.@.l.f....d..C8..]..#.d..v.e...o~.j?.....P....}..M..R.....M~.."......C..n...+..E..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\qatigDI.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16632
                                      Entropy (8bit):7.987667947452126
                                      Encrypted:false
                                      SSDEEP:384:MABnCwm4ytwpYTOCea1lcZ429/EW/1z1IY1n6WENtoVWH3y5bBw+:MFtwpqb1l8lBf/1z1tZ6WENtxXOH
                                      MD5:163DAC0478B6D54D6601517A6D98DD19
                                      SHA1:339FCAAD1DA7FB13D15CA748DB63C15AA2204CA6
                                      SHA-256:1B21F3D416BAFA07DD51B9881A568BA30728C1E795EAFC63F2AB74912F866DAF
                                      SHA-512:EFFC225B12CF224601C7830E9E35DC45C7B306D9FA6F1EA9A92F09D9D9B85556DBC8C20D429C966D0A587B9EF652D2C26018DEB03648EEAF99B929EEADC7D8EC
                                      Malicious:false
                                      Preview:...Yi...../.9..../..z7|...-.e.....3.4.4F......?....j..o..u.%*.'>R.p#%.lo."...M[...w.... a.%.?..tJ..-I....jS.......|..]_...<..M...s.L^)i.R....q..9d#.X..j.o.3.rj.^.20.[.6.=.EM...5.-..7..../.Z5.^{=...+..0u>......K<Yg..Lt$..^..M%..t.6D.....Qw..X.8.......<p....hUM.'I ....D..Xm..H. ..N -.X..H.$....B..u.A....J.....eY=..X.f....^?~.[..Wu<.Y.'.........|k.F(.......v..>n..Jj..[..D1.B....IR..ee...{-Q#...}..E7.H..z..#)nG.V/..y/s..].J.........*..VH.2;..4..I.V.$.[7~.E}.+........`..v.......M..A<..M.A..(h}.3x.KW.\ (q.=.u($.{...=.v.\..Z.o.....4..g@...j.,..2..`F......(.zd.l....$......O_...%3.O)k....;Xs..t.#.]...."A.%c......../X..%.D......S.....e....\..J.:..t.c.6T...%..)..^......@...T.Yx..t....._..Aw...._..dro.X.j..........z..L......<<.i. .>.....(...'.oy...g.........l.......VO.}.gI.........:...1......G..ny..n.........eP._5..#F..eI.[....ku..l........(.....t...\."w...N..&..>W..u..8.z..3..*.(....6j..u..........C...!..Z]...An.G...O..}/..-.S.th....6.sh...a .7w.:g

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\Local\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\Roaming\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\3AlcjmV.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):107444
                                      Entropy (8bit):7.998398644548947
                                      Encrypted:true
                                      SSDEEP:3072:8oiLcv/NDdDpitombEX3EofwCD0jckuPH1LSuYzb:8VG9ySZ3XguPR6b
                                      MD5:F5A0C2E2A249FB5F11FBEB12FAA17CB8
                                      SHA1:A869B85EF3B4740A3E5B548C8B6C32F55FA44963
                                      SHA-256:AD027287EF3C6F5BE57A0894E0F480FDD48D12FCF52C3D770F86C5C76BC5E72F
                                      SHA-512:73CBAB6854B9B0EE1259C557812404218E846413B0720E126BED526E68DF90CD4CB8EBB69D8417766007094411C904A837F22586D625AA3C121328A4C265FE86
                                      Malicious:true
                                      Preview:tf..A^S..D.."g6IB.._.\..3..b..%..`....&4t...%.i....pW....s&.e.4...C...A... n.q.Y..i....-.s..Z.T..W.QL~.s&... ..7...I_.E...L.{..!?.l.q.N......sg:.n%-..(...T..I'...`...f..X3oC.....h..8..].fI..&......@.+mT;t.<3..P.9.y.wQ..s....bE.x.o...T.:..6.z..xV......q&?kG.kF b.S@..1......m......2.+...q..-p......5X...V.0cq..T%@=..a...\...@_k$.2..%K....k.7....q.....G.E*7.2....2.U..?a..EwI_;Eq.~..9.I......-....'.x..B.A..`..c.*&AgHA}{.I...q.u.|JR.F..'..L.../...qMo..ZN..i.ZW.....l..]P.....!j.r.(..`...o.pYl.~.2..Vl...\.N..Y.Q....+..B.=.@V.."-..O..n..3....|....x}I.d.Mk'..ra...."....\.+..A....:.)s..B.(?..5.X?...._9.N$:.....(.Z..~...^!..=Q.!......x...BJ..cY.u....g......!Fc.+.......r....,.T.P.nF.RzMj4W..9........L.z...w2!.} B'bx.P.s..1..z.8........;6.j.;y?.r....1D...y4..P....d.s.d~W|.Y..|...<.M............}.g.1.v..McGc..G..9hp.@+P.IT....o1.....3I..ar...@Pk...>S...+....b..sOR..7...XD...Z.,B.2j...u...Id.....J.7............HDs{mP+....k+...m..L.)b@.A.;.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\2zIRDzZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.97791382893636
                                      Encrypted:false
                                      SSDEEP:192:K7KVXTC/5VGWqROz0z3xVjdMW9csY1D0/7DTf:/VDC/GIz0bfOW+R1W7Xf
                                      MD5:D1A1EFB230D4064D47703C0A9E429CCB
                                      SHA1:1DB679561A8971D88439BEABD74BE1BBE617B62B
                                      SHA-256:E91121C97C32FC5A0CDC17EA4BA8F8E857DE17271293C76A4F900EC2946D8E59
                                      SHA-512:644F7E6E9DA310844C75EEA560BFAC23A6FAA6C7D8DD16847BBE039D2A1510F832D323CEF36D9CD6872FDA3AD22B0F0BDF8CA267EA38EFBE23941D4A9331021D
                                      Malicious:false
                                      Preview:V...GL.....f..s....d.........-..R..o...=....$.|=.W2$.._8....o.I._...E)ve......"/.....o......4...RJ......m.L.G...j......r3..R......z-.Rr.R...gu3.:d......[....Ck...>BI!.....?..2.@....f......&.kb....9.xj.'..#<....F..ploS<>.5~..,.*`t..<......7.S.#.........%...x)..C..>..Q.i....u.@~E7....E....Qa...f.Qe4.).?D\M.S..............Q.?.f..s~$i...&....BN:.R..O...zr.q$.2..!..E.Oo*q....g^..:.\...!2".1.....<e..R...n.=...($.~.o./.#..i.....U.....n...<.I........".~.P.....1.^.I{+..i....@...X;~Yn..5.....d.w.....k....k.......,....k[.*..<..PM......RM@^.>..R...6o&...V.U..0.5o....Y.9Fh..T)C..&..{OJ..d.Qq.].2.U.B..$.Rn...[._.....[....8W..C..]2....w$.&_...;.0ry..s..Xu..83[`.Q..i.Q.\c..'...e.]G.,..=..$......I..%.....r.jb.k..:;h..<M.K..A .m.4..}..;.@'6...0.r...T.j.......|Kb<.....d.Q.......=..VY\../....(t.z..O...v...M.y.N.AYt.BD.$..G..H}Ch.P....R..X.O..p}y....-]b...+h.p.[..A=.Q.......;.b.../.E.C5..$.......u.a...O...m.9..I.t.+.b.......d.......iM..w{....al."...wO..3..4...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\F4Bhj0K.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8427
                                      Entropy (8bit):7.978377813168387
                                      Encrypted:false
                                      SSDEEP:192:a/cTaLKIEhXQtnL/jXBCfID28uM/vdZ0N1sjoWhmv6Vm7l:scTk9/jX7Db/FZ0N18or4mh
                                      MD5:A1B99961200F65C6D17029539E762B40
                                      SHA1:28E5703E58D70FD81AE0D6A435A8FB850759179A
                                      SHA-256:128924B69F03A41486D43207A257F971930219BAB2D1C233DBC32F4032616AEE
                                      SHA-512:A217BCB51E3D80313A4B1F021BC74DA3E6FFC1148BB94DFFD9BCD7CE0E8AA7E5EAEE80C8CE7F3DC3EC27DCE43DB99124D0714B2D79ACD9E99A0430EE4DF5814C
                                      Malicious:false
                                      Preview:S~.h.....}.C.p..+.'....=.b..d.k.R.Dl....y.............r....i..A...C'%?.S.....,6......e....s.^..~....?.....Jl..P...=.g.:.....!...w.e..&a......r.)f]P...LDA...7.3h..D...`.[..84.x.....' .`......#...L.t.n...b.3*...OM.z... .3.+.......1R[bG....bRg."{I.......?O..7.}..%....".QzGQ...t9.......ic..R.\......>..*cr..2.?~Z......u.i....-uR.....-..t.6..D(U#..\or.(......s..[VC.-...(.,T..g...tK[....~Y..p.....<...%..9*...6.(x..x......z..4A^z...vP"\...JD....C8.D>..}.E.Ng._..R.t..(..Z.L.Ct.....V..1..6.3.:...6..#{ ..MS#@>...{..4..\.k....@b0...T..P.7.$J.`.|.P......_..n.*...S.l..'.K)si....n.."....<.3.7 ~.K....'.NI..n[..../5.H.1..zK:.*.b.a..fp.S.)."r.*..A.......{eJ....K.v@.S.G.7.Y..b....f...}p....;.Z{..'.z..jNP........IK.h#...!.{.#...~.Y.8...\e..Rt.w$..%._].k..v..U...... s.R....&#.P.{...f\.t.z.....y.9.q.HWh.V..+..|......E"..y....3....:....A}+Q!.(.q.f....qm......n.u...eLW~....../.)..._......&,`..l..#./..`.A......?wz..]..{.{.t/Py.Foc."..4....~[.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\qxETsVI.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8435
                                      Entropy (8bit):7.97673877948361
                                      Encrypted:false
                                      SSDEEP:192:DxEz1EPCxplngoMdKGwmErZWqip9HSQge9g/H+CyzrKJgw+Q8x:Oz+CXoKGw7YT9XgUgP+frvrxx
                                      MD5:FCEE79E0E7DE2074DB5B41304F6F7C0B
                                      SHA1:C26DA0F9EAAF0608CEB2B13D162787CA3E1801C0
                                      SHA-256:4F0EE60207A8ECDD71AD04110921662E1B9E61CB52730C376C00F30D7836A568
                                      SHA-512:5A1634CE5098E351CBA3BCA8FB1687476853F2DFDA00AA88F6190941280053A47BB751A21F5073D4F91EBAF44961BA94132C609162530BF9CFAAB5B862721309
                                      Malicious:false
                                      Preview:O...C...!...._......<.hD.s=..-}...v.s..1W....]...3!j...m...8..`.......S../.p.,...^.,....4/.c..b....K.....[..;..G.3n.-.r.....1(..[.F...B..I..f.M..t.....#..?5a..o.k.y.y~)M.....L....h...9..4.p.0.X..P.k?I.I/.:.Or.SW..$i...D:xe......+$7{~...[.8RC....h.:.].....E...M.._F..r.T..i.k......YssO.n..............-...S.....8.R:..^...j.....xq]..?...'.*WF5.^.E...._..6....F...a................:F`y..J).?......p.Wg.K.40..p...S...n.hf7.].Z.=.4..e......h..L.AE.r........J..... v.).W.N\.|..i.[.......x..~..!.nx!k...g.DC....Q.i..2..i>..6F.........N....ib....P...pdFW....n.. ..g.."G...2sQ`...p.|).....r".....r^k.{x...E.`Z..o...b...O...Hh.......uy.C.....9.j.E)g.'.u..d.$v..IG.6'.~SJ...S..._D...y.Z.E.X&....j.%E.c.3...;U..m..c.....I...'h..S......_.....~.....0Y?{....6.NaW`..hS..p.5.....@....s..<..E_c......2;..<t......6.7y....1*..o..$.{..............U...~]....z.S..W..2U..vI...fj..>.<Sh$&.'.....w.&.B....S\u.R.[.4)Q.?.3.2f...q..&...........8;....-..L...I...F7..o5..n

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\zDBkoPz.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.976840714681276
                                      Encrypted:false
                                      SSDEEP:192:XRxr6huaNs0UgV6Z+mkQzdoRLUQgAhwDlxOYlTAArn:XWYaNs05Vs+mkL1gAhUtlk2n
                                      MD5:60D71104FD887534F8D1BCE2F3A91D64
                                      SHA1:2E4D600FE016B076AFF7E415DD3AD287BF30116F
                                      SHA-256:9B9F4E39B4550FE0B19D0AD1C5811C70FE7ABADE6FFC6FB2C248AD633CA50152
                                      SHA-512:E06EBFEA7EB624875D26CBEDBA60009109BCAC3255718BA60E2BACD81A105DF09EE5CA636978F9E999C5B3D7439447CF99A23F7EA76A2E55CE646C0CB0E69C51
                                      Malicious:false
                                      Preview:...'...=^sTx.?..&.#.@1W..^6vt.;.!i..K.a.....=~....1......:}5.A.....E.%.T..*.Ct.|....r.>.:..9.).W.-......^...k..>.q.%D...E.....c....hXP.wfO.....|..j.../.N ..D.b/9..O.W.y._..(B!Mv..C...P-U...2..En T...k.w..JB.:. w.......E.0.7/..>NU.$H..6....3..ux.C."..?iu..B..Y.e..S...jD....g....2.........JB.._.....|.2.6..4..u.`)b%.......$Q;1.K.... _..?....D.....Ci.D..B...!.a..A....l9.....Ae(s.z.........53....h.%.".l....,.U....I..0.....~.]....9.R7.+.....,w....+.s.1..r.nm.-...Z..Cs.................l.....e.K./i~V......[&r.q.7.K...3i.YL........._ -2.t........=..+..G..=..9.?\....%|.E..&. N.4*.03..X.k.;.e..(.._...._#....F.pd.. @z...{4$.%.L...4..Fd.e..w.i..9...q}yW.I.r..?....;v.I....F.;q%.M.uW...Q.kD.27...Q.'r.".....5.{-..`.g4^C...v...2.+.Q....I.p...._@}.!....I..M.u.......EtAAUR.....pvA=.o@%...o{y..U.B/!.;.\.w9.Q.G..C...f(.u...g\...!Ke)..I\.,=..!q.6.Y.I:....tNCS.8..t........(y....L+..V:.=..U...........p...'.R..x...;.4......"H..S...{%uG+..a6.......7

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\QMiuSFn.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.980577735764621
                                      Encrypted:false
                                      SSDEEP:192:X+tXVXsHvrOrDZ6uG253wo5mFMbjZHqnnaCnlJgIQ9GWI:X+tFmduG2ZF5sMbFKnaC8zI
                                      MD5:6DB0142A69D53E3F16C414ADAB92FE01
                                      SHA1:C15E0A8BC214EE9A38DE0B0798D04EF857C18B4D
                                      SHA-256:EE2DDC6C8C916B84C9420CEAC839DA3BFAACA68EC59E45298475B57101BD7D33
                                      SHA-512:0E1595F1B54CE6467CCC588CA7EE34FD128135ADBE2EF1E957D76C3CF8C4D801E7D628D5D87D0C6CEFB7C6253A026A035C43AE840CA378FEC4A667EFE08D123B
                                      Malicious:false
                                      Preview:..v.....H..N!X....wK.(...f:.."p'......4Y....RA.|h.G.......9C.W..Q...93......p{I....U9.~....D.,..w"..AIi. ..e..>.ls.:.............ZDvrT..&s..... $....jv...|{qM....+...j.MoE......s!....E.. ...8}..J!......'....&..v..Uz.8.f..T...o....OF.G.....R.L.#.K..Z(.(...(..+q..>.(......x...L.-..0..@....MyA.....[$.%....w..~....[.w..b.SHrn..._..H.5......7.@MQ..|.}.b..}.'-.`n..5.,^..1.9.U/ !...*C...n.....tI....t.z.%n.?R.....!l..s.."fe.i~.8i...4?p.0..4.R..>e/..56.TAR..mrGK.&.....+.tO...rr.D.4....E....[....7J....Oc..........[T&:..i...;N.4<...j...d..:.*......5_.^..].6..u....B.....J)W^..p..,...&l..-._S.f...Fmo..!....+r...1.!..M..l.\..&.!X.. .l.&.....BF].e..f.k0p.'l9.y.j..`.)....Oe\;.:.....7..J..*...zlA....g .GM6K.f..9X}.)....[..D..X..@0........'^..`.5F.....8..2.....t....a1.v..w#.O.....rx...0..&,8....v...$.C..h..6.?Q..t7z.......td.LP.SZMr]O.:.....Xzt.0g.x.,.\..wL-x...t,..:d....@,..9.%...b..6$.e......z..,.....M-.#56~.o2s.g..w|.]........H..?.q:.....by.D..M.Ej

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\RNQtMcg.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.974586901693512
                                      Encrypted:false
                                      SSDEEP:192:VWegKijl5qtAgiXBXiMD8l1z7XOL33R24RIgK67sjRUGN5RTbBKYz2nGKHGZy:Y5dBSMIjGzRfRIgKhjRUGN5f2PHGo
                                      MD5:3DE4F05F2CD8050DBF79C3E3EE6C2180
                                      SHA1:994E56050FCCD874120A92ECA955210BEC8A46A6
                                      SHA-256:ADC37647661132CDAD9083C48B3A8742F9B841A8013FD5B9C7BC800D5EA5C8EC
                                      SHA-512:2CA76D392DB4C85E69FD5B7A57BB06A1CE808760DBDA81DE3AC3332E3218FE78ED1C39A96D11985797B4D487CBD23C01466346D6B2303CA1AF5B559844444AA4
                                      Malicious:false
                                      Preview:.......i.......;F..e.!.. .Z.)...y......:.............+.H......cz..D.wn....X,....5:}{x.:D.:..mr?^......J..P'.`..y.D..&..........W...\.m. ..[u.]..>.C.$.EL.x.....r.U.9?...N..7..!s!...3\.73.1.m.)..yh..v.%...S......,J......G..>.xncr...I.r.....$..k.d,.+..@....9:.....G9.#._...W?..../.:?.^..i...a.n../G.N.RM........=/..(....w6..X.].T8o.o8Js&.\B...:.w5[....6pLO...Z.L..U.!._.....".(q..Md>._......r&..;..z..oo^.?...:...a...EZ...4.G;.|......f..pW..V\.Z.C.0.'..{w[B.a.<...O.........L:......0e2...<Cd...|.E...x....0?...h.)r.g.ba..=.S=..u.U.t...yDVr.o.......mne'Dq.&.+'..[..D"mbE;..*..(...GF.Z;E.v,.6....U/..@c6.1.e.b..<@...l..4....OA}..Ed.......YNkF^.........t.Db.....7.NQ]M..%...+...n...+....l..n[".Nr...^.k.......T..>....cq...9 .[r8...[..t.xaP......~...n.D.k..p....P.).T.p.zV.~,q..)x!..!..h[7.._....,.....ZeH...5....d'......#A..h..3C?r&.d..(..3mF......zAr93.Y&a...M.Q#-....@...d"...w.;g2c......)@..n8;..h..R.!.*.......<aW..D......4...W..!t...<....:[(5X..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\39yieo8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.976384456081884
                                      Encrypted:false
                                      SSDEEP:192:8CLD7a5Kp+Hz0yPopGrf1AUfdGKZyhqxPun2s:8IeKqPopGrt9fdGKUhqhU2s
                                      MD5:7AEC9DD9E3B8244A5D4EE5DCC317B74F
                                      SHA1:EE3E7A6624B1C048C2614000E480F81E57B8D997
                                      SHA-256:71745E664BC1DE948BCA050DA6A800F79CADD598F21ADA7C660C725DBE58723C
                                      SHA-512:43FD93B80E8A2F9365C7DD77322C1AA69B32C4B70F439AC62091DB3A8C9F02091014145A821E8167BBA7B6C5233ABF6A38003FC7A27F924E9461F8AAD3968F0D
                                      Malicious:false
                                      Preview:.......j....pdAkkp."k.........].+.rB..a.h..:..jpw.h.f.......Q@.H."......(..*....Yg...y`/.3p..Wqe&....y'......YpK{^..Zn.+^.?B_.u0_.rs.C........\|..E.P.l....J:L.Dk..M.!.......S.f.5...K'.-..Bp..GZ.Ze..l...M......;..7.v7TV71............/.uL.G.8.O.(.s...|H....ja.G....>. ..C...I.......*.....iZ..%......V._..+l...\.j`..kW1.E...$.C.Hf:..k.l.|.-.F...*. ....CB...F &nxz..S...QQ.%...b.y..........5..g......5p..P.....U..g'...82%....3...}.......,}.=.Au..qk....^..d0.Z.1...]...h......n.M..=i...*..@..?.|=.q..i..1...E1v2.LU\.....M..A5.O...'`.r[......?j..s.X.....W4.y_.*......)0..Q.h5.v...Nz.F]C.."DB.8..JdFoZ.B..2..sbq..{}>.C....m|.OU.-...F){Q.u...'............#.^.n{.m...$.N......O.....0_.y[...u...U..Y....a..Y04>%.[..X......zi.N.....$T..B."..m...([..n]Q.e.5:....+<|.M.X...[L.\)..<..0.OL..^..R..0LAj.yl?z.w.c.....v....$(.t"A.4..[#.... .v.B....e.n...=..])%.z.!g......'...2~0...D2.p?..dy2.yY../E.K.,WN(....J.d2....d...\...P.a....E......d......./>d.xh3.N.......4.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\fHxBFiW.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:SVR2 pure executable (USS/370) not stripped
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.978836578812085
                                      Encrypted:false
                                      SSDEEP:192:jd8R3dMnXZkm/O9oMosymylMMIfcKRqcQ8lCWCFcG/53sYp:x8R34sRyNv0Rq5cX6cM5xp
                                      MD5:E429C6ECC95F414CBA376C6F95395C92
                                      SHA1:693A930BB26C8CD6A1D737B0608FFC639038422C
                                      SHA-256:36BF9CEB8348B0543D02976D0BC202FEC892466CD82A2724226C1AA15CB4DEA8
                                      SHA-512:713F23965904892544FFBCF3E15C087FDDB8941B4EB3ED8DB375F780C9BE179C6D1F43F58103FAEF7738CF7C15ADC3446B9345DEC2B946BB47211EAC63859087
                                      Malicious:true
                                      Preview:.X.}.>.....C..s.......$.p(._..R...:..G..g..e..+.M..Ly..9.U&....x.M..L.B>.xH.D...^@.w..k..G.s.W^..*..x\./..*.H;.Y_)..-...^:~.,1o.....W.(......./..._.c&...2.b..).L9..;...bH...9,..h*:.n...T...M..U@.....t..X...d.3.]..u.M&.O...d......8E3..v....d..p.F...../ ....)Y..w!o.U.*WhTx.].8{.w......w.e...r}.y...T.}......ZQ...*...`.....;...oUZ............(..T.[9T..vr.k...]..c...`B...5.........s:...H.9....).s..".C.5O.`.'..{....]..Ee.].s.q.......,.".....U......(.#..SI:$.2?#B..../e.D../.JF.E...S.[`..C3....d....F....c./Ry.../..8...!.!.R..^..ws.....Y."...s=2..,u...i..E.0..s....:..h.E..;.....&..#/...I.|.J4......q.A..s.r6A...T.f..{<.(.t.*.R2..|[....l......'.2@......<....n.Wt.7..B.7...7+..o.T..!.k..X.^....;..."~.@d.\..yz<.SXV.0..>.....`....^...:.Ib......F...........Q{..m.M..-..d...q.[......o.....*..i8.|%{f..4..\...6...'.!.ll._s....]K...m...#r.........Yo..g...........|r....rDE\...jJ.......K.@u3.Rv...6.....I..iB...T..."s...K...y....}.kS=.6...g.uGy....V~I..G....~...V..v..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\C2IYg0Q.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.976455096234661
                                      Encrypted:false
                                      SSDEEP:192:395u7ITNJYbyKBRSCbN3+wyEDqInhgoZWJsmkltt7nv+Xa4:SUMtBRt9W0VnzYJsmkDt7nP4
                                      MD5:8BADDB4CE93FD7D091BC74D231085192
                                      SHA1:C87757E1370175F8A53494CC96AC0CE2B02AFFD7
                                      SHA-256:6FE9448EEA0AE36C68B22DB3833C8AE84896662ABB4568A4FE95AE172139E3FC
                                      SHA-512:37D937FA7A3F610B0858C422F0559B8824D7F4C6B99FA2EFE0811DBD660F9EEFBB489EE23B43DEBD9546463E5689481A61DEE013A7AFF824F1A4D93454CDB5B2
                                      Malicious:false
                                      Preview:.>.Hv.SP..S).R.......ir...W*.5F.Nj......%>H.....H...h.d3.i.$5._...."c.u......*2....>*u....8.B.G.....dT3.#.K.W....hX..b...zK..3.......$.vlK.!..$..L...*.5s..4-FC.j\..P..E.N........x....[../...'M.]V..1........T.e..._..q..[..QP.n....g.6F....b.m..6...iS%.y..43O_...r.H.S.,.k..A....%..B..,z..8..n...aw......_.On..T.U...zm..A.....Z..+1.X.nzJm..+>q...P..g.'Ll+..e..n!S.#.q..e`..l.Sa.....s..........KuL}...$...g1}.......#q;...|.....B......6..".X7.M0;0.K.F.:..3. |R.:........liR....L!X|@.^......]NnQ.........P.yY..=BdjV.iL.<5.}......@....w...<}m6.....2.rN...1.8-&3..cK....n.....g.!........^..Ue..>.`.......iF.D..*.3\H..H.$..V........r#5..KC.]P.m_!(.V.&t.2.U>.n.*lt.....,=}(.+-.r.....N.....}U1.;....z.....N..+..FJ`.a........<.E.L.n..{.|.....>...b5...A...=.z..Y.K...n...%. ..g7..]...F...<...<O.. J{........J?.'.\...N._n8.(.5.....s.Q...R+..C.}4H.d...L......2.d@v........T..h.>...L.NFT...e.Y.:-...Dhd.;9..A...j.r.R..........fL:.8..A.....)z...w...8..R.M.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\wkjOeMQ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.9781615605933895
                                      Encrypted:false
                                      SSDEEP:192:X9e9cFPPkKEHCD+t5spattXnROY10WXaeQn2aSziw7KMtGq3PCZvC0LnW9OiYZkN:XgcF0TC6t5lzhOY10bT2alq3n0LnOVYC
                                      MD5:09A089A08AA2623C026C8CE96910A605
                                      SHA1:FEA5CFB5F09459076D24493BDB074CD19F2873B3
                                      SHA-256:3A194FE7571AD44A1DEF27E694F85F9AB35575C52ECE604F0DC7647019A7557A
                                      SHA-512:038D066B0392BDCD9DCA0F2F3D3F7E0C73AFF891F8367D700B13260B1671C5CB58D760E4892E25209E9120B967178402F2E1336840C773F78710B74A7AEA51AB
                                      Malicious:false
                                      Preview:R.k,[\D..\W;*.1.P.C.|.._..2...(FY;...y..(.z9byqu...g.........p...m.=.R.....i"'OLy).6.Pq..4.%.`4.c.?.."..)K.'.4:..7.6.8e.o:...G......(.eZ...`F......%'....,.}n|.....M1.Y.T.Q..C4..|..!.>.(pW..haF.......P.R%....F...x.]my...W^...J.4....i....D....T.#.b8.*nB.Sx.LtD.2j..T.W.QOh_N...y...4..0....|xd....}....U.1.>ku.DW.P.y..9.X.%.......p.N#.n.\......@f..<...P.lu..)T.$..N....#..>.._"Q....Q......[......S....BT..-..I..Qj.[...J...........\..t.o.#...s&<.R.......o.KI#..e.oq...G...E\...P...Y..&....ay.L......R.P..y.......!.a&9.M...\.............;.....)..6]..Oy.s7..|H.W9%eb..+....B.Q.Jo?v.u....a9....#..8)...........e..k.j=*...^g...;*.t.?..#<{.m.{...j<.....s.f..^......._L..X......2.>6...P....Ups2V-.E.b..".w..O..G'....G.&h....?'............q...kDN.}....`J....5.\.e...6....CK...qB.T.E."@..LJU.Z#8../z.....s1.....n.-....oOF..n.....KU.60...m....}.[....?LuA:.UY..D/%:.bYI9.0.B{....e$-........I....S....a"..}_.^..H-...+G.M...N..]O.P.3.uK.p]...(..0d....\...k+.y.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\gK4zGb5.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.977924493960524
                                      Encrypted:false
                                      SSDEEP:192:ePL6w3EBEsXSRjr9RNDGjMnecaBaLx7AwPJMeK:AewCEsCRJGRBYx7A+TK
                                      MD5:20967C3F984B12D23533EF87EABA5D32
                                      SHA1:157785C4CBBC0DAEDA1664F2874E28AE8D8F8325
                                      SHA-256:60418087A4E55461326FC2DB4BA5A870F1B127B6AF0A1B42141866F9D7378E10
                                      SHA-512:1E57342454CCA807955E2CAC8C1A40014EC6BA9461C144D9C22BD0EF2C3EA4B3EC517C4AE970703DDDA456F541461B43F86C9B46AD8FDD5C7CBE51DB92537B10
                                      Malicious:false
                                      Preview:D...I|.......\B}...Y...Z.... ..r<..<N.RoX.!MP.G...W..<}.#D0)...6..%6.`...>...0p.3......Te..6en.u".W..A\`.x...S...`ch.Q...^.x....l...Y.....Jug.h]..o+u6B.0.........O 3..b.M..C.X.0y$...V=...R.p.1/.v....g1.=.....PN)..68...hR.N...0.S.h,.aJ..U...\p...S.......C..6..to..=U6...+]u...(...>....uJ...X........k.....6h....a$p`x....5..v.....7...u.h........V.N.XP.....;8...)C.T..n...../..Ofn....\G...!..............Q.O....#C..atWR..'.p..?M>.J5.I...Iq_....`....<....|n,lhy..y.Q.I..3c}......;.4.H>5..~...+ve1...v...q..e....].....&.2...g$t/.KK|....o'.......d./..SGc......./...5S......g..F...*x..K..H...70...+8..x<T<h.....L....tCF`.!@\q....FC.0.=..&.%....t....c._..;...1......;I.%...{'k.4.,..q.....T......vF.1.....rT...?L{..Ta.y.....?P)......:.h9.`"M6..{...zK..bP...a..R. ..eu...P.I..t.V.IH..9\...0.p?.S...;gQ.-4.dd.]q>..6&..n.E.ndE..H.T..i...+.V.G..|....nH_.!.,....wq.59..........y.......#'x...n.d.?.9E...iD/....I....x..wK.z.zG...w5..e._.[^.x..........{....3.0G.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\420rzgy.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):33023
                                      Entropy (8bit):7.994539526370136
                                      Encrypted:true
                                      SSDEEP:768:WgbubMiAdj4nG7nc5vQePxgHKaL4xSM3VIq5pl2tzC/8ObOJ:7buITyG7uzxgH/4xX3uq5gGkOy
                                      MD5:1E2358558D498F8FD036103A63AEB7F4
                                      SHA1:39DADC2988E71CE519D267FE57DD613A0C9C1108
                                      SHA-256:AC6AA10ED856604735A238339C177FB7A5D2B5005F918299FC1CFF36C43E8516
                                      SHA-512:2F92A7E570629B6D7A8ECB4AE762A2383AD1F7D97A90E534E989BBBC0A0AD1AFDB496AC0150A027F3BAFCEB7C7F20D98A2789EB5B57D576AAB1C3D80FD4FCCC6
                                      Malicious:true
                                      Preview:..M....Q...)0....OO........@...IJ..A...>F..B.:.67|{.s.PKiy........Q..3U.j...]..:D-s.p...;1..~t.,../..^.u..%.q4..hJ#...`.W..2.....Z.~].Q.w.....Qy........z..P..6....4.H.uI...A.C8.L.u%.Ze.........E.....jw.j2..X..p.......5..&<......n......&.h..cG..X.KN.)..._j.5...@...S.N..Aw.b99..B..X|...A..M....Hf..@.z..a...?...."..7.}s`f....2<......j...0$..#...$....r;O.......>......)...B.9R.Yp.&iZ.,.. ..L.....bA@..........$...Y.?....\.t8..xSa3LQ...E...:3B.......O...M....l.g.b|x.....e..p..C.....'`....&..JB...|a...S..I.rnWB{..C /..BN.l.DJ..#Rj....I/...E...3v\&..._..T.-,~....KF...,c.cq ......D0..N....%PwC.(..|m....@..X(3......\Mg..G..Q^....B.G9.>d.v..|.?...=~Q./..0*..G2/....x_.>..,.<:WX.lH..Q.._..t..YM..e;*.......Ew.....u...=s.-.....a>....I..."=.....1..Y\|}...wH..i7....&.qd...sx.....`...o..b*.Q.p.(.Iao.........hr....4..oj...v.g.=.U4.}......q'.\:..i@L0...:]...&.......#._.!m....[U(4.@.A..U.~.....8..._...&...*.....}...?~.+.bo?...?4.....n..+6Q...{E......-.f~...e#.'O..O...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MdqkmNh.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4345
                                      Entropy (8bit):7.953986524927635
                                      Encrypted:false
                                      SSDEEP:96:wyMvRKIY9krui16UCVFa6DFVZoBKTBPIVZECfWA:jzIJwzz/7mcTylWA
                                      MD5:87B73D4DEFF6AF961D9B5794351A1352
                                      SHA1:B8AEAE5D583A8EA4998A1B37DDA8747559294205
                                      SHA-256:4C4D7E57B2F8119AD263955570440FCC2737BDBA8A6FEA1AB74CF45BE02ED384
                                      SHA-512:61A1BA0FA25B0FCFC5520E3AF3CB778EBE01EDCCBBF5CC9A548DA95EA1C25CF0D5DBAD130AD26035DAD55C528F72B41979BC578AF040FB56C11E49832BDABD10
                                      Malicious:false
                                      Preview:.y......mF.bK......>`.u...*.....W.3\...b(6.M.v.y.xP....Q<.w~;*....y.z3`....!(5..b..^../}...#...C./.......7.........M.....m.k.g.O'..x.~..B..}...7p.p.......$.=...&...L...0...qK...P..I.S.=$.e?N.h.f.%....R,.;..Q...Kc...j...,...5).2^..lx.u..S,....|.>.....g........l*..Y.#.n4GpE&.[.h:p.s...F....B.....I/.L*89......w....J.....'bD..$bn.B...9._.F...).s..26]......R.H.g.."......W..:...&...."..q..^.#.f...d|f....z5..l]...._"..$$...c].".Z1....p3...6...9G.3...O........d..w...o.<....._.kA..B.)[.!9...P?_.%...`...".....Q.c...VF>..~0}..[D...q.....P...;.96......A...3....e4.l...#..vfW.Tn... .vb>o.v0.cm..r$..2..J.....f..%...w....2..Kj7.I.ocX.c=.,......^.H*..Z..g..a.....n.x......4..e...X....GZ.t...?....(.so.N]?......:P.o...T..%M.A.{j....YI..t.>a?\.....#&\&;yC\^....0..8.....C...T...6$ mO....lmc%....B%...sM..5J1".!...j..>.XB..,/w.....t._.~h#..T..:m..H9....).Y.O....X.N1....e....>......_...B..m....p].....B.I..!...A...b..J0..Z-..U.P"...J.m.)N0.90.....?D...$.3....A

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\g2z4qdX.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1351646
                                      Entropy (8bit):4.38125858463518
                                      Encrypted:false
                                      SSDEEP:12288:357j6ucIpGl6/kXm8wOKYlNWfjvtghtkz77Uy7W+420JcwyjAA2kBED:8HIpGQeVi7tgDmW+42rJlBQ
                                      MD5:335D6C600741167007EEDE6C842355F9
                                      SHA1:CA89C991BE0D10A8E3714C222082E7955F24D06B
                                      SHA-256:E79EAF9DB4F760B3F63800618D93E200F9FD42CA35D46E9BBB5EF7EE3F22047D
                                      SHA-512:B6180EDD616CC7A098F113262C24631A173E5A10E52E8D953A71F93D18E073846E869BE7C4056D048EF82741024C28B0158A233624DEA5647A1CAED0E1EA49EB
                                      Malicious:false
                                      Preview:..%..p#...W.Dv.4.R%b.j..."X.u....t'$.6"d..2..m.ui......n.v...Qc..m.}.%N.....8........}o.f}........7..0...y...V.r:E.c.&#.z....Sn.0%..].!....[...Y.L..<y]/8...j!..1..Q.HO...i..B.^..Zt...L.i.D.,Ml.^....Q\........)5S./J.>...8>,...(.B.b=b./o.Q...T.d2..pB..^:.O*.9.FR.bN)VG..M....t.NQ'...`......1.R?.c[h..tf`..@.M..".p._.....(.W...).<........ SO.....c.O...x^.....xD.s.?^.c.N..b...Hc..L.%..A.6....w...S..V7..I.b....>n.\!...s..3...h.....4..u.QJ5W._.u..(.p.>~sV...L.z..V..m=......to.?d........o...i..r.L.\.....vW.`..g.k|.:J...aB.,#..iY...b. .J.b<.I...qB..YP.!......=.&........h.s.f....mi...VY....*.p..v..-f.X....wv.\b.^..t.gd.V0&Qs.?`...t.E.Qk..%.q.a...SF....$........H.."b........7.G67..D.T...d../V.........B....j.L.aF.(r..{.......(m1....n+.hv5(a..-...M6x...$.`O5..\_.<Q.*..)..<(BtKZ....i2..h..jkkwQ..J5.f..7........MW..T}e4[._....#U3.*fX..6...O......Y...-..O.......)u$f...@f...u.CC.q..+..Ct.S..y...P...M".bLZ.(..T. ....cU....bfI....H...Yr.uemn.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\zenmzHB.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):65813
                                      Entropy (8bit):7.997044642796159
                                      Encrypted:true
                                      SSDEEP:1536:RhUUol5DFZYNlopn8dAMbbfJcFHm1eI2sNadbYY6qLC1bVPtr:RhUh55mNVZbbfJ2HlYSbyZ
                                      MD5:8195D4C4B779A9AF2A90659BC25ED660
                                      SHA1:8FD3DA530D1AB8A99E719D54278559DFF159C0E7
                                      SHA-256:2E9CC47124531C505D4F8785939CE18B994DE2A62B1C0DF4AEF4B539FFF8EDC2
                                      SHA-512:942D60E72F9F9A244BAB7395CB4D415230216EE0F48CEF229E2BF3EA78EB83C26B6B3EA0F7619363AC97E543108F03D5583DB8CE3D58CCFB54938A6B579B0677
                                      Malicious:true
                                      Preview:....2......h......YT......P.$*....D.......S.#...S....\.....yw2.sD;...v..=U.:^g$..&..,.....Xk......3fx...I.Y..*..|!m..`.2.2M..1<;Ao.k..<iq...>...?U!&.......?:1...w...M...f...$.dx..}.A.........?.......vR6.+......k<.....}.....8=|_..>{{\.....Mw....M.c.|......./l1...DD1.lzno..,.._...far$.;....._..p...z......Y.g.2..9....S..V...1iX..7...X&....X.4.v..h.._...[U:.YEt.e.....=r.i.....6....+.X..=..b...C.........n.vP./....NH.!=.....4...2...:...5I..n..f.;Q>ln4,Z(".v.J........a.U.u.x...[w..RA.i.....S.o..,G_....N..F....A;k5....{},."}.|.....E*`.e.|.e!....S"..$..c.'r...[......z..".DT^.N....H........_...9.zNR...qg...o5m...^1.....X...}:h.,..#.)r|.HC.ob.=V..i......W5..I[....ml.......F.aDJ;.q..|....i>.2....<.'.M.T.|....0.ht..P.H..[...J.....p.(M.>>6.(.4...a.^.P....k...`.5DML.9...~.7F.O...e[t.B34r=..;...#...~.8.*..~@nZ..S..3'...+@.6....d\8{....SpA.NBx.xG.!hP..V..G.L...D^...$....I.p.&....ch."m$K.....E....tX[..@._...P..T0.~..#..k.5......:.=...DFu.}.[._.<.(e

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\T57bm2j.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.978689951391668
                                      Encrypted:false
                                      SSDEEP:192:ar4a4krMn30A6zG//9xdZRBGM7vW+H9DCl2m0yPZqWpqjYd:vVcsIwp8M7vWsq22PZqZcd
                                      MD5:FAF26F5D78CD7148A24F0195FCCA3F14
                                      SHA1:74AF606AD5C0325310408E30177B8FCC5BAEE4EE
                                      SHA-256:4E19628385CA27F8E40EB99943DFAFA0F944A79AA6CCAE619221703FA7A95610
                                      SHA-512:CCC4AEF901CDC296FF0195D43A3477AE6CF071F7117F02F268A86E13F9ED160BF441C443A2886BF0BA276EE3ADF48C87DC946CF42A55B1BD70C80C9D4D318517
                                      Malicious:false
                                      Preview:..^....v!.....4.l.(.B6P...&-...u.FL.w..49....>....ci..6U....!J.2.h0.\..63C."./c.....#2.93Jlz.4..(...TJ3...r...W.xw<..R.'.J.xRT%].:..N..P.q...n.....M.....)...{.Ts.....;.[..b..t.-9..Ejg.bE9s.....>....k.._..cb'..iEzJ.p.X.MZ......}EM.}{..I.['........x.,....6"Nff>...........V.]12..<=1....W..cT3..Qw..{....z.S^.4)..u.."gdR[K>.3.'.0...c..G.(..L..'n..]....0S..R0..n._.1m......y....].'.f..-.sJ.Oe<!..fN.......6..D..NZ`..>k..WW:/rQ.J.W...D..... .....#.8s...XPGf&.V.......D.be.............ab0.[..HG..s...*...........r.....20....A.]...M......*!.=.M(.c.....H..0.4D".tv."H.$....jNw.;..#.Zg.`.s.2s.....<.^oF.HV..i*..[hYt.H^..,m..f.%..T..q.}...7..XwK.Z...I....S....J....9..n.31."..h..M`..e...6.;)..T..N..;.A..T.MvX.z.>j6..|=@.A.-....@...3.n...!%.l......r.....)..e...>R.B;....2....4....s._...{.#.7.x...'w.Ho..[.=6j.=s.:X.1m.,..d.4*..ZM*3Y...K.m,..f.O..^...!.-.u......#....9......2..+...-];...:.O<_G.~.Q......0.b0c;s.*`<...hFg..7.%..2..-2Y.V..T+....(...1.*.=...fZ^...........

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\GJN6J2A.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.97592307306318
                                      Encrypted:false
                                      SSDEEP:192:gHG3JpRXpxzGosLezQSbhgQS8Xt8+AJ3tDmxxlD/JZLzG7V:6GXJyezQ4VS898xylD/JZLzG7V
                                      MD5:349B5161309510ED4C9087702570F502
                                      SHA1:13F7A6F567EC20B56035ABCCF071C8A9165C443B
                                      SHA-256:96A4ED98D4353D48EB6D25F6D4E85825174201E6E85F3CB440E059B4868591D8
                                      SHA-512:12DE6353C11D72D2213D25966D25107189C6D7266D47B11A4F393E85518A85FEAD2A49D7EC36C35C171C12FCE9313C8DADD89A9224C223FCD57BB61D90554439
                                      Malicious:false
                                      Preview:Y...:x:_......^....p.i..n...K.....@p.q.._.x.|P...{.Xd_..9.q..........A.}......I..9.es..)..'..ee..p..>...b...^s..u..26.`.(.......7S!..)8g...c}.1.o..>.?.R....cA.......... ..^......1....7.`...f..%@.-...W...o...O..:.44n...-#A.i..k.9.:...r4f...Z.m..q.b.=$..&......y...D.WY!....q..Rl<.a.x1.{.>.0....h.k:..Gv..~.3.W...Xojq..8.^..O..54........`.F].62.?.(_l........-x@..w....8.f..x6...}..3h.......S...ef..&....;..Cz)]...f......(.I.;|.-b.EmY...s.......M...-.......&.5I...^./vM/h.]I..J.9..CF..(.;W.A._.@....|...%Y.%....h._.......t.*....!b..%[...~...H=' 9.....I...&r.d.]...?r~+.n.;8>.......O.]...u...>./G<!..._.....dt.iF.)n.Zp.,j..W!...#.&...*?.iV>.K..A...H..vn..:...nd........I.........Ov$b....R...Fv.I&'.o....U..k....O...'....2.u&......\..8.Y.w.'.HdY.OP.".*.l.....gh.4R.K......l._t]..T!...a..i{.......I...b..Z_~..nqm.J..>..3...[`..zv..P..._e.....o.n.t..[..xQ..k...41.......... .i...w..uz$.boU...*.]7._.X70.O..D.(.,.f""...$....3."L]"1.Y.Yg&W.L

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\FsYD1Nb.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1573111
                                      Entropy (8bit):3.600047218904179
                                      Encrypted:false
                                      SSDEEP:12288:irGECuLEnVkW3mrzwb8DUHC287rQa7FaOaevmZ1kJcRd+xEaTq:itLIW0m+Y8Q4evmZ1kJSdpp
                                      MD5:DCEB36B70B8FE8B2BE2935CA98D8013B
                                      SHA1:35F0A87185127BA7B9CACAAE0DB64637948F2B2D
                                      SHA-256:779AFC4C52C21F3F4BD459ABE7B4DD99434A5CE98702C03A904D795F30F676DF
                                      SHA-512:924107924A66BF99C6B90917AFACA92B8D8050ECAB47CE48AF3364E6232513C7ACA969E697E3EE2C7051C184A69BD8E8190DE16CB470A33EF6A1FC9A7178A518
                                      Malicious:false
                                      Preview:\!..).......Z.....+E%...^+e.3m.?1.e.K..MaG-.La.Fc.3X.....o5.a!.X.-..h#.D%.}...x..-ou...\...X.l...x.=ZZ.f<..@.f....Ab..V:..4,opS./.R.......W.M..a.....0.C.X_nO.....N...._}Q....T.*..0.^....X...kY..rb...0v....cYBL%..&.o..CBZd.....i.....y.....sf..........#.......g.80.\...R...P..]@Mb....M.?.v..OQ.).....z....p...?z.b..0.)N...b'.}...uC.t@/....a...\U.!..Jo..s..ei..@4.%dQb-d`.k..4}oI..m0...a. .B..W.f.V. N.X.}..P]..X..!.f.....I.;68@0..A..!=....Y.7$...}..n.!.....,8.@.&H..U..D.....1Y..u.......v..?;.'/......I.".~.'..!....w.<)..'f[......%....@.Q.....`.S.*.....7....wj...-......C.....Y..| .tH].B"M....M..3.....%#}.J9S3;..uc....n.q.$ ..Lu.H.......9..xiP;..?.xx..Um..=.....:....bt...._.....z..7....#..H/...%..'...m.`.:k.8i..OPy.^..Z..........Z...i..<DA..Vg..#...e.7F.'M........;I*EH.n..VE^P.........f.Y}..;...\}e.}_.`4.*H.6.....>..B..J.e..<||..1 1..5g.6..5..5..s{...u ...W.e!.A.:.Aw+...B.._V|} W....'.D..b.......}..#.?nt.....Z.eE..*B...J....-...3..?9s=

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\x8X74ns.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16632
                                      Entropy (8bit):7.988578190659857
                                      Encrypted:false
                                      SSDEEP:384:7s+gPKdb6d6uZA+F6aTYe84xAhTEeDbdg069Ejj+H:7sJd6uZAC8Pldv6Kc
                                      MD5:5FCD89433C1F257CF84738A84B88CC34
                                      SHA1:5ECA90B522E3C08B3E328516AE2F0201D645B711
                                      SHA-256:0D946E98E6C77020CAC7E51ED56ECD66B949699E56A67EE67FD96AD9AACB241D
                                      SHA-512:6F0713692CE6223514EC0974EDDC35A8DBFFF52144BD3B20AD144019328E8C88B72DF09CC387BB9C7A68D89585EA614391FB6BECCFD368AF55EF908AAD11874C
                                      Malicious:false
                                      Preview:...|.. ...y..=.,...{.e...:bZ..cI..r).>.1/u..+.x.1I......l..6R...y.....:R...U....Fw..q.d$.h...x.$u.......-....5...E".+.s&f. ....Xl...0...=...o.G_U...O....U..G'.k.`{...`.....kts.....t.=.......J_..EU`g.....C...6M....7.L...>.t.?KC...k...[....'?h.y.jH....i.J.#6o/..4....t %:.IC4........|..S\.C.o '....:.S.nd.....{........o......vx/x..T..V.n.D.$..Q{..NZA].1.h..+Dc...K..!`+..Gp...Xk.z..+.~...xjG..p..:......'...88...,.......k...\..D.6ES.Kv..ZI=.....]...Dw.]M...+.4.....3uz*..2~.n.2`...]...._....."......5i....ZJTg.:...{\S...p.GPp..?..{.g.b..l..C.@..P5......-....nS.j....'.4l...:[OW.k-0.l|O...8..!.pO.J..F9.L.8.1ku8n.!..M........h.c.....~f......c....Zrm...m.%...u,.[.B...XGY.<.G...I.....kr....v|.U..<...Q...nu.Zr.........C+.UY+..Vo.RM.F....NK'.XF0.......lj.-.5.0.t9,...<@.{...o.`[l.........z..~-.....s.z7.c....&9u$G....=..k.._.%.JO..Y3. r/h.9....}... j..B#....n.G..6.#p.(.b.8.)U.r..+..?k.....1.Z..8...|.,&..$]...p..8.4..o:>.:.=...J.v.-z.n.....g.T.../"exZ.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\26aF3Sp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):524529
                                      Entropy (8bit):7.999641932220872
                                      Encrypted:true
                                      SSDEEP:12288:8nUDewDSnLLlYgCTh+ONjf+F8lnR3VNkc7oxj7J2M:BewNn9Hjf+FmR3V6gij13
                                      MD5:FC173747BA8B127651EDBD2F52BBEFCB
                                      SHA1:A01AD0FEB3479E269708301714F64ACE54C7258C
                                      SHA-256:ABFC3EB8C3467B43A3B64E1D9D7B5525601DF97A1B69FD784237BF8130B6CC02
                                      SHA-512:9927871AD41E046A9888345E2FEE676A27FBF787734EA405D66AF2BE62DE4FD3AA076A6E5FF73B53ED117B4A561D7D2BA426AF0AB3170F5B4030BB3D6D610E9A
                                      Malicious:true
                                      Preview:..e.j%.).;._.:...S"....h...<R.5C.)r..l.7.s..+6.-...e..F.......7.|r.@|)....4.H.@.b..'.27N...{.t'.M.0.......?..Kt.(9..1./..@d..Wg....+...2&..(.V(m..A.N...?.W.&...Q.F.(.....I/...T.=SK.;...2[0g*..4x.0..'.TX....c....(........8.'...D...".bLS....X%y#.R.0.].T./'.i.j.9...(..=...a....8..wY....T.)[)7.}.,(.<+x..k..dQ.Z.%X....wE>..Z.Z.7.c......>..k.].V.^#.j...OC.....$..fa.CXM.4..3...=..Vj.l.Pm.z.3..h=S.\$.$.~.....]M|.5....c...@4.).e\.......#.....hP..t..La..f...A.t.T.?.V.<0.h9..g..R.!g...T..M......u0f..;.......q.KL>6...0. ........g.Bs...HH3J.W....._.vaB.c..t.VXv>X0.\...c..,..1.5JY..q..5.....l.)m......'.....4.o..q.-...1.$a......5...Y...$C.*....W.?.t...N.....<?^}..-]...v.........L_.y....\./.B.&.p.].x.Cs.....q.F..@.....g6....p)Ni..s-...-\3yz..P.J..+....t..Z......Ne].D.s..W2...vI6...:6..cKjA._...=.(/..Y.;K.mD. ]q.....6.....;B...rEk....UB........\..7e.V.W....G....G.).#.gZS'&...G.E?...OJ..=n.v......o.~...x..T..[.(.h.!.g....$6wz.V3&.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\2as7GSL.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16627
                                      Entropy (8bit):7.989956137031827
                                      Encrypted:false
                                      SSDEEP:384:2XlzCIxzXAkbjQnkOJ0GmBMZlaHqjE9Er4lSkRk/XQ1qMWe5UrLCpq:2HL9jQJvmGk1yC2/XZW5aWq
                                      MD5:C229F9444806FA4C295F9FFD8303763B
                                      SHA1:03DBDAB4B9BCCA6D449FC884E2DBADDFB5240C90
                                      SHA-256:C921585A97CCC26903F6EA832ED7E1848DA37BEC5D434A695EEA2E4F9557EF64
                                      SHA-512:0F5A37270DF95333662549708C8D5DB6DC26A2981995F6186BE08E9EBF72BC9DAEB81E0DF8E51827DEB53F4354E7568AD1818A8DC126866B6A0C83B08404DF15
                                      Malicious:false
                                      Preview:..3...s...%.7.P.&.M....."/....E.........0.W$..t..~..g....J..&O...hl..n...G.O7Sm..^~4......E.%9../Chx.'-L...E`......R9.h...M..@....G5.(.M~$v...A..d.m....<h.a5Q...b.l...7^k...\`..W..w.....V..P.)......g1..L..a%Z^..`...`O... ...f<..u..$...*......U...k...4[.\d(w....u....+.....&+...<7.....=.4.~:....d.q5l./.v....;Y3..laI.`.........:d.5.jZiD...2.z6...d.0..p..:............c.<B.. ..... .....C.....nI...wTC6..G$.KV...].....P...U...J..7.WYt[zikM....`.g...pH.I........^k.....WQ...(...66l... \0..;F6RI...$..h=..l..X*-..t.=W3..G._.q.y...d!5k]4...N~I...q.Y{[.....-.dj`...........b0$x.s....7... .L.0.. .k.G.U...me.X..Z.t@.....0.~-.......^.... N...8..)1E.r[.]A.....IAa...6fa.....I.8...2c.kc..).$qy.p..p.7....^....]b4....B .$....c.m......fkYUH..G...S..h.....MQS.;C;+9.7..E.C{Uz(...{Z.x..$.(......8...W.....7.r9.&.EX.r..q6NT.k.T.a.....J,..g.jq..C..h.`.rQ.Q...V'...a....^....e..G....?..A.f..d.U^.w....8.............oC...(]t.X...^......).m..7.\..\!.........5."..K

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\HcQ5qVf.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):524527
                                      Entropy (8bit):7.999627082900387
                                      Encrypted:true
                                      SSDEEP:12288:NT9+Bg4APaFrOkDS31vZ68lKCkYouX1umAjow2a0rvSSob5:7+BASllw1vxLkYouJ1y0SVd
                                      MD5:8FBB6300F025D9C196B88667FB558213
                                      SHA1:A84F7C55BF1F4E1A46DC407EB1ABB2B75E594325
                                      SHA-256:1F858A6AD4AF8F2D0CF52618E7D5AD99CB587708765EB78403552889EB657F77
                                      SHA-512:8F7F98B72ECADFA1BC3D1C72DA5FA23411C07A96FCC393E4F91E26C689FCBFA7B3DDB3473C4C8A690732D6525F6CB1406FC67E7B150AA622CC40320BD928FD82
                                      Malicious:true
                                      Preview:.p....3....A?s.D.}o!7o.M.0H.......Y..<.$......~..H..{i...r\)k....bhG.*.t;...0...w..j)Oo.....U>.......n.G...r[R. S..Iy5....".n.v.tC..)...J.U..j*.c....(..}...=H..M.35N39U..5rc.b.[<Y..}.}.B}.'.>[#..I2.A.w:./.....d.y....TwK.y./....3.k..dF.....m.3.....2E..`......%....xf9l....=.)..t...DNV.H..o.Ui..s..."~...mjA>hU..IX6f=...........T.6..^uF9...M..k....PMu.m.Jc .7@..p1..@...*.i.....Iw.....s....y.~..#_`......"|.85..0.(.&.Z.6......%..+........J........h7i.w..."MY~j....B.\..d.....R.l..W..O..>..#. .{....R...t.\9......D9.@.;4|r.cH#*.B.....(..9.....]..../...:.@..'-.<..Q']cq.q.....*.s..@2...Q...Y..Z..)c...nC44Q.fg.."...v$u.....a.h.fA...e./e.V....".S!=...&....n..dN.[Th*-.........I..L.H.q.q"qxT..Zn,.#`..M.z;t.<...!.....(..w.,.....?...X.q)sy.....;.[5.....<]....Jr..[......(6.)..F..*6......z+....I........."<B.v.x.,..L.,.+..}.\..u....b.<Y.....6Q.[.GB..L.p.WgE..3%.X.+Me..e.^.....l.\i.<.Q.|.7...-~..W.$&o.`n.}X..,.K..V_`.J..... C]q ...N8S...:-...M....\c..w'<.R.,..)*\s

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\KOUnkPp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8425
                                      Entropy (8bit):7.97848282938519
                                      Encrypted:false
                                      SSDEEP:192:g3U3sxuaUXyCC+3mL1ql+wVjZdITxx8wbgMctLb0:g4jpGOfFdIlDbgMcNQ
                                      MD5:BC2003686E1DD42EB9269F32B02D173F
                                      SHA1:5E18B38D8626CE4764618BA4607A8AB71FA0B12D
                                      SHA-256:4F3F56E1FB022EE663B399CA94D609965693F1299255286043F7DF0699BF744A
                                      SHA-512:13822EE78D1C60EB492CA1D073461BE39725CAF47BF66CD21D5696967BCA213CC34DACF71F6D71E70E2D23F999AFA5CAE78F0BD5C40B92F907F4F3A291C80F9E
                                      Malicious:false
                                      Preview:...n.l..........u.p....Ju..........4^3S..@ .R)i.%..Kl.9......K...E.q...ga=T....)..n..&.;..j..K$.S..#TX.......d7...>._...ZW.5h24..U.y....#.F.->m|.......N.p..% .eG.../.......7.....Oc..@.X^...-)..66T.0...7Ks...6.T.P[....Y...*..V,v....K.)l(.:2.b9>vT.~E..|....|WyWqK...^..y..7u..9..d..U.;RW....@CE.[!x..~U5g..~dl.].%....}.....7q.4.&...$..Xe.......p....em..~.....S...!..^...D....j....+l....u.#...2.Jm..Pv.m.}S.......Jv.Me..JX.4....D...L..{NJ@.x..i...F._o.b.-......j.9.D:..|.e..9.....?6vJ6.w.6H.E.e.msw..J...z.p.tcT1.(R.%..>X]......<P.01,....v..r...(........K.2.........K.:2|.r..R.5.U.x....Z.%.e....4...[:../"....yq..n.1o.!c..LY.._x%2...l."m..t.....N@G...g..l.....4..5j).F.(P.......:!D..K...o.3\M.}O..e.q69.........].x._.Pz...a.V. .f.@.l...=]3...#.......YJ,...v$...."j..YlF.-.e.|gI..!......l?.{..>Uv....(...?...O.%.SY .V......|0....>z.].V.....MJ....|....qC..B|..+.[H.=.] ..8+.d.b....C....[k...ZU1.t..X(G..I.D.\.J..:0......./J.%.&&.Q+.*3..&.\$.(.X_.'..9...i....6.T.t...=)..m.q

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\YEt9Ic3.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2097392
                                      Entropy (8bit):2.8566218529165504
                                      Encrypted:false
                                      SSDEEP:12288:VWm75sB9tqX+8IYq5pPU6tBnVOfpMda5aCZYrVt1Ajs9H:VdUtqX+8IY8pM6NOqIgt+jsV
                                      MD5:12EA15F46324ABD31DE207FD457DB176
                                      SHA1:DBD7F26900032E23415EB2003B876D99BAA11EEB
                                      SHA-256:DA307C217CD14E0FEDA4C39DE36572BA3B09BF468351D30D8ECCE67A7DB44796
                                      SHA-512:5E92F19372D9FCD782EBE642970B41A946FDE799048958D237D2AFDFAA2476ACF9FC46FC33A67C3CB3E847543D1736EBBC8C3252AC8A35993E1F1E4B3A25BBE1
                                      Malicious:false
                                      Preview:;s.....4G.."~S/..}...,...!....W.....W.\..nt..+.....`.t'..;..../d...ob.p.....!.........2.E~...o......p.....".B...}d2X"...].GG.P.1C.p.B..j....`.....`5........c/.7..T;....3h....E...fX{...:..............}+.7].Z.....Yl.....2..m.0y.lf(.k.B....;.<O|6Y.......k.s.9..6...>...s.i.7......f.l'..f.|.... .R.O.\.csW..3.}*..#.H0.!s...e=.i...7'.....6...|....<.=............Y.'U.N....B......'..B.J/..r.{P..`..^..Y..p..Y..a.....U...,4..Y..m.....Y.?....c....@.{.".....N.bs.(..U.W..[H..^.Ek:..-.>G]..J..!.a"BRbU.....d..Y.....,d#.d.l.@.6R....ef...Ci.-.|+......r..J..G.{F..[1z.v..1."..e.I..Z.p,.h..M....CI9G..>........l.+.&...h.n.o...Of...n7....$........O.?.....s..>...>..q...8..q ......hk;o.7.%.]T..4Y....7.*.<..6....l.kI..{....e..#r..Rt..f...&?..... .Z$hg3.G.....+...*..]Qubw..sm...pz.!..._.L..f....4..G...2...N-K.cJ..0.:*..(.*K...1R..4..kl.A.X.Hy."?7.D^,.b......S..I?p..$b...\C...7.....y*.z......)<....x&.....l....~.5.E.t...D~A....p.B..]q...[.v..v..bx.I....N.....|...0bBr -b.~U

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\YKufZth.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Secret Key
                                      Category:dropped
                                      Size (bytes):524529
                                      Entropy (8bit):7.999653970345527
                                      Encrypted:true
                                      SSDEEP:12288:5elWGVpdnZ2zaJCh9bjIzaFfjNj+RCVTGpag+LUQhx1yRm3UGpwO7:5fKpdZ2zaJChZj35VTGpiL3x1spe
                                      MD5:AC140C26F8F40A76A7CF1707378FF66D
                                      SHA1:7510261153B04BDD6E032AB96B5B0781E114F1D9
                                      SHA-256:DB25B995C2FECD7D0F741F5E0DEBF07AFD2F6FB96B2513FC31BAB2E5C3CA09B1
                                      SHA-512:828F7B0F65F0AC1A48E1D7AD4F2B4C71B4D65BF70B277590CDC042258CACDE1A3BD9695A82BE17F79F0E11714692E7A7A68DDC640CF0EB62758ED0954D689BE2
                                      Malicious:true
                                      Preview:..+..*.-U.!...}...s.m.......~...U.'......,...}Qu....*G.ay.....W...6.I.!.S.[...G._..m:..J.X.......-....5.W....2.k..Y....[.F'../.a.:s...q.u.B.......e...../frg.../yK..y.\...3!.X....._..~..*.2..I.q..[.X.!=.s%....T.!...1.'....fd.E^#:.%.oi.....g.........e..HQ.I.a'.J......S|........~].b..........3h..O..>.@.7.....=\.".....n.f..n.P./@.,.%.}.@.3.EQ..=...>Xp.BU=..O..j[..."...#.qQ...k.."..?F..#..R.[../.F.=fU...s...1o...F......*./JQ.@)o{.Us..=.)...3>...S..|5.R.....0.........#.O..?.........p5.5.Z...$...l..f..P.....q...-0..8......j.........Z.&...e5.=.....H%.T...N^?E...]......y..W.8.w.....&...#H........7r5......)M.s...."T...0W.U.....C9."R+..a.b;..6.......&A..4...E.s.7..2.9..Cl.muA..........s.E....H.0......;..c\.JB......&.^..Rl*%.n..@..Ci.-&..@.b........"b..R=..d.fx......nH..b......&y+2.v3..We....0.N.t..(.t..yJ.]......5f."......U..@@....>....t.5+.l..s..?...j.m..2.X.p., ...\.zBtj....n[.....f......N.Z...!;..[^E.W.E....\..)BZ......9K..O3..\....VP.x. .S

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\lVUf9iz.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):524521
                                      Entropy (8bit):7.999655398960372
                                      Encrypted:true
                                      SSDEEP:12288:Fwgsii6emmB5JmtBmanIEW9RTcTIw7RUPP2:Fsii6lM58tBmanIhVSPS2
                                      MD5:E966E07AA93F49A10648116626081BE6
                                      SHA1:3178C0CFBD1E72216FB006047AA81521CAE163B3
                                      SHA-256:E749DA8007221ED2D2E79FCE4CA7C01B57BF0B1A0A0DBD1BB70CD78E6C511683
                                      SHA-512:953BED58AAF7F5CBF6599FE00A88415D18B266C7AA6DB8FE85EB6F33DB279EABE6C3B0353B9A59B2A305B61DC51D7F849D9021825FAB7D49F299A25033CA4C50
                                      Malicious:true
                                      Preview:..:K.h.=....p.F...T..@.&. ..H..K.,...6+..=&.v5....B......h..e......p@8.o{4....L..#.=...9 M.F...P..A...H..#GL.R..S..\_TX..E.r_J\\.Oi..]".>..2..="s.U...i...G....G._.m>..Pfc".p.z!p.OY...*.....<.]....J...".4#V...\...}..4."D.J. ....{...?...vX........4.M....}.E*.S0;h..p...j...`....srp...9.$..O....,r...m.{....'.Hj......5=......2....?:..7......5..k.A|........Ib..ETJ.....ev.n..<..U...:.$....b.O.}yT..b#.d.(m.9..qB-..l..O.X!d..g....G.\./'.a.P.n.S .S...n-..V+Y.H.D..~gDfz.....Y.nC...#.:.].\../.5.2ZD}.R..1.?rYm /-..+.D..qA'}./.8..{#.M2+...(.X...._.)..e....d_....v.."..k{. ...C..6_.......;Bw.U8.q)5...2r.o.02..M]om.*.@i.y..rb....7.E.O..zJ.n.V...)h.BX..kY).([.O0.){.s...<P...yP2..-...=.....{.a.G..!.V.......+7;..A..X.oN...eVp.eu..y.J...P...d.tS..e6.#....0..R.[.(;.............o..b.#.~..8.R..&..L1.8Ml.?.0........3...........3...B9...)..@..arjT...k.......Zz.R...g.g.....p.~U.2`X1.d.cV...q..|).#5...&...w5...]..(/..../...g[(..|I.....lF.bP.=...$.5...-/H..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\00Ao58v.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37273
                                      Entropy (8bit):7.994913157557899
                                      Encrypted:true
                                      SSDEEP:768:ZB9c6Hcslz08gB/bcKq886gOAgns1VpACzUUOcb3es4oBYIcISMFl8wUG4:Nl8slz08gBzw8A/1VKCN53bxSQ9U/
                                      MD5:5C8F4106DC456EAA44BA3A4C39D15A4B
                                      SHA1:6A15C5F2E7455BEDCE74D6F5D0D39444115665C1
                                      SHA-256:43186226E5D148EE0C8AC4F1934ADD6E7E6AA9DFDD72DA8EE2C8A0872A28DFD8
                                      SHA-512:0BB0A4CC84C2F3D4B413F72AD211AB517E953BE16553819807AADBEB89B8F5C34F638AF8465612928FCCE4E9B82CF5151DF608D5C6A5C09ABDBB05722A0CF4AF
                                      Malicious:true
                                      Preview:..Mz..PC..z...Q5.%u1+..c..O.o.O....kj.$.}..y...O&.u.*e....93-!.....=+&......ck..w.1!.~.........W_....^.H...s....+b...$....7w.~..=......l&......Q.!.o..[..1...4...V..F.ay. ...'..p9t&.........G.(%....>........Au7O..U....".z7VZ..>.....O.a>......X.%=...R.H....Ft_zJ.g.{. I.k..roj....W....:Ib....<e..LU.......... ..r...v....\A....I!W.7...qw.?BB...._L...+..I.@y...T..g...B......2A.n.0.....MF...M.".o5.ky,^..^Rd?E.......~....-.~.].......-.<3..f.q..I.A....Q.*Q.hV.&..B.Y.xt....{.>d...a.V..................ceC..!..(...A.z<.....:`S...t..M..M........E..2.8W.....4[}.:.K...S.....V..`e.rg]DE....5t.....{s.)...8jD...`.j.i.......9J......T.:...l.D..-,t.......]..*...=9'(;7E.q......!......b.X.....,c...a...K.h........j..(u....:).....f.t..).xqC\.,..I..d_.[.;I..E.9ef.V:..)c..d....O..y.........O4.a...M..C.e8~I........L..b:'i}.Vk^8I.o.[(K.c.j.T3.dr~R.,....w..MO-.y.4jb..|...:o.=<...s..,xdi^d0.ityb=.......S.=JWzIPC..p..#n.l.w..#.R...P.=....k.+. G....9y...CU:.k..tV

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\0iJf6oH.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37300
                                      Entropy (8bit):7.994601514779721
                                      Encrypted:true
                                      SSDEEP:768:bODzk+3fKxJFzLt8rAOLgPLFdcJcDf9NviUfgQhQD5AGdX5+:ew+PKZntnOUzcqDf9Nvp7QtX55+
                                      MD5:73F5542CE35BF4FA5792AF88A4D7C73A
                                      SHA1:64D0733C1315C2067477A6A640C7B311E0325D26
                                      SHA-256:8B4CDEF67850711421576F60CD95A357EEE8ECFAF2AFBBB4B9866E8202EE3BFC
                                      SHA-512:35EF7F436AC10D27D60476A9F14450B3BC3A7F48A8E7DBB421D64A27E9D1426009D84CE0289A962E206689237D201ED313BB07F90B023DCA194141C7AAE07AA7
                                      Malicious:true
                                      Preview:..w.d.7}...l.!.#$b..;....p..F.Q.Y.BP$=.U...0..c..kGh.WR....-...IO...b.Q.*|....2.N.......N...j.'.....UHj..F..m..8..X...&7U7.........y.d.D.Z.4..;...ut.n,*]:L&..e...}.Rt....L..M.vzi.s.....o0..+.>?C...3..nQ.+.c5.'V.6.W."...........F..c.Gj=..w..Y.CRR(j...X...Y&..+.9..w-...+.....r.$.:..tt.q...........$.t|..]...7.T...D...2x.m.\...0.-._..HO.z...?.0...}..L~..ln..}.#Q.Oy...J;....v....~gA...\......w..#.+...........vI..$....y$O.....HO.....C.m#...2K%.....F..:.#/.r....<ET9.etc@...3.h.Qc..|.2..Q.n.....m<..z./^.Y.+.J.[....$;.D`...7..y...!k..8v:mJ.L...C.....!m.:.ww...F......8.mL].[[#..+..:..|.U..n.}ca{-.O..[....u...m......FH{>...jn.v.uKik..N.....}......g*....zy.`...Qz..Q.......5.e>...Lq.....y.....;R..* ..0^{.....y..7.Zs.(...f.^..HO...l,.T....T...^...od..B...{..:3.F..g@..*.=..}.,`c.|....-5R..5.a.<.%f ....]..m..~.V.A..O.......^.....k............'...k............@Xb..2...m.../.%ixS.................L8...22........Z..A.*.S.L=l..N.C....=...U.N...N.....`....s

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\1555SAM.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8184
                                      Entropy (8bit):7.974442434558833
                                      Encrypted:false
                                      SSDEEP:192:nr+eo4c2E73mzT02aeAQR9s6PQnL2aaardtf3F:cr2C3iA2aeAym6Pw3asjF
                                      MD5:79EBB99A6A82B0731C66B63529E6AC94
                                      SHA1:AE3BACD63428BB1CBB718B68645B06EFE5F90C04
                                      SHA-256:175D60029F71DA84F1BBD4A1B8676DE1A77A5A1A374AF893A44DD56E412C3269
                                      SHA-512:42E049161AA2E55C8F9A71989163900A5C54587A8E78F86110C8C6DCEEB0924D0F1990B9A2F074C697C8C9C8663E33C7373C1F9B16D04715B8F690CAF6233A3E
                                      Malicious:false
                                      Preview:.r....^{..:._..v.^.4..l...... -....Fb$...1k........)...;..GL...P.$....B......O.....4.q..{.t...0..(...P^..s...G.x_4..p4.Cy.M..Sz6.>o.q5..1....{..r..o......<.q..6?...,/q@.q..U0.M;.:.....|..\.}..X.?..+..Jp........t..[.....E..,.0....B.*.Soy?....../.c.p.{.y.gIx}uQK.."...u.\6.w..=0#dsz}..=.{..B.0g@vL.......{..].U.[.*...3r.`.j..a]ZC..$.]+..b52w..i4..xP.4.Ll/..F.&...`9Vk.h~.g..Qp.....63.9R.j".M?......@{.K'4...X..V..(..M...R*[....L.|..........._..ZN..{|.E.....0.....a..}.Nj.%..../.l/.x........B...t....A...[..kez9F3u....E.vM...c".....M=...{..._.i.K..M...}A....'..po;]..,.^k...2@D.H......Qq.C.4.X*n..U...J..7..-.;`.2.;.%.fX.a./...s..$.,.......C?.F...I+..@.fmI......IK.Nu...+.....O.j.Y.QM..aB.t.DU<./(.ar......r.'..M^...@....,tA.-.............T...H.cV.5.q.% .J~.n0..lh...\x_M..f.-.....$.P .]....m...pM...U.;E...h....rZ..d&....z.4.......,......pu..?....EO7U.%B;O..W...s...`.U.@....6.$.a./W.u...&?...\.!.p.r.Q..OX|j=..=..T;u...7O.....&Y.\.Y>..GU.6O

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\15mukzw.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37314
                                      Entropy (8bit):7.995779889185414
                                      Encrypted:true
                                      SSDEEP:768:dMgHhpG66NDPZyleGCfhVv2h4AT+n89fIJ7VP4SZiMdJbHcKyxrdu:dMgHhpG66N1ueGCPnAT+naIxVP4x6b8i
                                      MD5:703B66AFBD84C1628EDFCBFFC2EBF709
                                      SHA1:D3102086FBCF0D1E4B2371C8A08060F61B8DE6B8
                                      SHA-256:6B098B3D0F838308B0347ED82F5AD9E06AB0CA2E0935BFD7A2560DF08AAEFF62
                                      SHA-512:F23EA7EE7DEAB00C255C5F1346894F08BFEFEC7DB3FC49DDFD762E6C4981B878E6EF1C910D8FB6481059ED73E99F1EED502650E05D6885CFAB859C65F9741B45
                                      Malicious:true
                                      Preview:....."[...UV.e..f......e...$&uk-t0.\dgw.*...>%3.j<...h:..Vf..Q..... ..Ye.Y.lC&-..K.B."....Ll1(..".....}<N.FO....6..F.&dR.D..+.$...I.H..o...>..T$cV7.q.&2+...x.C.f..0.V2..xTl.4.?..D..]."....,WT..souz..C.`...e02..`MMJ...$.(.D?).F^.Z]..2.v.=_K...&..L..X2..}..W.|....g\.bFn. l.d."..~..0....\.......r..IF.(..7...W..@..g...j...y.Ifx<C..h...gw.Ox..I.#hx..0..G.....3.z".~....-.L.....~..B......&.!3'.....P.c....NQ..z.F.:..N...:.kI..J.6|G1..@.jd,aA....(G...n`F...=...g....o.{..*...\......0...O0>z..j....=zy:T..T...U]_sd.x...B.^e1.s...7~"'....p..SD:/.p@f".[.....vZz...p./..T4.>.mF4.._.....hwm..z.........U....u.JC.,..-..(.p......43....o&..0...s..U.......OA1W........%)..f.....u.r..W.`A].N..xj....T.8u.t....{7,...@........................F.0.e..-...:f7.p...@._[5."........>..}?...3...V.#.0S ...{.N.}.=<.Q.B[.(.../...J....5..Y..U..;...#SZ.;...>.....[...:(c..{=.......'.(...&......r..A.....7...x.....8X6g2.5.%........g7......-.t..5....\.qX....F.......Sk....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\1OhAzBo.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37326
                                      Entropy (8bit):7.995365984712412
                                      Encrypted:true
                                      SSDEEP:768:OBRdraQ6GENG4+3FJQBK0oUXjRMK/MEdBPNRgkzotEgIxLLnDQfztA:QUNVcFX0LtMElzVg2Lncfy
                                      MD5:804BAF21F9CA803B34574B18C79986B2
                                      SHA1:89C654F87E4D7359601D954B54FAB12FD4BC3BF1
                                      SHA-256:7CB309493923E76C275F93C9D721F2AF88E410F3E055375AFECE2ED69FA84983
                                      SHA-512:482365A2BB6F5B5467B55745A180E5848FAAE0254E346A5BF30DC61D827F7B32FFD6DE7F25E65CC0872E79FCE5ABA1BC1C5682D71E6A9F9F94CB048AB13E5916
                                      Malicious:true
                                      Preview:.X!.]....8[._A..W..w-_}`.,.e..q.q..^.4.=fV.k............h.ep.......N..$.....k.<.n.Q7._.o.m....B..#.m.....Of.a......!..o.[...Y.`.U......Z..5E..p..Q....Q......byq.....@..S...Jx....,".......F..{..a../.....................Ki.h..hU..r6....P..u...r]..X...p..;.gb..zo....T..{..*.,s..f....)..}.B.X....Hm.wP.....\c..1..:.Qul..I........#....X...j......N..?......;6...$n~...\....2Y..m.....p.sMI....<...o...l....*...d..8"Ko........./..A.....w....?.A=...|.L......=.w3.Z.3..4<...X...9..0.u...J..E...f1....O){.b.....O+...S...F.I..}_.......O.*.;`.q-....TI..`.jQ..L/b.'...3b6'.F...-..........jB*.Z.=.....z.9....M.x.,...n.j`......v.@.v..P.9.1D.O.8;...6(..._.Sr.a0y..[U^3......7..d...b.F..y} q%...S.a.b..R.^..=..L...V.&8....[>..".....e..H.t.......K.A..n...F..2....J[Z. ;K......Q...|..J..B._...2I.}.52G\.....;.i...+@....A3..X.C...tsh....4=.F+..Q.R.X.[./,..I.Sl.L|+..A..)Y...D...h..A...w7...G........a..%.3..}Jk~..Kp.=.@.5.w3I$..bGnk.Pk+...+....T]. .@..j.O}.p....s

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\2KZQdfZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8168
                                      Entropy (8bit):7.974608026798842
                                      Encrypted:false
                                      SSDEEP:96:dOQS0WgHJOkDn/ObxYnS/22HgwOfMTT72Bxs0ZoIjBbRUQcdtg788tgAg5csEqSh:ddSniJ/DeH/24Y0qN6QcdtA8O+nM
                                      MD5:8646331F7ECCC376AE94373CB304418F
                                      SHA1:5837CC3D2620C2248E476639021242E97CEE8CE5
                                      SHA-256:EDEFE8063126AE8CFB90C0165FBEA4763C69DB6D00524BA2C97FD465F73238B0
                                      SHA-512:4DC44EC77EF20F7597F2AEDA1018C7FAD7A6E340606A1D3C6BB2A2211470465700B5A2BC2B07BF850DE7497752A89DDD97CBF35EF58AAD23B83BF6DD220A5D23
                                      Malicious:false
                                      Preview:.K......[....E\.;...../....3.........q........5.......q..eW..C..........@.....V...a....%..@fN.r...\.0.....$..........YJy..x.$...."H.....GFh....M.$..........~.....`..El9..,/r..Pf..hj^"P....rf.|Nf.D......|.].y.j56.G.(`2J...W.........b3..J.d..V..-.]..x.p..Xc.r.B0.!....'..T6.+=S$..b..|.gzBF....(..!...T..+..F~$..t..n..../*.......bZ$d...Q...Uk..q...5[.}..;....K.sKd.-...].BJ=.K1G...oV.r..d[.E.....W.VN..B.5.qS...'.Bm..u..L /ew.dH.k.........Q\V..~3.q....pq..)4p("....Qx..4..p.S<`.ad..G.......5h...`..j...N....1.qS....e.B..6..0....R....7.. 1.d.|.~..e...fa.s.......G7..[..#?.b.....{..<.84.....-].Hb,z..b..Qo.{E......e...b3..`4(......(3Y.........J.k...Eu....d'%.,.g.."/._?2..2$.d...Q|n6...g....;...g..U...r}../...No.....@.....,......xTO..].....R.=...oo.8...{.qP"......#Us.j.}D.hWQ$.\.".U.....+.0+.)7.H......rE.=2...B....~......O..K<...V....v......n...Y..P.}D..mv..\.(... V..#.c`.a.:..A.......'...M..zT..(...q...Dd.qN.!.pI.......R..3`S.v.#M.d.....s_.F.#J...x

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\2yIcAqm.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37307
                                      Entropy (8bit):7.993950452623084
                                      Encrypted:true
                                      SSDEEP:768:1hxS5WFSV039mtAr3REZ2yqZ7GysPytSYpi1mmX/:1DkVGHBO0Z7GHqxc3
                                      MD5:3FB3D19522DA1C8BEEF813BC084ABE2C
                                      SHA1:706D3F666C06E2CB0A6ACF4DC98C3FC92E0617D8
                                      SHA-256:759DA41CCD10E7C3009C92C62430C05B96685A3DAB3FDF4BEC7A6EF0FE12D256
                                      SHA-512:A798B3BBF4C0BB6F5DBC1543DCC0123DC33DBE8E5D871316EEC0A55E43CD03E4F8E88A7225DF24541512CDDB00556893F5C66E7C96D65D990C4D76F43FDB6599
                                      Malicious:true
                                      Preview: ...Jr.{o...x..........7..h......B...._.9......Y...>.....-.......V.H....5.2.....jp.i.9...\,\.x....G~.^._.......Rh.}:;.D.-..e.z\/........lU.o1...V}#.[.k..S...Q.....`.(.p.&.bDv...&..[...Z<........6.Uf./.7..3.h..^;..V.."Cl..FC..1 ..2\..!.7.d?d..Ot.kN....v.wH0...k.A`j..C.*.G.>=..zd.Z.XDu....u"../a....h..BR.n......4h..?...,.........Q%.....v..~ .R.xW..0..8.HM..K......o(..c;........Sp....j.-.......i.v.......k_8.{.qX]dqL.....o...T..O.K&..K..Q:W.Uq......._.Y0.2{'......s..........._at`...>o.R J...c?rZ....D...#b...n......Z....'...i....T%w.........m.....3..d.Q.L..;...u..5......y\...i......*..5....D@.Dy.kmenI......d.m..2=...1...(j..G..f..F....'..*r.C.!..-.hQl.....>.M..G.c.%.!K...8...V/a.;..Q......O.F.-.....|...W...H.>.....(:\H........|6..}.T/..K.<.....)..Q.O....v.5,.N..Vk...Y0.'/..}..C...a~......s...x....w.....8(...x...L..._....d.`f=l..!S._.....G....tw..[..V.hQ..=bW~..p.-..\C..\....Q.&.x].<..Al.Q$Y.*.c.h.....Q..!".AM>....@..f2./..1~9..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\3FlJDxY.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37301
                                      Entropy (8bit):7.994813393967703
                                      Encrypted:true
                                      SSDEEP:768:EVJQahcIQtsBiyuYap5bXJFWRWaGRMm2nFJy3yvSLpdu+vhKO4Hi:EVJQacsBi4av2MtenFJ+yvSL/ughF4C
                                      MD5:5896641457FC5F6F5A42D8ADD355658C
                                      SHA1:D2228D0F81E13C5C92C95FE488E8AEE2661FBA6B
                                      SHA-256:2B613AF25D7FE7AEA44B6AB8BE27EF754FC7C060DCE77A927CADDA42D9397D48
                                      SHA-512:EEC4381956198B58BE461FEBF9C26A51166A455A03871DDD99889AA56B23C2931F5CBE8551505EB6CDA773876F8D503F98AE5B5474C91DC11D82B3C11C17B1BC
                                      Malicious:true
                                      Preview:%p.....;.......8.J...J..g%..!...fQ.a.`\..Xv)...:k...........Z._....*.......h~.B9?G..2..D(.......S.....r.Dm..x.<..U..*8t+B....g.......jMzr.<.IJ.."a..nA.IL,......m.,g_.........J...*...._.<{.....$...cnx...K..2hb..e .X.,...d.......C...WV......c..d.w.N..=YJUg.M....~...U..79.3...A..J..&C@.[.3o..Y.....rk.v1..t.X5.[.A.....H.S.....a).....].......#.l.........Jn.._..J.........Z..R-w^...-\%.....|...=.zz#....&I...i....m..x.W..^H...S6....T*re0.!.....]!o|.,.Rr.2..\;...|lITd...{..?;...7....].h$...H.E>f.`..PJ.....y....n...rH .....0.6=U-.Pqa4iH..>...-.e....S0jD.R_Q.d*..R7..=.s.....4.7f..VL....\. ;.Q.4Z./.Q{}6.WM.:.3.K.H. .....Ph*..tb.-..y...B.H.lorOz..*Q4%\Y<.H.9........~...nj;(h........:...k.l.e...vvR..B.-...N..l.._B.<..[.d.....U...&=n..[......."..~*}.t~...Y@..9g...7eo.....K...Y...#..`.<.g.&..%..Z.......}...#.D.g.<\..Ds....`%"&PoF..u.M..`;(..&..{...u...PP.NP.H..Lf!..#...1_...~Am.... ..A.....!6....7......o.P.L........E.`I.I....X]{.....9...<=.o.............

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\3ld25BO.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37283
                                      Entropy (8bit):7.994255238454044
                                      Encrypted:true
                                      SSDEEP:768:LfEEoLdzTKS8VWrthEU1qrx4+nFfDZe5gjp2tYU6IS8BNpBs+YJ:LcEoLdzTwVkrD1qFnFfDz2tYXwXpYJ
                                      MD5:712B7E3A6CA777D623C44E3939E92B4D
                                      SHA1:9DE34C72F0081F56A2E006BF3DB96BF378043318
                                      SHA-256:845EBC9A60E17D40DFE4346482CDAC5A71D9CA7C20DA0A9C12CA4018375F64DE
                                      SHA-512:B5918920DAEDFC911F7DE40402CF29940C6112B2AD6B3D8406BCAE9B8F872AC3C62B2C7773A69318BF4082360359715103C79B0985A8CCFF2A53446016352291
                                      Malicious:true
                                      Preview:...*...~s..g..2...F6.Z...S..Oq7g..*...0.pK.b.Qs$..4.B$.9......gM..p..b/y..xlW...<x...d.*.y...&<.mf.(.........C../.&.r..E.%w...%Z..|Peo......IS.%..<..,<..f....Jfy....4M.]>j!...O...R...Z..5..v....T./q}...L."P..Ek.......*.EZ..Qz.y./h?_.#Y..g....DA..&s.......W...i.v.)SG.CJ^....=.'d1{..Y..b.]RL..s...K;G...x.(..[.;._.ESa.............x.....UE..F.C...,lc i.F...R.S.V.).v@....K ......WN.U.....o......z.\.X.Yb.w......(..d....v.S..`k......j..{...'.*F.g....0....0.r...H.n.J..\..k}W..n.X8..CH......ZgN....._=.8....;......[...y.)+.M.|....Q.O....G4.T.j....a..... .#.m..Q.D#.n.m..7e..7.r.4.6..O.9....Wm=...."....xO....+eh..h..zK.8..n;Sy.].m.2..S..=g..q.u.n...6..>..%...&.?..m.j.Ak$...axv..%.A.,k6...(.\)e....p.z...&C..2....#s2....&4.A4i.^...j.........pmdUa.......e.o.4.....8...U.s.$[.....OL4.....sm.g......m.?..{9M#8......0'a....\..5...L..y,.C..+Vd....Bp.[;..B.tIP{..\.............".`qz.G..p...JF.....`m......".`........L..P.N.3.Y6n.|.(*y..{."hc...Mg...y+..Z.\.=..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\3n642bg.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37295
                                      Entropy (8bit):7.994767723000228
                                      Encrypted:true
                                      SSDEEP:768:HdvPVRjJ0ntyIEIRBg4toB10W8lmNviv/ntI+E8vV63+1XqwOb5GUU8h:PZ+r57zFv/tI+Eb+V0h
                                      MD5:5640CD76802719A093EF37B91C66949F
                                      SHA1:4E6D2474B229836A00EC1E06E57CE7BCF01301C8
                                      SHA-256:EB85422E9FAFD18B43F4363C988354680F4F1B53A956A963E21A66CDE409B953
                                      SHA-512:E4EC4B8CD1C57341B69F759D4518746DDFED45B4B67541B464684C51518B0BA027502FB35B17CDEB426DA039AB9E760C89C3723822ACE5D09C30230F7FCE97F6
                                      Malicious:true
                                      Preview:-.~.k.?.dqc....+..$.$z...- L.-:.....a....D.{.}(~.AM#^B.Q...e.06>@{i..5t..d...P.v..%.qi..:'.....RL...V.M/P..X....a.K..#.......z.....6...B...{1w("....~x..D....H.n...<.W.7A(8.......A...)).[.iN......3.^..d.....Tw......U..d.........9..:@...J].....0.KR.Q.eMg...+..S<4.n1l.b.....>.`(....47S.O<..Z"..'....9...w.._.v6.s..3u.2R+...<L.mV.Y.&l......w....C...N.y..Z.jMp..J..J.OO.u.J.mK"...2.&........r.:N#.o.s?M..V..G.....M...K.[..^8.v..22D..^.c.Z..k6.n.lg 5.....p-OuM.L..n(.2.5YI.....Q....`....2...AZ0.v.I..........`..;&T.]./..&.{<vg..eu....b...r.. E.I...............z.x0........\n..Y..9.0l...NI....)1........$c...QIf2..p...G.^..I..#.!..!.@..x..5..C45#v n.5.w{.....W>.....;.}8.8D..C....#q..o?.g...~..{..?..e.pC.X<P ...M.v[He..x;E.`..rM@.'E.H.>..:^H..Qq.Q..[O.Lq..Z$....>...*.......6.......... Yg.Yn.r........[7..R[.Z.Y.7.dZ.c .t.bu..U......r.......q.R-p.i..Q;....ax......B.../..Q..i|C.g.QT.wa...q9.......z.{.....x.[.......8K..y..0..u.{nm(.<R.t...]2Q.wL..]..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\43wXwns.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37310
                                      Entropy (8bit):7.995228651742069
                                      Encrypted:true
                                      SSDEEP:768:Ny9bMS5Dtezu6xpIS9Ots6rsYsQgDOsv8L/33uO+XN:N0dczuwISkDgim8jOz9
                                      MD5:C32309246C24C5935B19CA9A9C7E57E2
                                      SHA1:3A36566A9E5D3FD3F801461A81BBDDA22C12EA9E
                                      SHA-256:072654E9CE49CE1D3F593BA43E779748CEC91FF124F3627556379DF1E8FEA209
                                      SHA-512:D658419FC7131D1C32D3F8A2444107EA471C2AFF26649B2DF89A949F47ADC5F1EA4CF08582854345DE2FD1D200CCA6E301602F900B98FB78DCE57960A123AF0E
                                      Malicious:true
                                      Preview:.L.-yv...y(?........._w.9.........=...-...../s.q6&...2*..|G..8IZ{bS....O...)B.?.%..&DZ..M...{X..T2......^.9J{.[.7.b..KN....{..L..h......jv.m.3......\R+9fL.8.g..&.."mZ."..>bx.[R:....VP....:@].6..SG.3?B....T..........6.zZm...2......J..P..J"..Yk.!E`MS..Ps.I,.L..:.1..xq[...#.;4..&..D.Q....v....!...:'r.4>.......e>.@=..q.7..#J .a.......T..m..}.w..W.Lh..+.......fe....).'..V.l...|..T...Bp.......|.(.....2q]......T.9I.%5..%.4.k?...m6...~..}maS'....U.a-... |\.....+\..6.e?.H.A...... ..S.(.W' l.........H. ...>.....b....h\|:.c..X..IXB.....2.9...;.....@...a.\9?(.Y....*.h...vL..i^..L......5A"...MF....!....z.........Q.~.[.<T`..8.4.-..2/+.Kj.".]....f.lF.,jc.).`..D.g......'(....yH.."7...5..A.Yg....Y......v.V.....#[..u.x..$.Y.....K...@....FYz..-.ktr...J..;.p......s.il.;.......Is.S...._...g|.$...x..}..z.....w.....5..f.=..9.e..&......<.qFcf)C.....<].Y2.h..'.Dn{r.J.]L.$.vu...Lq.k.9."m[!.......5.X.<g.i...+........(.0....tb3......-.F.:,.f|.....*...\....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\4DM2Gmv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37325
                                      Entropy (8bit):7.995578940294012
                                      Encrypted:true
                                      SSDEEP:768:KjZRwo9pLNYbqy7S6rXKxLWC45oOrl0PU50yxvxEa:KjZmorLNQqCDGWbdrl0POpvxEa
                                      MD5:37D8F2B281651747E95678D5C3B340C5
                                      SHA1:28C9190416CF3D290A6CD0771D58E969A17CB856
                                      SHA-256:4BEDE30FEBA8411C11B733875AF3131EC85C081F62EF6D78B743F80C80EFB181
                                      SHA-512:4F65DC80C02F881B293FCE452CA3859DA68F9AD784E3D2BE07ED323700871F4BE3D589681547441F3CAB4D4AB48435EF54998EC6DC20554CEE0B310D5E6A1B3C
                                      Malicious:true
                                      Preview:K...]...w.y.....p....|.C(.(.f...N...=...-Xq...T..[*Txw.;.MA.X.I.c.\..T#`.2.h....H.Ti/.".....+..P5...x.>!p...?b4]......c.......?.t..A....?.v5.....l....:M..>...-3.&S....\.g...V.X.mV;..T.C[..4..H|...........>1.........]m..N9../.et...8S,.d...).9.d.W.f...L5....3..Y.`.9.&]..5.f.sHz..y..`k..,..D..ci.\....0? P...T.y..G%....A..GA+.1....[B........P\....C..4.O.z U...E..d[Z@V..x.I.N.<...w5,~.em.L>r2C5.JZ}..yeaW....J.6.W..}.....c%....(..}./u...&.c..K....MCh.tV.3..*...n_.%8H.8*.....\...\...T.....@........eHE~.j ..0..}.%G.H..W.X..t.!m..c6.]........_....P..+&r..'}Jq...k.....`*v+|.+....q.x`ce..`tl_....0!...Z..~^. }....i...se(....~...1.............$o.J.Y.......q.xs.J......y.H......i...K...;0m.....(@p._.....?.m..V*.....hA.eD..f.m..]k.A......}M...)}#m...(..U....+:._.E...;. >..]<..U..?...]Z..u?....w..7F.......x.v_'..cj.....a]1.<o9|.......D.....) ...........Z..b......0.>....%..Vs|.........q....e..1..{..5...?&....9.(2..\s.....a4...U...../.......,..&...z.<.oB....T..M}3..[a11U

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\50aD1kQ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8170
                                      Entropy (8bit):7.977073456642741
                                      Encrypted:false
                                      SSDEEP:192:kkzzRDV+7pLBw8PGBKwn6RlaKWZrIRpay0iTb1DT:71spLBw8PGHn6RGV17ml
                                      MD5:7672AFF9667F6AFB83C8AAEE240934F5
                                      SHA1:A9A34B4DA7B3512B55670DDEBFDC3583B02F35A1
                                      SHA-256:0CEE2191C2C614BA293D775593C763C52FB1F2163071D5E5D669A702A2CB91AE
                                      SHA-512:1EBD633D0AB5C16283DD42D03514893D74D4AD0EF6F019FAD689E7ED58C697D17C362FF229A969487BF8BDA4AEC6FF2683A4CC972F19A1431F5DDC07D5982B00
                                      Malicious:false
                                      Preview:{...p.......`\s.T)..1. ...@k..X.S....Y.._.u.]..W...6-]...........X.i....J}.&.:k.MfmM5L.l.m.0.(,{w...ii... .jy..^.......ZfX..B..3..Z\...u.5...d?bw.;c..w...-FD.|..i+..*.L.\K.kM1.a...iV.h.xX..(..P....xcpl...m.....S.._.....iY.~....[..:.].0.. ^.....&-...Z.ejn...l....WZ~.@..4WXn....z..9X......dpgl....M,....o..B..2,..6.I...Y..[...A.........,,Q.g..T...,..BI.<I.?......z..d..7.q...|....'.7..L...VG..W.V.....DQ..Y......e...t2...n......%0.D0J-....BkE...c.../EW1.......'..r..\;.t..5...v.?....E..S.e.~i."F.@P4JT:...{...SO...M....c-9u"......%]..WNq....*..y.d..jP.r....]]..(8.2...t.E.i.;.?r+..-..?1.E..@.*...n..w?..>)[.49.....O.4...."....+...V..6l.G..41.5.Q..aw6?.K.E..nM...0-&...............~.8......s.7e.J..i&...b..;H.._ .V...}.A"O..Sm.+g......T )_.Vm.......A..Y.b..kWG^jM7.........T.*.I..?..J/..K.n..O.@.mz6.R...k.._0.hO.#C.o.... ........L.#..~....8x.@..p.K..Z..z...S......x.+.....B.d.#.;.A.P.q.!.....6.[..<.Y.!!.F.zO..!.}_.....^.%.......O.....E_.%..#..d

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\7I6rPrM.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37285
                                      Entropy (8bit):7.994694311359833
                                      Encrypted:true
                                      SSDEEP:768:XxNjW79wG776YB/BmnKTQSSSj9/p34RTWOskmQVxIdGF3kUq9c:XxNM9wq76agKTQSSSjPoRTWOf7WGF33
                                      MD5:99EC5A2EC1835663B4373E05C9906228
                                      SHA1:8499151F166FEBAB912F453399DD6F2A5F60DB3A
                                      SHA-256:DC3D34BC7902EC150A2ED24592AC6FD074049E3F91F68BEAFA6603EEEA5F75F7
                                      SHA-512:B15A027B2872920DF7C487F022FF5A99E3016799B0AA00AB3DD4A4B3F0C8ED9E176B607695AD2782822236D2BA0497D220C6F4C7634B45C0C2757ED75E60FAA5
                                      Malicious:true
                                      Preview:.!Z.....07....Bz.L".^Q4..M.@.]..B7x...W..|.N....U~.z......g..vP..aDY@..k.Y....a.j.e.!Q.5'.;...b..i......<....2.....2.(..(Y..'.'.A\,..._.......D=>.P...9]v..]..;S..O..:Z9~ .j..])..>IM....Z......!x..D..(.P..1.........B.......d....7.i......c.H.!...4..@E9...d.....;.2.....An..).....a..M.$..nG:...].N.....1..f..S............T......-)...%{../.Lf2....i^...h..9.5...M}'.!.............`.w.K....II.,(XM3..8I..Q..p6.N...1O......l..f...w=5....>..~..LvD..v.."....4..vr..eb.0).G.L.f7Y.T......6.~.k.P...g4G..y.&s..........`....j......Bf.|..}U.h>jh..I.9...7Ud...6...\.F.......l..%].Fj0o....n.s&K.\U......V. G....d.....9.(,.ZX.oa.@.P."?..0Go..-......T..U...D1o..h..H...A&.6.I..}...+....L......y.(..P.k.........x.....h.r)S..m2..Sy......f.\...Z..8.]9.T.....g2D..0:..70....Ch)6[Z..*..Z....-..)...Ht.3F.q..b~......e$]...T_.o....." ..#.@.v..&..)..$.}z.z..9....5}.[.d......L..%B.n..."...!...C....1.$N.....^.`a.z...[.y#{....f;]K..c..R...e.8..0.....B.2{%j.f...g|.m.\^@..2D..ZfB

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\9Fde9uN.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37302
                                      Entropy (8bit):7.995369045595479
                                      Encrypted:true
                                      SSDEEP:768:wZAyONPgpQjKoHKacZftx403C4LwauEMVdUCfvQ8+qCx741JDAx7D:wZnOGCKoVMftuwvwsmdUCfzCxPF
                                      MD5:3347E66437C161BB756604D74A59DF3B
                                      SHA1:21599E0B29D711A0629FAE2D0C019607C0914349
                                      SHA-256:845389C54673D090ECFE55D443C52C099FCD3D11E8249DF721B493BADC2E80A9
                                      SHA-512:D138CA7786A378E4D60C1B4CBCDA2282D60C204318CB4C82961B50DCC9E7ADEAF25CCFB3294956D590EEA9D40D1A498F9795EEDB4B2F003034CACDD683DC049D
                                      Malicious:true
                                      Preview:'...#....fW...A.i.4.g.&.a..Hy.4..z........{....eN..h...B.l..[......T..:...%".....d.is..w.u(9...!..c`.q.FQUls....r.`b.4.q..^...qzm@.......!4...}l.:.dc.E....'.g.....9....oc...W..f;;.....6.*....]%...2...N.c....-......8....TI...Y.)..i.].u{.@#.......,....0....!'`Q...)a...Wm..%J.=...Z1...K..Yo\...,3N..w..r....6 ...}Y....<..R.a`}..j=....M..`2.Q.~..5M.W.].:.=.9.....O....$.e.H.>.u......&..tn.Wb.8.~....b.^.F=WtO...1.H.U.d..z.J.....f..k....q.1&....D....F.....(.....26..oy...m...H.C...64..'.I......Rf...L._RD...j..;...>.h...5.Y..(..F....{-..6.\*....u../c..eE..].sX.O.I.3yp#<4+}?.7D....i.5.,....7..|p.h..M.x0.5./..5.YY.....Tz.@.|+....~oOo....g.w..%2.r....|....).=.y.gy.~'.p.sF.d...0..7...{\.G.......^..T{..@d&{.;.fd..q...#MJ|H..-...N}J...U..fG.- .....&../-u......0.cK..zes.>ja$<...E4"......bI_...q..>.O.N{..R....[5.d.Q.n..xI.a.n`..7X.33.(....P.S...L.l.B......M.N.+....X.[.......db-.F......p]....+V..f.&..Y&..e5.....O...^...W~.@..b.G....^...Q....2.E 1m...4.....D

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\9YjQYq6.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37280
                                      Entropy (8bit):7.994022905195434
                                      Encrypted:true
                                      SSDEEP:768:nDwj1+x4oI6LdJ+I5xvCoISyEDmxBYuIZaUbVq9m5WBwOv/ElLD:nM1+x4n6r+I5FxR7+uVqQ6v/ElLD
                                      MD5:C601519BCF0117219942CD352BB89573
                                      SHA1:314F79E9F24649B3AD1666B2C10BA4EDFF53EB59
                                      SHA-256:C03ADC8D4810735776B49356D61D40843F0499DA0875827E592A3C4606586F88
                                      SHA-512:6F8555B0283A6208918C0D1783125C133E75680BDF59EE1B5C8169A11A46838E8A2B07B8E6F50B7574BA61BA2A758B2F318C669B0B375EE8C1065493ED1E30A1
                                      Malicious:true
                                      Preview:,..,)...,..[Q....[..b....Tc8...c}~y..&....3.vw.:.W...t...+...+.)..,.qbs|:..].[T.vW...4L.L...-.3.#(~..3.h....m.H......:`i.N.4.,.....I.&..>.DBl.E.Q..#.MH..S..7....L..t.v.~....A_`.#F......y&..~|...n.. ..l..T.n.D.a*jZ:&....`}...n..K1..[...].f...6....a...&_T.U..-...H@.N...1V_?,.9.`.!.o.+..:..M^.1v.....(8B....]..."..9.Oxe....h_.O..X..1.Z...q.R..p.7*\'js.EU...l.q/..Gav....T...9..`... .E...7.u...~..._....W...V.>..Tn...wr.\..dE.E:z2......F.1e?.dn..m..uNyZ*..q..x.z...7...h.....wx..!M.U.WM..\I...m..J!x.:..O....._.X9......`.f.d.jq.X$m.....|...!.a...[.>..'.4r..!|..Ej...l.Ig..8m.G...J.a..&.Cf7..+..n..Bgv.~......./c......N5df.........na.b.....yN...Ov.....p..s.i....ay....fs$.`.x.C..R~\C...-......-q..lO.XY.=....vB..&6O.Dq..c...V3.....CH.qT...ynp..H"T.1. ....[q<...s.=8Z.H.)..1.stB4V......E..Z....3RYL%....*.`......i$".g.".....1..((..R....{.U..)Kr..b....n.:......q.qX...D+wE).'/vQ.W.9......C..... ..!...+.'.V.(qJ.(.f<....j*...O..,"bFh[Q..K.1....3.......$.........4.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\AGGa1BH.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37334
                                      Entropy (8bit):7.99500285105742
                                      Encrypted:true
                                      SSDEEP:768:2FWjuu97ldoMIUeKiT1OgvZD82D0wXSR0F6Zyr/wCJS4WpjuNK0:uWjh77oMIU3ifDNiRk6NH4Wpuo0
                                      MD5:8DA62EFA2C43980AF1BFA3CD9E8B61CA
                                      SHA1:D4581A15D497AB38625A1C9C69353336A944B32D
                                      SHA-256:ED11354C04A6791452BD68DD7BEF4936496116665F38C5E817D2E00F1DB97FA5
                                      SHA-512:D26118F1FDEBA1AC7D32AA3B6E9284947566CD6F05DACC6D6DE87E2A651C0636D9DDCA3BF4D9DE6D7D986BE65378482BBCC9D551B7D2B86207B989E169D2B831
                                      Malicious:true
                                      Preview:E9..@t.....{.T..g...a6..............q0P....h..(?.v..+0.|........#.I...9.....w....U...YaQ>0. .)%..V.>.g.xq...J..1.....S.N....`"R.A.xm.I...T.p..9.E-.0+...\xH~....4.~..j.[ %....J......HF..5h..|QY5b...Noq...Z\......-E....3.0/...d...S....lBc...o...$....}...W#.>...V0.i....{....wJ.r...xQ.. .Q.,.74xcY....\?...Jmuc.d../:..k...j6.qm.]....u.,...l.........w.J..mh...'.....o...<.w.1...3R.^.2.2.c ....@N.R/.F!......'r..[.|I.....sj.."[w.gH.8.LH..}..T.......qT...%.....$...Kn2cF..6p~..`..Y..$..V..<....P.!.....U.. ._N..pP..>.?...i.....u.A.......K..4oS..../...Xl....9k-.;.*..-.Tx.6X.&.u..P..E...u.OGb>S.".......' dzP,.4.uE.....heE)...3.....':zI.."......Q...........u~..?}JD..l...........~..W.[..MQu:.zq.V..!..A.'....CO....B..Q.n...~..P.N.....Z..;.:.. 8..4o..-.j..~*...Q.B.x....}.6_.k..+x.._.)GH?.1H.....e..&*.(.H...V*~....+Y....LD:..D.L1..#Q..A..i..Xy.~........}R.Y`....f.m.1......._..a+Z.z.)N.Kk;.......r=.........vx......{.y...6e....qU....X.NE }.IN.v.a1.]6..M

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\AOc1zKT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37302
                                      Entropy (8bit):7.99495655821796
                                      Encrypted:true
                                      SSDEEP:768:oiPS3u1i2yMgabHZlvM8ZqBKAm5amnnpLWHIhYbvY4RMIuazqIS2FeA:oiPS3u1kMgarZlEbBKXNntMI6bvdwaTt
                                      MD5:F732F585B56A916D36EDF64797E93CA3
                                      SHA1:C9F8E1C5738BD93CF80701EABEB25A2F8F173E58
                                      SHA-256:BC1AE127D0A0A9A6B070716DAEB9FAF17FC6316F4CF028EE0041A43CA6D55D7A
                                      SHA-512:0A463CFE1F396B8EFEDF99635FFD678992BAF7C6D15A811BECF793BA6F526F4689E89D15AAC27847C0939481133A628BA85C5C1B0AC2F58FCFF43E65412DC8ED
                                      Malicious:true
                                      Preview:/...OW.w-...O.hd...V..B.Z.5...m.\ &..))/gWp..6.9.n6../.....p...iHf...`.._.1....@.*^...@5.y.:...M.......GQ..LP.n.Q....4....a_....:m.....,....02g`....Xiw.1:.=..C..X...S{.......|..1Ij..Q|.8./.xNtM/..t.}.d4u..#!...b9.p......Zs...Wb[7.q...[..X..... ....Gjm.?.,G62...gz.....f...7]{m.!.0...})........7.Z.."*...bJ<V+*..4.P..zE".]xF?w..W..Sq..3.?..g.S.Tm.Eu..r..rR.s..M..ge...F...p..1..-...It-.tk.. .4.U.. ....D..v.5.I.j@s..>.E.... .BL......R..>..a.p..e..d?!y..HD.....:.0h0.f..?..'"2P..u..v.(.7..6...l..[..5yj....a....b@...;.I!.2.P.UA..~.....fC..v.....tC./..y.......I.....'.....t.}cb..u.....`.[.=t... (.d....+..s.'?[!.@Z-.@..v.S...sMI.U..DV...y.."[.[E.]...d.9..]...%pG.$..HN..p.[.G.........,.^S....Bg4...^+...07.b..F........'..UeC..K%..O...G|g...]l:...5..<.........0.K......P.G..x..k....<K.X..}.://i.pf.q..t.h...IY.&.a(...U^p....gK..~..l..6..UF.....8.=..,...%t.....$a.a.n..gO...s.w..>...z.Z0O. .1....=Qg$v....W...a.d...r.0.........1..>%8C.....@KA..."D.eO.P],.pW.m

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\AqGe75v.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8183
                                      Entropy (8bit):7.975034415807453
                                      Encrypted:false
                                      SSDEEP:192:vziCX00b7eD/V/sk8ntBpX+WqEQ6CXaxasKrUxJCCVHD1iUP:GCFgV/12+WN1NKAD1d
                                      MD5:71CDBB3E821AFCC01BCDC6ACCE2F5227
                                      SHA1:22638AA63BC1017C23C180C68163660C87CAAEE7
                                      SHA-256:DAF029893D8B930109B539ECD7D14611628A3EFD4C18B27ECEF1B1B4F8C6B300
                                      SHA-512:08AE0722ED08B2DF18B885DBA1E42CE17D4C650799EE201AFD165A45E3C3E1CDE79763BF2B719D385DD869D6BFA463EA72D836DCA9B5B6459194A8F90D07EA2C
                                      Malicious:false
                                      Preview:R........o.].... .C.Il.H/+.MX....w...m......../PYE.$..I3....8kd.SJ...i,..\..3...#.c.`=r....!.g......v{...*I_K....[O..^.K....,.. .t..M.c..}....Ds.(x.&..?.k...E.Y.9...^...o..;.P...E.0..@/.lX!.....[i..O.T.........)I..#.m...=..e..CI.5...7@.;#.......sH.0..%..t. |....T.*k.. ..3L"m...BS.....3.x......yH..7..L..z..w...p.K.m...yU...IC...'Hw?...tn...9(..........:.....O...~v$L=...Dn..yg.}.I...X..V..e.....e.8i../H.R.&..3.]......M.+..<..{...V....x..z..uE...S...U;......F......u.}......N...|W...AP...BlM..r_^.'.AI.h?P....q..p..z.*..c.C...V..M.>2...c.T.p.c.+D,k......_....X..S=....]...."6p.-.......".zMZ.eHG..).W.>..:..X..GjU3\...`r.wC"p ..3z.^.,.......bw9..qx..XF..y..CN..Q...O.+..mZ......+...m....e.N.....|....$/..._._9...P...hv..do.z..l.......`_.M.....&>....Z..`r9.....!..E.A.:.'.F....?.......H.n..D..C.4.KO.....$=.U.....'.K.... .{...u@.j"....-..?2WD[. ....+.=/.."p..Z......1...D../.q.~..L..Z..Z......Z...\."F>.Df.o...y...@.Y#.{....tzL,.~VQ.>....-.[ZL....+....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\BpPh25A.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):7.973416179987468
                                      Encrypted:false
                                      SSDEEP:192:m0BFgH2niRC3RyzGF0vvbNqWrIJXFXM3gqI5C9HpPvMtbj0aMSkZ:1rgWiY3RyzDjkXF83gqGCgtbzkZ
                                      MD5:1BD60C67D0C7737A2FC3BE562B8F9BC6
                                      SHA1:21C4E6049DA61C32F812CA3A4AC2AD62F68CE269
                                      SHA-256:6BB1C6EB55948FDB2F4E4F3743C37CEFAE0960EB0654B4AC029267D3E2C6C1E2
                                      SHA-512:81E95D2C1CB3F5AD95DF5F7A1E77F730CA595F3CE0C50AB4452F3F33CFCBDD0BEA144E7D77788AFADEB2BCB005EF9A1552B19EAF103CF1506D186869FED0D59F
                                      Malicious:false
                                      Preview:....X........$.51 <YB.E$x3.c.:........e...t.@.T._...RB.CQ\]...*2@....#.^R.g..}.dk$..J.......3.3&......Y7;w.....vE/-rvs..&~...R.Xf..U"...6.....S...J..q .C.b..>.8.C.Z....L'z..d...P.h.......b{:....Ju....o..h`.v.x........D..GR.>...b..a\8........B...C...B.#...NF.....x.V.=../....6.&.E..9R.i..,.A~...... ..L........Lr..c<c%...y.A]..uUK-.p"Dc.H.!.f`.*.]...!k..H.......K.;..lUp..T.8.]..RYK0..i9.......hB.l./T.15..Ck.....R....`I.CoV."c..)Q`.z!J"9.\.+}..;G.......A.U.J,..<...*`..sJ..WC1.+.Mxz..e.......-B.EB..&#1/............>.......-&....U?....LC.....=.c&.5..O!Y+.X.g......`.5.U.-.....i...v.J(..c.....n.3@)......Q../n..6.eV.....c1.I...*..o%.3.eX.n....DM......[.Q..rj........s](B&...I...8.FRd......\....\p.....[..6...4....3f.{...i..!.y.-...v7.Q-..=jkp..........oG....)K..8.....).x.(...N..`.=.......S.N..%`Q.....~.Kj...).s..F^".p.M..3.i4..|s~...(.1.kM.I..n.g6v7|.l.}-..P.k#vb...?..O..JT......x'&S.."Cu*).|.....-..fG5Z*.......P..p. ....g..M.....`...m(....I..h

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\CcPHJEq.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37294
                                      Entropy (8bit):7.995848275841397
                                      Encrypted:true
                                      SSDEEP:768:xSARWyS4UUglGtgVLQvDdMjqm9NRY7up5wC0tfpjXEiQzmGwktXw3/0:sARWySMgMgV2MjqcOaLwddRXqSQ2P0
                                      MD5:C2CDE64EEE04F2A93F34BCED34BAB184
                                      SHA1:148813316BD415A1869DC6CB9823062235A30E44
                                      SHA-256:C8713F481E65838EC9B359AD00E62A1106AEDA493C41DBC7159EA78EADC40AB9
                                      SHA-512:81A44CD4977DEB4678E370A39A85A404671A14A11C084D55D6EE3F2B62598D31174AF4AD5F9AA54191A280609888DF6098B2CFF10C815B21278B39A582DA0376
                                      Malicious:true
                                      Preview:.....(g.>X+h.[.4@...`4h...cvd...z..O...#.SP...8..}v..j8...6.lO.C..2I..B.e5V.t.W.8..e..T.G.Q+.k..g.d.j.G.:Y.T$....+<....>...h}A...u.. .O..Y.`....#m${.F...[..mz.qfk.i....d.u_....*..\..).R.S{l|.j..$....I..F.Q.W3o'.ly7...`..sq.P../.R#.."{..KG}.+6-L.<|.[.E.@U.G..Ag..s.^..........W.}..............$..~...6........X../P....%.(i.1......[;..|..a..+...T..`.....w._...<!..Bq..V$'8..m.y...GA.."3.H0V.}#k...$x.....t..A..\_:;....m$C|0i....hG~++............_....a......}a..$...{..d..Vr.1X.B.~TG..[ ..Tw..is...O.......]\.wK..$F..&K..*.42R...<.gnI.3....+..X"f6n.v.O.2...>E.Gw.y.%3.3+.m>.(.V...#%l(.p...htI...1_...c.._.-.,.....7....Oq..l......."X.p&s..L.N...eer..8...a;m.a..~.......]..~........mo.].K..kA.....\[..c.U*.\..`!...X..NZ...N."..h..(...P..4...n.IT...Y.Qi..>.+.6....N....:.~.5E6F.@.....;.;..^.xa.B.})w.(..c2V..C.2.+.j......,... T.{R......k...*.C.<.\...4.\.c......&..YYo.,.l.HE\.'.....F4....]..^...'....\.....A....D..%.J.Q..).1K.......;%)F..........

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\CnbdfpE.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37303
                                      Entropy (8bit):7.99525782098975
                                      Encrypted:true
                                      SSDEEP:768:OJGHFYtK0GvMQHuezzvwe2eQzpK8aZHdnCgs6+4I9O2af:OsH+tK0G0QHuePyeQ9K8o9nCgs6URaf
                                      MD5:984774D1D6285AA5C49827C5211CC659
                                      SHA1:E81A028E2BFEE228818A6D528719AC0910DB53E1
                                      SHA-256:B03A05792DF51837A6E96018F1C5F2AB3DFA52E1FCD9E77F11F1B87E28AFE589
                                      SHA-512:D4AE13AFA91EAF681A892B01B45548253422F6AD453B38F0789966A6E32F355BC4FA9C13D2AF42D777FBA0376F578687DAB95649438273D9FD2153795CC884EA
                                      Malicious:true
                                      Preview:.z.-.....WfO...;k.T.p.j+M=.?Mg.....q.nc..R....3tL3......f...P.f... .@.[.`....).:..<h;....\&I..l......X.!7G....w.OE..."..=u.&.....zi...o...+X.q..\;..2j.K.....\i.(..V[....})~i.M...z.Y#...)}...1^...H ........l..d.8..b.........U.iW....f..e....Bk......Z[...T.5..Y....z.)hg.RG........O...n9....q..RdO..C...(..q....~u..&.+.FK.>.{.Z...o.....Z.d....8Kk.@. ...b..[.6...(.X.>....Q..S8.....c}.....Q.....AW.U<..4....O0..n.i.Q..3.2.t<e.m..#*SS( ."%....2.b4.s\..K..1. .S..()..b!.#e..;..........N........X%.[..Y.....;a.tt9.E....1..p...;.....B....y....t.!.p..A..B..u...T.++4.g...&..;....=G...e.*.j....}.,J_...2....R.$.w.g..J....7~....c..y.SM..3..s9.`.n..^....9~...xK.nr.K..\.p.%.......Q...d%..@....T..Kb..,.!..!8.u.....ht.\...7{.9.....>Vk.....'D.O...IG..|*........WN....!..U..... .L9f..* .d..<:.5.....sc......(h.Y..U.......m...|..6I5s.4`.W.....IS.....5.q!...&B.;.....eb~E.v{rX.....m.......,.../]....m;I?x..OC....g..=Ilo...#1]..$3U\...Ry...E.l.O\j%.6....o24....Tq.j.sa..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\ENFCPnq.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37309
                                      Entropy (8bit):7.995575426191574
                                      Encrypted:true
                                      SSDEEP:768:Z7yyu6AXRpqG+9habaSHw+JulqkCGSTzROP6ndbEJI54epRPIVDv2ClpAgk:Ryyu6y7qAbPMlyrROP6nduIVbPWv2mm
                                      MD5:2138701F160A83B77DF9586D2BE7ABE3
                                      SHA1:9252A05878C482E6852D132ADAC23DD998B0B6C3
                                      SHA-256:7C0DF3A58A37CAF602854AF85F019C2A0A008E53E326843A28A89273FDA568B8
                                      SHA-512:9CA2E9EF6CCF6406B1DB93E00102D6D5045EEB8E2DEC2F57D2576F258171A4FE2F7BA3C3E78B018D1194CF56451759D33B4ED7F2A717E7963529777D7C47F54C
                                      Malicious:true
                                      Preview:..!?..&..8....L.......^.z...F...}..8Fk...0`...:.J..-oHC..6.+....-"nv...k.@[}...$.w.....p#.<.E..i..J\...0h....y.=...D..+.J|.+M4x..~.n7QU....7..h.J2.`.....<.M.!X.ad..g.......y..Zn.....Q..'..>q.......2..nBW..K._z..q..(O+.>..`H.Wx.(...X.....J`.a8uV...,....`....X.]l..=..C..+....,.....o.B2...,.....f~G....#...".2.L9_..|f'.&.~.a"...?.\.j.].R.q...O...0>.,Z'...v]KQ.. ........|.+E&...K.t$]..B.Q..4........`.&....{3h.DV......B${B..<X....E....{......q9.....~L./rU.0....z.......O..\ ....*R7E.-.).C.!...1.....; .&..0._i.R\..)\..4.X>.'N.J..!..CEr._."q...ym.;aP.<U.r.S.u..5.....%^.6...IDN..C.._.JF0.nR.]Q.j3S%.....]....%.M..8.]....&f$...\...T.0-. .R.......M.j..%B.....*.pz........g....H`zB...A....v..R=....C..s[....[.w.q..G........Tn4gO...`..@....7+.^W=.o?..g^.H...}.S...4....u.......;C..8..n.7...d.CX^.{.}<.P.^...C}.m9..S......`R6N.I.|a....dq..!..JS......&..5..iT.u.z.J.i.).;..[..V....7."..n.4.>E...4.....jc...'Z;Z.@..re>..$...zP.hRmg~.F........o>._5.T.Dm..+....U...S.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\F3FDeZA.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37304
                                      Entropy (8bit):7.995096600372032
                                      Encrypted:true
                                      SSDEEP:384:JPZgB6+gEungf5YoY4WAIR6s2sK9A38tIrL/wOflAdP7Az9Y5w9QW5z2UxGBZip1:Aff5HW1fOsgsK5w99p2jZiXH7fr
                                      MD5:5AA75405D136835CEA7FCC2A922F402B
                                      SHA1:053AE5A75D13B4581598C687497CE7B61F596245
                                      SHA-256:90C3FD255956AF5EA006960C40DB8A1923BDA831842E57EC0EEE988AF2863AC4
                                      SHA-512:5C837BD9B2B56599F0F0C0B4FAC85E95C3829A2A7239082BA366AFB821EF75570CD3747B6C848DD172E9AA32E8E994B3AEA1DE947AE76DC3450B19004ECAB471
                                      Malicious:true
                                      Preview:..?A`i...S.M.+h^.8.....Y.:.......c.Xhy!..w...wk]..."..ByK..[-..e.w..'`=..|.lxT....#*.xA....l.? ...3..@8].M.2..@.Q.. .. .`E.P...E...5.5....;.qf.V.Qu....:h.......ZkN.`*'z.f..%p5.!.M.g...y........,J.y!mA......6.H....\.C.......#...P)..U...3..@=..2m....X...(.._@1....2.2O....jD.2.*wy....sRc.<...4...w#.7h..ap.G.1%...}......N....S......FAl/...PiE...p..H.&.H^.~-.Q..]...p"mmXu..AH.b.}....Q....J..iU....o...>v..F..~./....z4;.,.P`!Tq..b....Y..7....r......^g=.rb.....;....F.X..g.Bo.4......f.Sj.X........_Y..w.LYL...^..`g....S\...>.....$9j.H.jM.,..R.......g.p....H..o.v.q....+..O..T...5\.GL.#...5........0*...../...*g..E.3.U..R(...k]d.w..7.._........d.).-....I.9b.e..&Tt.w...8iIpl<.p.f...1.P.Nb.#zb3x5,.Rvk._...g@..*...~.......a....b....\..\.:........EKs.:.O.LH.`.J."8.......=1.gN...~....D......".=....6..y..Z.p.a./.F^....p.6n.7.ve....,H..K.X8 ...."....r.k`e"..r.....,!].V.lk..+).^F.mX.`D....c:..R\.Y.h.... .M.}...z%..6....C...r....i..^c.zo/.mQ....D..k....{..S

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\FiQjIcX.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8172
                                      Entropy (8bit):7.973853809307215
                                      Encrypted:false
                                      SSDEEP:192:iJ0CVDu0wryKmbGjPgME1M7VLEtwRBsGcl+4TjP:iqngI7qcctTjP
                                      MD5:6E23462C2C28F923F57A96F58CB22466
                                      SHA1:0CF2289FAD72703797A60AA02CB02347A7E3ACBB
                                      SHA-256:882520389600B2855B46F6B437BDB3C6057F0B45C0A3BBEFE4F0E219D4415D8A
                                      SHA-512:3FB661E94A2BD4423B8DB84389325ABCDABE98DDEE012C80D29509973DAA88BC28F59FBDC19866916728553A373A10A8AFC2DB296966B4E422E5D994002C4757
                                      Malicious:false
                                      Preview:o6|/..|...VHk.v*.E.`Gv#9W.........cA...d.u?p.....]g..._..".Ed....W.r....=....,.s...W..P......".z%f|.#.Xy.~.....}d._.......;.......x.....Q.9]9.w.....q.pg..*>.....~..q..@..x-A.u....q.d%.E....gu!....``....T.........1..d..^/].d.3.e.m.*....Z....]b......$.l.qE...1.#.......\.....F.|@(X<a....."kI.).zS<..-.BYq.......R2..{...q..r..0Qn.6..3-...8T.O...F.c.-.P..f}.o..k.....unN...C..!.W.._w..~..-.v..9.2....c.q.(..*Y.. ...w..tiG$.3....^Q....p.s..q1h....|R6...Q.`...`...!.0[.u.....RS....vn..y..].w%....%tz....sT.<..;.[...l.c...4v/,..=.^'.5.k.).!..OEs...[b.......{.`i...lpk.8.......~Y...&..M..=.O._....#L.@.]...Q..Y.o.LPu...g....EX_.$.9X.0Mz.5]W..vk.X`.Y..ME.\.d..*F_..Z.x....r..^....{....F....F.D6... .,aL..L8D.....u{./J`..W.n...bK5..(U7.;.<..<...G-..d......k.~3.e.[m...J.Fk.j../..z.l.}#........O.3..].N/..Q....L}-4.?..@...X.D'X....r....W.D..........l.y..<m...b(..>..z.0.E\C.J).,.............|`..G....l9.6.`...n1.b...?..`[.x....X.....Gb.....l&.Hd\s.i

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\FjK7yt2.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37324
                                      Entropy (8bit):7.994526534368266
                                      Encrypted:true
                                      SSDEEP:768:L8VCUhLmpgYIVJsboH1vDJSOun7LegM9pvAdzbclpBSe496:oVCU8pgNXskjGn7SgM9CbepBSJc
                                      MD5:A6986A188610A8A2FB6DAF90C2B8FB73
                                      SHA1:B3264F525A75F6BC3E3854B4D11E9934AED014F5
                                      SHA-256:43C00DBFFD2B544687431B40BD73862D33B3D706C562652D44C8B6860201A31A
                                      SHA-512:F04DC13FA500CD6AEC44567241DE8400482E9325FFADF4E01B4C1CDDD9162CA7E80F63B29D465DA8B047EAEF7B2944B04CB77C15353E321014F126D59802EF99
                                      Malicious:true
                                      Preview:.........Z.emN/bv.:j.2...`..!t...E.T......$.."..LJ...9...T..............qP....2..c.}...rCy..=#..:....H...V..s..."m..p.@-.(<.tA\.7.......yk{..J.....j.)%...i.P.C..?WO..9o...t.G.S.@C..,E..F..8;n..n..m....c.p..:UP.`(=...d>....V. ..`q..Q>f..xA.8........_N.6...U...Y...V...P.x5.......#Af....r.9n:..u!...(JO...i79.w...1.!........no..{.-. 2.u0..C.....kp.c`.....Z-....EY....z....K{".....|......`F..`=...V...r.......|......K...`..#.....,6..Rq...$3..>......R..y....6.....d...O`..pi>.E..\].A.... R.H....<.G..7....=UCrj..G..g.WSbm.[d..C1...!\/.8+..S..........8.,...#.|.;.n')M.....[...9b..^I...[)O..2.K..jD.^A.....U..s......~m......_<.C..-....1R2..H.D..#.*...M...7.._.;C.IzM=.f.e.3...^v..Hf.N.T.A..M..B.{..}+.....p.....?Y.!..i4.Km.Y..QK\y.U.{..(..&a.P&.........EK..5w.%BF6....5.\..)..?...ZYza..._..r.$.@R.{GP...c...*}QD..(.......lW.<.tp..bK.=~.^2.V.=...L...w.n~..5.f...^..rU.X..LVPl..e..].....d........v."......8...L....p....@..C.j1h...+......_b.\.x..v...x..r...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\FkASSiG.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8178
                                      Entropy (8bit):7.973732505601849
                                      Encrypted:false
                                      SSDEEP:192:ame07G66Ensx+KwdOyPg7QacIsjkAgBV7PwbeXp40ZN38X:am06Dsx+KGOyPg8/JjkbBxC040z0
                                      MD5:4D4234BC9F1056E6CBD2A926EBA465C3
                                      SHA1:AA814F7E0AB494469E72A3A8B40AB2335C80ED03
                                      SHA-256:21B601D84C2B45275A40E603D167B502089B8EF23892C908887364A033FBF144
                                      SHA-512:B209108CAC0A6E471D6A2C14C8908613C6157C40313AC312A610C84E657B92D575F0E6CAECD8D239066118A3E061E3B9FAAD55D317FE2F6B0D74012FC9E7E3E3
                                      Malicious:false
                                      Preview:T.|...ZH[..D..[.C.X.@[9......\.?...@.9s>..1jq.i.\..a...I......Gy+<EA@...r.....I..W_...4yt.$.)..../..dap...).......:v...W..o.G..2.J..B;^.+8... .{.v..+...Dj.....?s.....7....A.........g.s..f_D/...%..f..zxt.Wh......=.4...y.}...!..>.["...u.f]..o....{{.)......&.S. F^j..Q...E....<..Z..Z...E..I..}`.M+.. m1....r...Y...7.-..e.8.R...{!b..2K../.3...8}.Q..V%..~.m[{...M..o..n...`..%..nDo..e......9+..8l.... B.y__Z..H..HS..:EI.r.C.fNc..nC.Qu-x.(...i..O.).T5..|.....BeR~..s..*..@...^.e..m..AW.PHm.p............Qi....]?]q.U......Efa.-A..a......&...9_.R?}...,.y)..1.Lq.2........bS9.=...D.rr0Y...d....y,+.?.G.{2...{.c7*c.#.g;.AN.%.'{...:x./..{.l..e.....d......?.2..E}|C~&...Y...h~.d....m..&ik.....!.j..O.....Gr'..b$....[S0x........8.......pV..._ .k.R-.uA..x.`l.....x.......CE. ...RJ#\0.].g.e.y.?..A.n^...`U,....!:9{$....A...U......q...2.6.....Q....;.[3~.U..Ct...o.........*..H..j....q..A.o...\.1~..).aq.})/i...;.~.}..F(.4.E....8.fC.4...s%H...PI.T.}.=J..T.Mm{..-m.. ..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\FlZxH2s.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37263
                                      Entropy (8bit):7.994931821872155
                                      Encrypted:true
                                      SSDEEP:768:c6DMyDIeENpCfI0dcY5kIeyTfHy4imG7OM2DEw7sAeHv:DMyklNpSI0zc+SLSbDrRe
                                      MD5:59781CAC0187FEB9BE970C0711F1C78D
                                      SHA1:6252BC9DC6C7DD72A898D7756222CF91C1BB2B08
                                      SHA-256:3C4F8F6CBA21A212EE584B4D1C335C5AA288F906FACBDAFE8463D6EE6CCF9CEF
                                      SHA-512:8F3904EBD60480400A854E5CF35DE962A5C9795A971E09416FCEBED92532603F71F1B2613B6B74D3C2A45F08729E499853AD6C600A16DCA149C3A0891E0E5077
                                      Malicious:true
                                      Preview:aO....@y........8...j..BG.....=..D.i. M^2..f.{.3W.g.=..J..~s{F..E..j..)ow....2.>..J.z3<f..nk`]......_~....,1..~svA$.$.v.&r..)J`....RWA.A..YlR..'....\..zoID/Z....w..'..6".....AH1....~q8.....7.p.".)K.."KC.._...~0.b.O..p|.e"......Hp.Emr{.^....`..\..9Sn.N&O..g..$.Tn.nU`.N`..K...e..........Tv' G.^.4.g...j.....(.V.gA;.Y..<./Y.I...G...aE...p.z.LJ.gg.U...5......~.l..+32.s....>...,p.R..2.v._:.r#.i.`.x.....P.....bh7.z...{x.../.L...-..E.R..Czq..H..vME9\.5.)..g.>.|..(w.b?x`....8...dZ.:...0+.1..H..$...,m.KS.x.`...V....2......"`|8...K.-g..,....\5...-..2hA..,..7q4.Ue.......3v.C...>z....".y..N....<........r>.N.M....0.r./.........(..9Yc...H.cPuV.9....mK/......U#.Cf.W.M.k.DQ.=...f...2..HU{..EFay...h.'.e.Qa...^..v........7'1..z...8.......M...?u.2.J.lp."...q.1].....3......G..|/x..9..o.W.GM...`M.wR;.F.`.Dy..X.E...p7w.-.]..3.3.#..!....o...O..G?.....d.N..p...~.A.F-.....;.:.?..3c...p.VI.Kt...m.q:).zr..^...m_...-,w?.,.QS....Tl....G...y.t..f..A.\BQ*....e.i

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\FsNYcLU.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37336
                                      Entropy (8bit):7.994750264670684
                                      Encrypted:true
                                      SSDEEP:768:UIqHRIBz5yvwfRPo51tb8I2gS+b/uTFPUkqyiLGB3/iByF4:U/xScouvGI9S+fzTLGB/ie4
                                      MD5:5D333E9562A938381B53D32FDCA8298D
                                      SHA1:7A8A57B5D5CFD41F226B0CE39A5363F9CFFB47FA
                                      SHA-256:6B21AB2C1A7D8BC87C2CB6EECD0633F928D7A90A14E27C30506271156304D627
                                      SHA-512:0B4C4D42AFB2A621180BC56773BC2B2D4AE6B919BAA9FCA4E23CAB2978225461853C3E67A1C09CD05C08A4E9F8282536CEEA3AA7424F1ABA910178A23D160918
                                      Malicious:true
                                      Preview:.....BZ..%..=....Hq..J...-/.o...C......z....+.&;I..&....+v..:.t..>.]..... .....+R...%:....cU..xDb9....0..Q.j{..}.2[XS)q..).....J6Qq.z...>b..s.#.@..q.$Ka.@vmB..y....]G..lB.p..A.?..YcV=.W.%".8.Z...AW....M..R.Dg..u3.L'...\E.......u{RZ...d....qI.n..;.$).U....]N...q.F.z.{...45.....a..%&...`>.6...Xg.^.).....VD..?......9.h.x...q...p..AY.....n.....x.uD..z..k>O.....%.../...:#..7..O!m.k.t(.;..\0..c*....'.l...eson..%|..FZ.[.....5%3Z...?.D.0.c&.u...E.a.-.F..S.f.8..O.;g.,\0f(..8Yv.^....0gX4J..:..r?.t..`.f....7......$..u*.e.91Ra|...j......D......a.....1.......!..6.X.G0...3..Z......T...g..[C..%.a..V..ov.`N....E...t...F0..^5.;V.........v.....Wt.<.......X.P....e.\.`....C.....d6NUk.))..[......%r).f..dQ;.....E...6.....b.)..>M-@.7.N.rk.4h..g.H..4.....9..\w~..[..i.Xe).D.]......o...(..@x.2......C.oP...zAQ..T....B..Z}.(b?=.sx.:.......{P.s..=.&on1.].-...97Q1...E.%.@......?RZ.1.fT|......4.Yv.r_.........r.Q.J3.'.....z.....D);..G..._[..U........7..n.pQ..)......'

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\G245kcG.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8168
                                      Entropy (8bit):7.977118802609932
                                      Encrypted:false
                                      SSDEEP:192:3xr/bnxeTFwCLmxH84phF6CK4QYymYnKPu97pwHSD4tk:3xDjYFSaC4CKAymYbPDD4tk
                                      MD5:27D497A82FC865DEB26309BC46BC1BFF
                                      SHA1:71F4D0FA8672788FD4A2EA0261D502D01DBF8159
                                      SHA-256:AAFAF9599413BB4B10B89FD5B640F0F46F479BF8C9F35C223ECBD7150A94192E
                                      SHA-512:DAFCA2C4B20B8CE77E960F9F33498E4F0247E246946536E2B6FA7DC4DE1BFEF9EAF6F0FCE6C1694E2309D8BC3D42838A22E2E99883A02AA1219C33BBE025775A
                                      Malicious:false
                                      Preview:?2........_P.....;.@..=.e.#.7T.k#..m.......R.+.....]Xg..!jR..@.d..7+.4.<..<#j...`...`.M..z..^Y........U..VG..j...u.G8.Q,.t-..._.E...U...Z.yU.b..]Ki...:b+..]..-HU.0v@1..',e..j..}.l.....5..Sk+../..f],.=...bR^.W..:.-.....E.:w..w.?t..L.'..s$......F+.......6..Nk..y.X.]3.A.K...g.W..x..d\D\^....1.e.T..l/H.....A.4....r..$je..=....i....k..K^+........{......^hQ.RB~.i...:@&......:..4.....R..o....T.d`.........:0{....].....U...9....x.*.........I........Z.0b.u.[..D>hj.q,.q. ki..B....4...5<..W..."....w....._^..J...?..t..8.n.Y.z]<.t.3Jge.........c^.E...(...rM....!..B.T.~....H./..u..F\...;..!.Z..f......l..T*...;r.X?..."...s$.5..z.....{.7.......Q|.....o.\.TI.'r.u..L..{.. u.e...?yUu.J%.$..t7.AI..-......G.k..m...[.~......!e....E....$XS.wr.^Q........@!0s..$.%...sx.t.m...........E.S.... e...0....t.?=..*..2.R8L.<...O.ViG@}....1....`...'y*Z.y...7eOHI.".b.b.3...~.5.2...z0.b.V.....|p......\.W.-..zd0.ss......k........H.v..b..ed....N....+.x^.9@.$P...\S...."O..+

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\GTw5HPj.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37293
                                      Entropy (8bit):7.9954207628985445
                                      Encrypted:true
                                      SSDEEP:768:fJH6BUr//hIAWLyG7njf5bpon3XJIZ+wCku78yeWl7UajNvSVAspHnN:fsG/hIAGyejBbsM+tp8yN7/S6spHN
                                      MD5:D10E8E2A59FF99A78FAAEB2701CC17F7
                                      SHA1:88AEE365A81F3A64E1799AAB8BEEBD4686B0176D
                                      SHA-256:64F9856395B208CA8901C9750D80D3393C1B0DF9C0F13030FCB8EBBD13FE6BE8
                                      SHA-512:31E7B8DC31B80AB0DF184628B032725555FE0BFA80FE6C4B933879B7877E611E1B029740B93A4A5AEEA17E3CAC3B4DCD3BB1EFC30CDF96D2FE58B22CEBBB09C5
                                      Malicious:true
                                      Preview:..,...9G.hfQR..q..;A.j...[F.QRv...0.$...Ch.{Lqp..|.>FJ....%|#[%.-..f.A.K.f......E....|........n..."..$... ...G.b.......}..........."..D.C2..........}.l.......9..{...~a...^{m......Z...$....qL.h.rj.B.._nD..[.fH_.l.|d;H..=.5P..t.a0.Cp..t...g.N. .....}...x..Po.6.@Y.c..:k..W)7..%.}.#..3`.m..2.jz...I.+......d_{~.QC.M..D3.rw.....=..........a..gy4d...#Z...J.$...HvF..\..M....\..;.&....a. W.9..l..I...)...i..'..^g...7..V......./.'...C.. ./-jrd.7d.....a..$..?..(....E.LT~.%z..b..F><WDB..q....7&...u.-K'..6.I...].C.D'R...C...\..y.f...T...I./.*l./.o.^..N.B.....p{6.J....4....w?O_..s.Y?...S..z.W..-.5.@4G+.gv.0.a..K...Y..L..^.....6........,......h...;.2.rg.\.....:.%.s..k{..bP$u.....H>.).....R.c.F7G.S.zW#.].).z.1..y.wT.)=..F..]...r..B..k.z....-..^E4..I.;.)iu....$.2....|j'L={..&..z.l?S....F..}.....L.{.....j.Au....O.D&...gva.......]$...!.T;I..+. XEs.........fP2.........2i.D...$...I.4P..L..\....c..d.)..Z!.a..v....p....\./...w.i..].z..3..quP...VHZ.d..x

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\HyMFWDd.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8175
                                      Entropy (8bit):7.981880828579577
                                      Encrypted:false
                                      SSDEEP:192:XHciK0xxvL3VTc9PBkawVt/NS+s29j4vb6uqz:XciXvLlw9BZwDp6m
                                      MD5:10A0E6A2A519798964DE0F7418F06482
                                      SHA1:CAE347A5A658074BFC8B420BEA19BABE3B46E8AC
                                      SHA-256:0B3092771AB7E3AAAE34A2BF3D480142F316835430D1C5C621D65CD328D9978E
                                      SHA-512:412ACE44F7BA670BFED1116E327BC45F56BB3E95B02ABEFA0F6BDDB16333152D3DB61AD9E6E0BE82EEC3D99E69D0B0AD03348067561D360626CD48D4A1E62640
                                      Malicious:false
                                      Preview:(...I..s.N/.*....{.X.j.=.9...Lh..V#.6...y9...r.p|.....d.@.h#V!..)Kp..k.GNuq.....Y.m..Yg.6....G.....f...cD"r.......T.....^u3.....m.....a..rI..,.F-.9..p...,a..U..7..hO.h ...(h.*V.E.@..J&/.....N.u..l{o.v....*....fN2T..V....8,b......{v....EW...X.m..&5..y...R\g.a.........f..[.E..sg.p.I]@*z..b.........1...R$..Q..1.9.@/....*..#..........&.A.....X.`.9...54.c...1....[=.E...}..S,.n....2%...s`_9.+..$.C.5..!...O....bW...E..:..`:.....w.."AU...=..R...hA....r..U......<BWTj]N'B..M.F..3....RGx..r..WA..N. l.)F_.%J;....V.xh..E...B......t>5.L..I$.m.Q..n.=....).F4w..o.J...Ht.3.y.]..?.V..t...o..p.s..O...Z......>.R..J..U..._...`w3..z5.u.!.....zT....R.......(.B..%..:V#..D.?.Z......"..r..M......t|.|N.Z..R..e-.O....S.....&.}X.Gx....'...s....'.k>.E.?].:.RDY.1..l.5..._..^..f....e..@....l......|..q...(...LH..*F8..x.Mad..x......w.l.....gnB...A...U7.'..>.......'DC'.5F.t>A.j...s!.R..D...i.....h.-.V..K7.h5.Z..$...n..~ ..d..o...*.......F.toM-...8...2.M#,W}Y..Uc<G.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\IPAAwnT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37274
                                      Entropy (8bit):7.995530896129538
                                      Encrypted:true
                                      SSDEEP:768:9GU83lQzc3eqsqMzj+WNI9+fcIjbWi484KaGpCqrE8OOo:MUY2qa9IkfcIjqi44JrE8OOo
                                      MD5:3E05DCD792EE4415B04D63E87B8E3FAC
                                      SHA1:290FEEE24F8BD70814681BCD88533F36F881F122
                                      SHA-256:591C78F8F9204C58717242551189C2BDA9B450071C9F62AE03F943087079514B
                                      SHA-512:6C0F6FCB89B90BF7739A1E4C2E1647088CD3A43D776AED06BA5E823EFCFD8CBE22888F014467679126D71AF8198C11BC2DF4AC2FF847414B07FDE825499AF573
                                      Malicious:true
                                      Preview:D_D.f...._-h...~.d..X.&...@{......n.....G.C.`.=.~.N.Z.N.x..E.{...d.....rOJ.....r.9HN.5...2..a...G..l...'V.. .(pb>`.z0qF.....lXt...j....8.r..9"Nu...*a..-]\..^.H...... Kx^#..E.d...y.b..^t.hc..Z......Q......rb;Cqc.k.M.. ....!W?0N7..W.e..tj.$...Q.S..?].....0.Ke.....#.mA..e.....8.....hy[X.l........Z...P.(Q..*.e.\+..|..Y..d..z.s....(M...&.rT...M.).]..5{M.....;..`..B.....).m&.6..OGo*a|)#.S...[..>.F.N.$...jg..L.b.E.ff..."N....9/}.7.Z.1.Ek.U6..~..P.D........z....+r.....9.#..P.9.%..I.{...Ucm..;.X9....U....n.\...'eB.....>.....;..e..A..$....6....Q.......G.;W.}...Ni..Tc...z(qM....`..XjxRm.J.XEbD..A.Q.&....6..JS..{h=g>Q...`.....DS=.zcX`uQ.v~{...%... %=.....[....YT.M.Gg.I.m......'t.e$i...!.n....1i....."E;X...-.uu.x.I.MPf.#.Bu....|..B..*....m..r..U...Z.@..ay!@P..Z...../6W...Q.3.J...G.B...mQ.6......Q.U../.[.......==...l..#.S.b%]..J..."...`l..A..l..g+j... 4n..g..fg.......a...(...c..f....A.py.P....^..&1+..92K....H.".NM@..<.qR7.:..Q.F..Q.:o....A.hP..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\J1sC999.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37328
                                      Entropy (8bit):7.995057339129456
                                      Encrypted:true
                                      SSDEEP:768:KR+fL/sMSl6+wLorGx7aQiDFMMalDJQdjcNrIx9PH8bPdzb:KR+AM+6/or+GGMa4W5Ix9v8bPN
                                      MD5:D71373B51091E65F339FF58CBFEA1919
                                      SHA1:DA2C2A1F4E0DEB3F4552F43DEE894DF478915EA0
                                      SHA-256:6679F7DDABF9AB911BE4CD66BF10EB5F2423BFBD6A5518136ACA1E57AB942FAC
                                      SHA-512:E420C85AE9D14400322E4F56ACAE18E736C4A501394C9F4338ADD5143506E96ECDCF039676576C4D1B84CB9CBB1C90D91362AF7BFDC29223C6E0C97330F19353
                                      Malicious:true
                                      Preview:R.%?8...Gl......!.D.:-=...J.o".G..R;EI..0c.u....w.....,....*..$..G.N..7.oY.h.+$.....2..'.....-?.....Sd.=..Q>.:u.vE.....&@..X.....|.Kme..0...P.RP'.3/.....}..........U..j..m...Ei^.8..B.T...M...C.sn%....\..u.4...04.......R..Q../.....N....\....S5.@.....LS..y..Y.$....8..../.@.........[^fXl.S1..I..O..,.i..lT..."......w..y3.U..N..:....T.+.. H...a.N.lZ.m..=.....}*..._ ....^.. .....MT.7.s.tm.w..ME...D..uG.U:~g..O.:.rl..)i..*$..& .`,.....C.s.W........^a..m..c.nl..6...^.%..I.m...N.p6.<|k...FL.~.qLiB.......od .1.._.\4!cWN.l...F...?K;/h\..u.....K7.h; ...P.$]S.n....)WB.2...;.z.....\..Z......`.5.Xv..d\Tp.O.q< K.ea.v.p....rr...(z/v....HD.xq3.MC.-.....M..k...pV?.........j.!~....,r;.;j.?.g.....0.........{@`.i..2..,..73.../.$;.....5A......0SE...r.O.A`X.X....R.5......B#\f....$T....z~.;..Qi....._ .D...}.4....'...e...*.c......n...G.sx..fI.C.0$..].z.2..S'..^...~..^.U.8......Z..;....,....Q,.a..&...)[YE.(..\r.[.aa.o9..B.r....-).z....`}......52:*iUMT._.a.n{

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\J9llIZR.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37300
                                      Entropy (8bit):7.995396580980663
                                      Encrypted:true
                                      SSDEEP:768:umY7E0Rm3iYvDUvQEBwYraLzBkUkPc55l0QyujL2eABy:uma12iYvDUYEe04Ik50QyujUM
                                      MD5:829D63D980A6B3E9C4582635F0429E61
                                      SHA1:1D4C24F5640F41ED6D53A9E34B2103D1B84466F7
                                      SHA-256:8D18592C99DB7FB86439658DE1578E9FECBA743DC003AE4AF6A62715A6AFBE14
                                      SHA-512:C4FFCA244D3384467B57DCFB13190CB83BFC472F93593A2550A64BD6230F1EE7B2C55F80937F0B5D36864CA11E78C1B67FBCB02D7127B75F69A9E36027C7CCFA
                                      Malicious:true
                                      Preview:.t4...E...F.7U.D,>......x........LU....f....M.........OT..94..i......y/.p..O.BE..".R.Q.f..~.y..c..[.....<.r%P.....d.p<.\x..V...5..a....O5....J....Z.e.X.a,..a...5...^.....q~{..#.aY.Z.H..t!........G.<@]..Q.vbA9.{.h.Y\....m..i.i....."...\...b.B\@....)kO.b.I..{..9.........HM.70..b.x..q._G.0$...A...e..f..V/.k..;...u.<...\..>Sd.......".%.1..v.{J...S...`Kt..e.4g..[.I...`N.oV.s.[Bc...2q.?z.9...%b..^".-.. ..........9X......l._z..*..C..t..cp"../e...t`.l.Z(.:|g|bZ.O.#..?...eF>.I.]..-5.L...C|$.....!......0.-..W.~JF.9.#4..". .........'.o9.....OW......`.F......i...l.0.|.#G.(...z..}..u.1..h......=..Dmf~c......./vs..4..Z......)....A...b?_o..N....{.T..]NHK.V.P.<6|.[;.u...wE]........8X......)aH.....Z.p...w../cn%...t.Le.7..b>..8<f...T+.cp^?.....,^.C._..P.09.(lD..F?=.U.J.....r.a.a.....a..;jp.m...r.OOX.$t.o:.]Q.:.|......\......Rs.8q..'..a.Upb.R7..O..Y...O.......N....Cv..y~/.w....+...uN...C..(.0.7.@9..?`.t...E....n...nu.!g.r..tY..+iU.B.yw...8.e...R).-....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\JQvluum.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37279
                                      Entropy (8bit):7.994729147118717
                                      Encrypted:true
                                      SSDEEP:768:nCLIdj7B977oA0ar/Kf2n8gKWV4mGLND+Uq6:48nPoZE/FnMWaLsUq6
                                      MD5:9CEBD169FD4687663DAE761E80D75109
                                      SHA1:15DCE2C4685002552EF5348079AA64781C16BEFB
                                      SHA-256:32EF5B83C28997FAFA08E50DC55AB766AA2682A429977E3B4FF62C4DC82C889A
                                      SHA-512:6FF5CB34E08A5F7E7464535465E2DC407416F76584A86F829B25547AA0D62DA95CEB6222392AE453930B74700D073984FD5906140F6F56AEFB6DF9A6BB676833
                                      Malicious:true
                                      Preview:.}......A}.l..]4......g./.U."wZa.:.n....B..'../.|.......].#UO..2.8..|p...|<...~...U....Qs7.i.:wu..Q.hD.>.w.H. ..fBeg!..O.a.B.A....#....=b..........T.FJXcdN.|~}..c\.|.u{.w(....p..).0...K8<0C).,.....m".-....._.....:'L......zY.gv..-"..in.o..w...r5T....S....S.^..F.....G........S.N...=.~T.I.....F..+'.q.....8l5.n..........L....[.N.;A.A.1|I...^.i.*....k.....=B.ld..T..3.r..-jj...y........(.KR.....b..h.G....w...`d..k...G..Q.._..9.j..U.]@gr...zFI.c...M}G.:Im...t!...'..Ts..z..i...&x.y.v.\.Oi..1..`g.mh&^.&..........)Q;.c.T.5.......v..vx3...F.%..M..#R+..Uq....YoX....i...J`.I..G#;....G.TB...#.<e....Y..s...%.....r..:.E.D. .....R_...\by....Q....|{'.N."o...e......!....j...$q....Ko.>..9..$...#.+p#.nj..I.~..7...P...?m.{N..l...K...n.#......V.ak;%.b.n.|.J.*.sV......a...WL[J.LY...y...o..`..n-...mf .4..JT.n..m~.....J..k.N....@.3...?.}..J.gqw...r.p...,.......7@.y.(+B...M.zv..G!...^..!r......!G..I...,..B&.6..^.B\>no<[....{.{.(T..&....5e..\x.H......W.?......

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\JYDzpUJ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37303
                                      Entropy (8bit):7.9954988427766915
                                      Encrypted:true
                                      SSDEEP:768:HcSr5/urooC2e3dg25tES8PSG6/hB4HdbSWRFzKwBHBhjmRHl:8Swroo03btEFP0B+5FeOKJl
                                      MD5:3CB1E6905B98B23B30C4BA7490CD5D1C
                                      SHA1:2245D582DBC84AD958CFCF4C5F4A998E260A5077
                                      SHA-256:B50717E06D8A012AD45FC0B719262C521F7E94C099E21C3D9ABD95CAB3EC7F56
                                      SHA-512:FE8B5C8905031B6834054C4457AF93DFE871A9C2F9447444B1CACBFBDF9DE46FE74C94577631948E65672FA95119682235D888567A2E1B3CC1F84D2339557785
                                      Malicious:true
                                      Preview:.Ox-2..e.=.x;.....)|$....LR.o..t..qk&'....H.B8_...>D....8....a...D.&/...-\&..^...,.....=..o-Hrh..5.WVO`6.I..9.....5...0Z]{?f...6.A.I.W.z.X1%...`..)!5...ZGS%....W<..K....Qf-0.Q..hJ..wT.Jp..x....!...F7.[.b..o..k...r.;...[&.._2...J'..]..X#_...[.wlU.l..v..[_>.~J.4".+28....Z.Lfc..`...GMnr..D.Bt.4....r..e..:...)s.T.lh..8.5.[e..R.R.q...E........Z.;.W....I.K2.Fw....8.;..Fz.......... %7..1CU.*..G....k...{..:....>.....r#Jt..~a.7.D'\..gx....a..Y.......3o...z..b.......c.~....=.Q3...u`.()...Bb.m.2....8r.'F.....|.D...cV....F[1.gWg(QW.......=8\..O........8:..,..5....E..BG..J..S0.a.M.==....(...YK.....{Nv.c.c.6...,.._..X...*.....g-..XCtMK.5..c"_..F.WY'..`.l....^..I}..wy.J.:W8y..J.$..DJ-Tz.vr'..;$...g.....}..:......7....`....Q.tqt5.!..Y8.].N.DF./...F........g..R....M..2n.S..@Zss.3.Je.N-...:./..Bj..g0.i.S..M..%..>..6Gh.%[..&3.\.}..%...7&.v.Y.wJJ.C..Hi.6..,..'P.:............b..P....}U.;@..~.~..P......C.3ZM....1.z...b..C.r.vZ....L...T..}....~..0...S7....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\K7I8BWg.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8180
                                      Entropy (8bit):7.978942924511559
                                      Encrypted:false
                                      SSDEEP:192:gpYrwFR0PgsGbXc5vC/VQH1qFHYyLAZGI:eYrwFiPmXcSVQHQhYUBI
                                      MD5:0CFC1DC9B749FD8BCC5449AB5AF1D57B
                                      SHA1:8437C3E591DD5E64DDEAD9E902A7D58F368192A6
                                      SHA-256:80A0463169ED1D9C432B3E5D3823E93AA8F9563F7627D6144DE56ECA87D84718
                                      SHA-512:23A196B5E661D4F4DB4EDCA0D1B1F70D7AFACAA3B22D0C41623DCF2703B46D0B0ED8E6D56BB18E77F1BFC3A19BC24682864AE12DFC96201C4DF882B767F2EB86
                                      Malicious:false
                                      Preview:Q..|."ncS....h.WUyp...ID.v;.w(......1>.,8.@/..7E.?@1..C..1.k....]....K.F.....E.s."f...u....{......'...^.MM......dB..."b......8.?...`.nS.G...\.Iwh.{.(.q......{.6..yIf.....#%.))>4.Z.^.{\...z..Q......1T...5`......sd.j..U................f.0..Y<.....-b+.P..F...T....H.}lM$o......H..z.....]...-*vg..0...A..U.2....5.`J...*>..<....*W%..?.$.....T..o7.7V5.t...2..Z..z\.6L.....mc......{...g..T..:..x...A.y......\!.%..s.Qx........,...c.V.f<.wi@.H.y....S]...EA..8,.../j...C9.W.6.o.16..)r...........r...QcZ........................).i......D.|.l.V..G.k.h:..Bl..>.*... ..3.;...<.ov..>.d..9.z.E..r.....n...t.M.l......@i....iUtX..UB.E&...Y8..Yb9.c....S.. .&....7...w ..<..t....~...?T..s...C....E.....JxKB.\n"......^.w].......{.....H.|....PZ..o.....S(X=ZW.JW....rF....[H......;.z..c..m...'*b..i..u.p@t:.$t..._.*.. dbM..$.....j.?..1Yyt..aN.U.".G.....U....!6..s.....i...Y.I..[.^..O.......Ul$..k..[.a.inj..vpif.;@o..?..E........&pX.`.}!....k./2......;+...WB^/K.,..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\KA3bcx2.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37316
                                      Entropy (8bit):7.995774097452058
                                      Encrypted:true
                                      SSDEEP:768:yXRwmsYq9k6WgR2yjeRCt24HXbrqd1pPKM8dC4twny+TjFWhZhrn:mwms5Sgw00gL+HpPj8UyPhj
                                      MD5:21FD3B5EEA7337F09CAC71EF49F3B13B
                                      SHA1:E81D737E1B9BCF1DBE2249ACCF46866B3CCC0DCF
                                      SHA-256:51EABEFFDD12F2CAEDA729B0CF10942B37C7D2D4ED99AF9C1430780C0D5D3D61
                                      SHA-512:4204091503D1F175BDAFDE450641FD50146AC01EBFE5ED9D247B50419D6D47788BFC5C5D0F825AF2670E8DFB2D344A5739614A57698CB119448568B941ECF705
                                      Malicious:true
                                      Preview:..=y....K%&..'|.l;~=S.LE&,...pR&C.....p.h1.a.M.tMR.*.F....V..Y.U..3..Dp..4p....k.@..=b..LDTF.A......(..P...'%.p<.xe.....u..~{.,.1u.....0.QLF.....a..}Q..c.~.q.B......e.J.vGIu..Op..'...*c..t$...rk..?j.~.x3}-.4....c~...B.nk.T..y...pM\Ui.h...&.W4...5..l.|S......OuH.....1j..{...^...A.Y...-.S.........pL.B.U@.uz.1 ..z........}B.mf...i.)..VR.L9.W.i..!Y.....\..)..7.q.....l..V..S N@(..@.r.>U......)bD.j^&....BPQ.....{HJ. .....F..%s.KPA..[......=. K.cyB..l.f...k|{.;....^O...5k....`=.... .8.....s3.....S..>..?.p......I.6...Z}W:V...r.....G.T]./F8...;-s..T..KY...E..^P..c....1Yg.z.,...i.$|.......;...q|.s.256::. EP.Vg...E..;.....T/p.H....\.|K..,~1.zh.E........=I.5 ..............:.....k.U.MY........Mt....F.[.k.F,.5.DK.C...J..G...#.......9.Z.....i....ES.kU.`..c.[.K2<....U..],(....C..&.b,.Q.C..C..}..".N......).L..7V.$P..|K........O.P9R.p.[.g.M.h...n.F.......D.Y.GMy.L(.....+.J.(..U.9.31..@.}.K....@.A.}...:p|o..=..Y....V..@.....4..)......Nw.*.X5....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\KJTdWwa.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8180
                                      Entropy (8bit):7.979437672674367
                                      Encrypted:false
                                      SSDEEP:192:+/6aCLzsyeTJ2VklfMeje4lsX83dJxPWQXq71mjaIH+bnIknAAiw01o0:+CaC1AIkWeyisXeWCyrIH+lX0
                                      MD5:C062F58D70305D29C68D65C98AC0A66D
                                      SHA1:C65F1B1FD10A6BA1DD657D6B21E79269699C2CD9
                                      SHA-256:76C51BEEE696A690BE6DDFBD2D4C347FF981DD1664FD0AC460180E0BCE07919D
                                      SHA-512:7BD002D61C6E29165A552394605D613D23C69E744332A0E3D4D52C30A2D8B9E8D8ADCBD1B38F377A1A3E5A4C87D6AEC145C415CA73728E75B6980D7D1562A1ED
                                      Malicious:false
                                      Preview:x.{...&.7...m.*.tT..AG.....U....j.o.hF5.|.R .Q../7..o.....g...G.?.uB.}.2.]f.r[....1b.....{.......}..c.p.Eqe@.B.(...H.QU.P T"_3rQ.md:....;K"..._.Bh..U.(!.0k.(.=..k...!0..h.......'w.wt.. u.o.#...\..s.?.......QV_...p.(...8q!Q8w*DCt..o.j.,./.}4a.8k.x .;.].._......KuQ.A.W.BT4.E~6..(0...<........Ep...W.Q.&.J..b...P.s.[_.p4.........GB..E.5w..(.s.gm.t..{.=......4LJ_H1G.....S3F[.c..P...B.i..z.c.x1..vL.b...M..........'.?b.A=...,. 9..L.../.x.....3.."*..<.h.=.{t~...WI....M....~......n.!...`....}...1.F....;.%.H.q.vfkN.D)~.h..j..<.........(.\.9n.A..L[].-;1...KD:.).^t]......L.H.${7bm]...%...v4.l....Wg......g.....L....d..,[._.?.?uf #.m.q....<....Q.......9KQ.3D.;&.X'......*..q.K.&.wyueJ.s.&.].Z'...( xe...M.....j.F.FI...ax.U.(..x.+.....eF./...V.+f.?.Y..E..'....tmH...r..\-.;\...%.{..9-.W.6.(K....'NV.H..|.q....N\8.g.M..7.}~G.}$R?-..&.".|%....,^.....!....s..qo.6.....n.../.....!-..J.UD.et#It....t...F.m..L./.p.....>.'.!.y.......|.O..B..e.\#.7....P.V.q>.<{....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Kxwla7v.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37301
                                      Entropy (8bit):7.995815631841554
                                      Encrypted:true
                                      SSDEEP:768:N+qSVeb7f+yvpcJFoq3A5dpfvS8j0WX2zrs8OMCgai3o1BfW8vpN5z:Yqn5vgFoqw5dFvF0NzXdB3o1lW8z
                                      MD5:12A2B3A28097D03DBBF1F90FE379A75B
                                      SHA1:9B8C09B4C1E105CE959F83E13CF9BEC99F36E940
                                      SHA-256:F2DBBEEC8C28F41CF169C56B1C818FBE865B5C105A48A456AFB7B93710C35AA5
                                      SHA-512:01A293013E215EA25FED69567DFAB99842568A3FBACB80609265BF60DCFAD7B8B8647EB96B96517742059B6BB7CCA1C028C45B2805C3D2210E9E98FE9E5A4828
                                      Malicious:true
                                      Preview:I../.../.s.....{.Ix.v.$N..e....!J&..(..e.w..C.`0...=......K.IH.;..5b....l....0.|9t.M.oXG.zM...=....h....c...G2.V&.$.U\.....[EJ..S.#.9...^=...~j.=...Q.p..`6.)c.......o4F...i(..ff..&.%..X...h|..X..6.Z.f.f.6[.`.S..7E.....CD...v.......'ENE.|.....5W5........'...g..iZ.....W$.."..6gv.[.fWc.9.....).a(.4K..s....-X..ly5./.=.;.W.^.%..L..:.^5.g.....S.&....c.9Mu)..6....J.H{.y}c.C...x..!..!^\..?HLk...SZ{.8V..z!.........."......6.~...M..:...gC.m...g=.L".....V2..4....2.....B{D3.....j.?.Z...n ....%.C5...2...b,.o...Cd.|{.Y..[xo.0...bW.V.6..Dr.U..{.........;.S..Uv.=.T...a<.....YC.,.i|...?VQ....,...H......rL.&.I....z...k...........@.P|.E.W.....|.......{.......Q...1H....<^.]-aQ:w.M.m.=........C[..sV.z.R.8E"....c...t|-.<D..S.....w.<........v.};/O..QC.... E.x..JO.4,.n..=....%#......}/..uE4..EUE..T.}..O..t.K.L.0...`.M.&L.+..-8.v;d....-h.x1.S.$.....%n....N..JS....2..b0...|=..(/........P......=.V.[:.'q.X.p...$..Cf.I...~5.M....r........bp..q..........p..#...4...=.2

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\L1qUIpp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37324
                                      Entropy (8bit):7.994565412432962
                                      Encrypted:true
                                      SSDEEP:768:zHxS306zqxaRull8Fk4Bz85hW13mcAgEDairaAc/rd0EVO+ptckQxm+nmkEwBUk:1wix/n8525cVdEDFaR/xNOwOkQs+nmhm
                                      MD5:035179BAEFEA07AD346D3443F91E9673
                                      SHA1:50C054D870E4FB10441DB1B80DE133F24DB5A95F
                                      SHA-256:311BB6B6BD97BD63323890D672D47ACF938EC89904B3E779D65775ADACC34D3C
                                      SHA-512:9B752C9352469CDF39A281C5F86A97494C6A71ACFFFA6F239C04084E9322491649421CB0A3FAE7CD366B107577B5269FC00B403BF6C6366D372DF38FF2341421
                                      Malicious:true
                                      Preview:...^Y....1..B.Q^.5.N.6w.=.|..,..5].......y...+...s...NY.|Hp..3/...w.yd.}...=.m...S.^zi...Y.N.0U..1......v...N..r...o...WL.....}....R~..P.-..^....Ew-...x\.......;.'....~..'.T... .l{..P....!D....^.....J......_6....=lV5..t.N.4..N.=..I..Fx.pq?Ik.O......~)....{[.....M...X.....LE....L.z..p4.~wr.e..|...h.YN...5.E].K5..m...dK..t#..5.."..~,.@.=...L.'......"_..B..{o....4..l...;.....i7..Q...:..B........*....`..@xw.f...7.......V..r..%o..'.C&....r,...1Tn/J.........zt!.E..!.V%.....).....0.h..>b./.K.....<.....F..s.G._........=..yQ...Ze.T.X./..Fq,.R.F...d+...|5..D>.B.)E..E..B.{.=l.o....mu..w..p.H3^.0.Vc...Q.-fu7.!I..z.....(.xL....>(..*.]/..(.....\WE.+.a.Z.{`O-RB..j......7.G..V&..^6!...r|...p......jW.,...cl!...{.I.fP.....fz#..z..^l9..)....d.d..'.......`'..7.;r.....l.6..^s.p1..'..0..n..a..%.N~..;.-..}e...S.wd..(t...6......8...ST.[6.t.g..[zp..R5.5....@}.j6..=l..5C..]'.?...F...v..U.....5x.-.W.m.`SL.#.N..0.d....._...a.X.$.{.k....u..<v.&;w..L.*)....Hbf.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\LE9WQlS.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37281
                                      Entropy (8bit):7.995501545557008
                                      Encrypted:true
                                      SSDEEP:768:aoxImZEu1tvB5wGQcqYf0lqoBDTazxgnMtFm1Ke2LstQE4TWJYya:lxrHvwG5qYMlICsAKtsaE0B
                                      MD5:44837BAD7BB71D4096B9862784906B4F
                                      SHA1:E7E9BD2C070E567D8A5252B9FC3799026790F5AA
                                      SHA-256:6C00F4A036BF3D88BA883C74349E560B37664578EB74B8F7F3940A9E879759C5
                                      SHA-512:36015EEABEFA7DC0DAD37D93C275B870096062FE2FF1782E157CD7490683D3B75F924D6549F754B32407965FCDAC664764A9A31356BCEFFB804D19542A85709E
                                      Malicious:true
                                      Preview:.....|.h.$q*B....l.....|....<....w.r<.?.C..i)...D....[.f'Gr.....#O..iDh..ZM@..y.Q._B>.h...M...>aDSr..Q...N..p...C.g*..~....&.sUr f.......3s.1......F6...8|3.....,.\. *......\....c..Ro7...l..B...Yl...V*-.*..C.."....'p}L.wF..d.....`.F..,.:.4.......i.*[..6.({....z2..T...t..Q...2.H.....\.....Rt#F...0.h.&...K.?.R..F.#..R..+....a.~.-....|....M..:..}.U...9......=..hr.^.......e..Dk.j..&....g..[Z....gF.F...?....3.L....?..&..;..S......6..F.s<.....X..kPO{...X.7|<.Z..........^..d..p.L4F3./..q..M....6..i.j-X..........*"...o....4.V..bb....e....y.U.J..(.R.Xny.1.....L...........^.(.ev.5.........(...l..y....B...=.Wn.T.P-.>=Ei..8.JUr.51...oD../&.....`%0..JS..f'....}=^j..5F......}...6....Q.."...C0.....8w,#..N..n.Z.F...0..j..G+.u-,...M.......1../.G.!.9^..#...=2.H..c>e.6.=#..Tf.U.5=.o...?'..R...T.[.xE.{......o......F..xRS.L...\_.[..Q,......4.5.....>...?w...Q....0.....AHx.^#kn...{Uz.,b.".2.......[..h.?."K.~..IN...L.j(r.M......x..p.......?..`.`...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MHZNhU2.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8178
                                      Entropy (8bit):7.979466381814035
                                      Encrypted:false
                                      SSDEEP:192:T0u6vtanYM/7a9BzLstKgsRAnTSMCbst3bhRhmq9i88s7:T0u6cYW2AtORmTSMEst3V6qE8T7
                                      MD5:EA36A89D37CF8BD620B36F6B6D77E594
                                      SHA1:BB257B42996DF81EB7AB95242A282742F23C5B73
                                      SHA-256:AEBDDCD2303B3570D83C1D19215573F6E0B785FA382B9C48877C61E2851A3996
                                      SHA-512:B03E0D61520DE271625BB24EC584FC84EE318F1092EBC040B59C53B3563226B5DFAE5EDBE3B8A8E55DA02E9B31D0D4CD93EE0A317CD3B11C66B15FDF39DFBEFC
                                      Malicious:false
                                      Preview:..y/v....ium.....%.nsE.`..._...\.tJ..U8..........[..?......../...7...DHU...)......Y.0...)..J`.T...M.O..m.p$...T..e...:T+.$..z`yr.O.)@..W.....#........(.p0h*..u..5^m....P-.<.q. ..B..(..(.(S%.m".=v.[s.gl2.,..(..7x.b{i..;B"...G.rZH.s.......''.*T..{X....&......@;.H[ar.....RA..O....}R.a..}..."Zs..Sb....b......5...!.XG......x.p.b>.*.k.....".2?..|.....d.J..n......,`J.....3..Y^.C..D..N..........D..."............ocZV... ....E.U....R....._.?i.D..lL"..:.S.@......<...)zZ.8....znH~LU..s.f.F.<.D......saA.c<.N42.R.z..........#.....?........G.2.Ga.V....I.,...Hr...B:..M..Na^.BHX(.O...23,..............{..8i...U7{;S!_[(.c7..C..6.....).r..rQ...)8[.^.W...p.\...N..~.]...b.'e.......m^1.......T l..v.DlFT.v. Om..5...A..u....X....+...d..:Kf....~.x.h.FY.......3G^..c.S.'99.!>..{..._.G=!.b.V.......U..2.."..-./..z.Y45"3.5...*_Qt .v../..k.@......v.Fg....iJ..u9..p9.w..#.`..5.e.?/|.k..(.g....d..y-......%.EM..y..g."G' ...[#.....R....eM..>..[}W....&r.8.8|..$W..8...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MhmrXou.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37332
                                      Entropy (8bit):7.994565591937117
                                      Encrypted:true
                                      SSDEEP:768:Mw4FFnLvKiLad3n8/aLdfNhx4oeNirdsgzrh6DhaEyj/iK+m:dCFnLCQN/aNXaQrdR6DhJyb4m
                                      MD5:9310D6043FB95814A9F3C6C25930EEE7
                                      SHA1:FC5CD1CA793463C31A98CA5D751A81113B084305
                                      SHA-256:D7AC3D9D6348D953D38BB4D5F26CF2C4A77FCB70F2842C3C8FDF5A96AAA21FB9
                                      SHA-512:850208A5EB80B4AB7E3E159997EE7221670B3A745CCAF9E5EFE3A7DE48C8C6F42EBFEAF567E30DA7B26420ED93BF71835224FCE6E91709F71F0D63B2DE065682
                                      Malicious:true
                                      Preview:..._.$dQ.:M......g..o.}..w;s.f..;....h(<2=*.Yz.\......8."......a..>e...KO.9r....H*.X....].K......X..,..<..]......T@.d.......'.v.9.Y.>....x&%.f..g?2.H..N...S,.f.....h*......K...a..x/.. 1....Z.rE}.....*z..:.;..-g...*..,.%n..U..... ..R...U...dqR.Kc#z%.^.S.."L.F.7..=....LE.B..].y3....^..0.@..I.D.'.m......x.yhugMz.......N7..7.H......=..`X.L.p...9..`.kB.-!..+...V?....Y..3..*.wYRY.....@....Z......y..;F.2.C....Z...EO:."Kud.......W.v..8.....b....G.:3......<...% /x.y..Z.~.v7.$...;..!..s.c.o*...(n..........N...N:....|.Z[..k.Z.G.....n...X...!..m....+..t...c...M48VxX......^..8..0...E........D..2..#.m....%....a..^....1..\(.......,OO).~0.5.....Bw...1..R.y.#=.x...V...-....^.A)1\.hz..r..!y....Sd.8.B.`.>.^.........".y..T.Rv......"~GJg).0i.........q....B`.Z...6..1.".q..bQ.E.w...Ve.<S.{s.....2%......t.-.\.....k_....OQL...N..)......d......F.q.A.cI@mI#.G.Ay...adv.....B}..uE}ri/.*........x.0....uU....w... ....Sx$%...VkJ.#...Re.#..A.l.F...P.... Y.e'..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\NVMmR0x.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37322
                                      Entropy (8bit):7.994886504302602
                                      Encrypted:true
                                      SSDEEP:768:MGxK5ZN7PDR6i4VqQ6BTWX0Hf4PWqupgpCOoG5NpGGU0HW:MGxSNT96TGB6X4ld+Cwpk02
                                      MD5:22E61ECD9C9303C9D98C2B8F6C973F56
                                      SHA1:5E6411F2AFD9AB9744185D54A105CE500C3F4359
                                      SHA-256:98AF2A55407FE00C64E5BAFA187E93549D7B97C86E4AA9723FB32A13549B7404
                                      SHA-512:EF6D75D7DD635171814720798915FF7EDA4A8ECD4A01A73EA343CF032476E34EA510855980E80AF78711EEE46FE24E2D972F1C6CE8BAF3654E65C67B5E6647D6
                                      Malicious:true
                                      Preview:...B.xJ...e.,.....J)...CHT........v~C.....qvVO.jt.,.~..v?...(..I..Q..{a.....5..V....5(..2j....i.d.D..rM2...|.4..&.f....m..^..R..v.f`.....6.N.xBZ.eaL.9.z..2.7.74..$5...~......y.Y.&..4r..)....AI].....i}1..h@.Mh.b......b....m...z..2..7..I.[.[...R....t..z.8.K......I...'......P.uK.o.J.%.]kd.....>,^.z.|l..8?..kp.....\d/I?..x.Hy"....K.......sAeHO;...Z.....&Ay&.3.,....>.:.......3......v$#..O.5.k..U.k\3.V.TN.N.H#...GU5.l n...J... ...!.%.R.WS..w...>*..`{..h5.g..m...<Q..p.XX|'..E...a..Y.....C.^{;......{Eu.p..........3....~.......'A....M.......2i....>.t....U..kwH>.p_..U;.f[R.V...1.....w.H....'J.f..M...}....j.....B..'...V[Ky....c].(1...$|E...d..8vT.......>.:..S..<<..i........ML.F..R. K..{R...bj...Q.L...e..![]..P.vW...7FU{<93..N....7...}xEE.....Y.H.N..........f.L....[.T...........J.%...n...R...,y.O....'.j..Ph....N.......0.o..=.:.....p...*.-....h<......B]',.)..Z..Q..z..R.k..f.+.L....F..............xK.........2t...[c......D........6.wU...{.=V.>..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\NVvdoe8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8210
                                      Entropy (8bit):7.980665100843189
                                      Encrypted:false
                                      SSDEEP:192:QPS+vtczW0C9thPo0IJpfm5SIMFtqrizsOJ2Yq:2Cj02fm5SzFtq5/
                                      MD5:059263E33832B08A8A1276519441C31A
                                      SHA1:F0DC88F30FB31F6E2BE7D244BC489DF5DBBE10D7
                                      SHA-256:84FA0CDDED77EDB56C089174FCAF57F5376C14EFCDCF4FD3D062F7AAB830D5D4
                                      SHA-512:AB3239394ED07772834AF628456C3474007C0C86642EC4FFC6FDE72A40BDEC89BB20758117E2050A9E527BCB52547EBFEAA9B950DAC97DC75F36F83FB6B7C657
                                      Malicious:false
                                      Preview:)H.0"b.#.M.D..w.<)...~.&8.....q.25_.(L.K6]'Y...%#_&...(...>z.K.[`..k.C....;....Z..I......D.7.N.Iu.(.1...~AA...LtD.4M.?....n..rcs.F.....o<..I.?..g}......U.5k.I..$..~.......L... f..h...M..NU/8.q@.f{N..(G...2...U.w.p.LO.......Y33.DtM....[..D..!.T..D..cj..@D[T.q...i<z.,8R.~.j...s.... |...=.W)gS..........5.v}......e\.F.........{h.z,..........a..S>..MYI#b....YB..*m.7...M".=. .{5#/...N.v.{.w...zB.R.YR.B@..ny-..#.{...4..........M........IJ.....|.y....qi=....=j.X..b...]6. 9..-..K...`.z..A.....O?..aW@.M......M<+...5+.G"....f...]..98..k]~aAi..j..OqL&Nf..!!.u..v.b..m`............._T.+.h..4..$.1.q....KtC.5...v(w....P.Q...5../.eK..i..z....ZY..l.B.<}.."..!u...>^r..u.....p.g.....X.W...S.qm-,..@.9..t......q...]Q.......w.~...;...e.3......W>.g...~.>...P.@.S...J..m.../n..X.cHF}U>O...1..'..E.<.N.e.@...._..=.<}..=3}...~..n.....f..z.t...?........<m.........[.p$......R.J...)5..=,....@...R.Zk|..g.;...u+.\S...L.....>.~8..x9..e.P.qeA9...:....{c...*E...\.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Ncd5nAT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37277
                                      Entropy (8bit):7.99504361173351
                                      Encrypted:true
                                      SSDEEP:768:eJe0gTq+izYmwTN01TY0/O69IzYuyhOvkSFHnHr4Xi0Qt:WEmeNWY0/G4h8kinL4XWt
                                      MD5:26FCFF5E41D180CE5A1F9F166631C10C
                                      SHA1:C776BC2BA076BB5EFE972ECDA394956CFF1C187C
                                      SHA-256:F75577EF645F7892C9AAA905DBF5A14EB6A531283504467945C7A56AEC6E3199
                                      SHA-512:9264B52B42E9316B86D1281B9042DDEFB584E37733DD9CA8DB31A94BCF00D761AE13C0D978AA4D1128E75C040FCA1F954C69FFEA2295531C61DBA3A460EF0A16
                                      Malicious:true
                                      Preview:.*.o..6S9J..Vv6..$.&.v.)3..3...La...ob.-hD..a...\.....d..k.h..d...c.pW.....S.O..%.T...m.w.K...Uo..f.L*...aF..."....D#...........SB..+.....x..7...._....u$zh3.f..8H<..A...=2..I...`.Hd.v...C.{......V.Wk.t......I.gC...>..F2g.)gHO..M...R.x..=n.x..pTiQ..6>./=..o.4.[R]......l'.8........,...g.e..<!R...*..[..........(g..i.VDi..#.p..!..>..&.^.R...@..:.4.;.L.......&......G...)._.m.Iq.....4.@....*b.[..(Z..A9r...N..^....)....sGF'.......j!\a....-....u..............6.L..X..>;DA...T....]....^.0.+O".....wc).V6...:=.....g.Nj...s.].l.x.C_.P..$\.6.n....X.&.c...f&.x.5o....z....I.....{..N..}.= ..').<..p.,\...}A..du...1..,.C.N}.[.T.M...z.#..oi#p.6..]........V..V...d...?.a..w.#..&VEY..$...!.....l.Ofsb......G....|.F.B...}#.X....5.i...V..TY..j.....R.].I...I}.F..@.Zi..!.0k...<*.....O...... .`5..+.a..}x....L....\..=.....c.G...O.Q.S.I....B....Ay5Z..1..5.........6Ao....T.!.Q.%A....l.F.0........\H.h..R..Y..- Z. 4=..\ccV.uZ....\..G.d.A..B.u...|...a.(Hx..N2H\..t.L...)...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\NhlGfpp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37309
                                      Entropy (8bit):7.995825915308019
                                      Encrypted:true
                                      SSDEEP:768:9W3FEFQFnMn7K9/mhqlxhWlcI1B2RRHNrOboIJj5YJuPEf:9cFEMAi/ycY2RRtRId5Yucf
                                      MD5:FCE0D4131C9DC0812B413C739719404B
                                      SHA1:0878FCA7867D06C16CF7053FA20CED1A8C8DE111
                                      SHA-256:D5E34FBA7B59041B7EA8B082B0E9D8A42F4BDAFB37118E935EDCA9CF42E8BA7C
                                      SHA-512:D377D1D84100E5416E433C6C9335633DCFCFEADC9C3336137CBC67231FEDB4FA5EC1C7F72F4B40E6934B0CF0F6CAC0DA5EDDA693FE70D225C85B118F759C33AC
                                      Malicious:true
                                      Preview:..7.......I.......t..Y...a....6..X8.`.Xz.y.o.....~S..J[..Zf#M.....*.UW&...[-U.@.n.`..$.>b.X#x.~....g./.....r.g..^&M......D|.e..x..m.m..M..W.....Aa.......E.H...k..p..#..}..l....@/..B.`..>......Y.q$S(.....R.f.@|..w.MW..jj...lx)._..FI,l{.o..............0z..",..^j....zt...S.+.. *U...j.N... ........V..(..`.......n'..y.W.=h.L....~....y& .".J...#.>Nmh.i2E...l........... ....%_.s#+.i....f.5.9..H>.R.m.X...b.. .!.".h.]A5H..hl.vI.3%|9....Ok..'.@...S>...\)...jmV.....m1.kz.......F`=.....k...d...._..!.*..;.[:.._X>T.....l...n.r.&c:Yr.V..........Q%s.....sw.....w...N.F..$p\>*.......e..J.Q..2..F.ml....C..a.pK...P....ot...J&oVH:....o.I...Nym.......r..+..L..'..$T.K.....!.....V~.gz.z..*.Z.^. .v...?....\...._.G........M....)S...4jUBC..."?5.......G.....\.[.....d%b......Ky...QF..}....o.".9..e.V."....=S..R.d}..fp<... L.....Q.YIWw....~......s":.".T.*YAB.xA...F...?..dY..\.e|.BQ.X.\.1+X......c.~~..R^/....~...g/.C..!..p|...dr.o..`-..,.t.ck...`U.Xi._cRZ.B.KZ.(A..av

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\ON5VUHY.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8168
                                      Entropy (8bit):7.97819062925667
                                      Encrypted:false
                                      SSDEEP:192:U4i+cUH3x/t8jHkLPIn3E6XdJtSwovyDRK7RHWC+CHqcTa:P3ptaYyLJtSZvyDRK7RHWC+CH1u
                                      MD5:D736E710C862333AF85BFE21F428727D
                                      SHA1:4EE7064ED3104EA76F1011460C34BA0C1BB3C688
                                      SHA-256:CD72158D75F09047E55CEA90ED32D46332DC70EB7815EA566318F84E221390D2
                                      SHA-512:D3F4FD509CA8DBC6FC6B707FB2A4C33A200983CDC83BB43995B47092617740990D6C0790CCAE7AA7DB7272C8DACE1D256A522D8A970562203B36724FBA90304A
                                      Malicious:false
                                      Preview:v.p&N.'...a.....!N...CD.h.cX.gS....C.iI....lb..P.A....z`.a.M....."r...N.q.y.."@|...O.&*{.M... ..7.%...#.Y..E.[."9Z!@..Ka.].|.8..h.A.f.._.-...E....$....Q.....A.t`...W5.1.'......O.9..k2..6...w....-k..^...>......5qD..$...FA.%..c.<_:J..oO.~0....s.+.O.......%.BQ.YB...+O....G...4q3.....XaK_...Q..g......d..u9e..E.s.3....*.6z.S.c.;$.q..s.T.,....<zd..m..).s..l....+.\.U(.y..JWg...m...z8.....b(o..qy....P....Wy..d....&....MC..J.'*.....9.b[.........,.]N.u.{.....S..6..J1`..W<[.T';..9..k`..V|e..T.[..*...KM.0..@Z.-w.....pL0U@...x/.8..d%p.}.......f..2...[.0. .h...G=k..w?(..|...Q..K..1Q..+....~ISoJ'_...x5.....;.........^E./..|]`.R..eH.H.j..J..l..'.... .%.F...bP\.....7....$.K.T.4..w.>8f`.A.]}X..7je..qs.N......~.6.D'...e..$..N.......k)..i.f.s..W.....!X>..M..LB(..bw...4.p.|eU-...(.U..6"j.j.....sx=Q..c...y...>...[.....*G.5c....'.]uD.g.n........wm\7.GT.NG.....$..7.Z.....xt....".kW..-j.\.A.+o.........C...F2B..v,.eo..u/..8..4....7..G.S..j3...x......:+j..!.?

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\P1Ztk9r.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8175
                                      Entropy (8bit):7.978967942126761
                                      Encrypted:false
                                      SSDEEP:192:3+jrVtkkTpnF6iwe/lKYCtOkPOT7UMNzb2BU/:OXV+kTpnkylKle7UMZGU/
                                      MD5:E41B1654FFCAE301AF59A72D454D485E
                                      SHA1:4BC2EB8524C04BDE503DC8D2ED02DDC0FCE15680
                                      SHA-256:3A13AD87182C9650DFC6A121A355F4096A6DA4FB77951F5F8BE11389EC4CD490
                                      SHA-512:A65F3E8B6B4E99E6609B34021C086245C0DB3F80172AB513879EC1CE3BD451C0343FB889B34992EC0614ED09413DE0359372578191EDEFABFCCA53DA80BA828C
                                      Malicious:false
                                      Preview:..vQ.?.9@.5...'.{..-......?V..?.Y)Y....O..!./.Pu<..$.a.ww...`j7.S.......+j......pnZ 5.f.....,..r...b.."..[..r;..."...o#.b.......!.P...,}i.k.......3&...c>.....s.0..<..$.2...,.v.6K9U]uW.6..Dd.".0......N.yr.dR......../..X>..+#.P.j9Z#..2...c.t.........k.x...UZ..y.S'.V8\..(.>~>-..I.Rkj./..T..p..n....,@...Q..BY.......M.U....ZJ....L..7.O3,O....t.C#....d5.....8..w.p.....O....@...r......7!.^90sh.b.....W2.d.4....dV.F.(*...K*uq.."y-.6`......:..z.oD5..aj.~..n.f]..,\#.'.....O.......R/....p.y.U.*=..#......>..+..,c.....i. ....-5...V&...L.u.5......e....37.'`....V1$b..8@zz.l.*.?.V...cP."dKuh....Y.....,7Bf..cB."...p?d.&.b?8.6U..HnwRP9O.F.K"6n.R.nfH..K........_... [..9.......{...Y...b....Z...-.U..H..(.&.x....'..H.jP..\.........p....*...pH...y^....I.5:.:T.../.^..Z.-.m.S.|q.D...mjG.A)yJ...'....g.........p-..V..f..K..u..q..|.6.....f......[.....y\.z...K..?.W.dB..m.9...W.sJ.[.... h.1../C|.....H:.7#. .Ie{..^Ks.^....e.u.......P.Q.1/....Y!....P.$....O..V.zx..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\PNQK1Bs.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8168
                                      Entropy (8bit):7.974066107436011
                                      Encrypted:false
                                      SSDEEP:96:IIe80xfrbkxMwLEicLL/NB6I8d5cBdnEbVMLF/4hgZXybhPfSxNQWr86bCIaucnQ:KxcxC3LFB6L5cnil+BXrTbS/syQ5
                                      MD5:9054E836BC75CE13AA37289BFCAA11EF
                                      SHA1:0DB4E370BECFD211294CB904376C50D59FE053A5
                                      SHA-256:2143E60F3BA88C6F42BD565F398180646A4908E1647BD77C1B2AED6D09D6F9D6
                                      SHA-512:B724AB19332FB2C22E6503BF32686325606506BBA76F2EA672D3C1F3A68B4F6ABAC027C52C469B3B92FDC8C7A20673BCDDC1BD75FB574ECDD3347340D6A53EA5
                                      Malicious:false
                                      Preview:."&'C.6..)...3...Y...ic.ZO`.^..!......b..e..9C{}..&.w.V.U...E(..%S...|.;C.OZ..o..R...<7.vS..._.*6...E.F.t.V..*..U......d...K.d.F.....i..........Y.~...c.#.8.,...c.../2.r.K.^.:og...Y.y...."...(.).....f..s#UG......\.r.Z........H...N.s..e..>...[g...&..$....wK7..jc.p..^A.........P.X)...5c.d..*.=......p.S.zo.)..>Y.)..J.=.{..o.....D........2...wD..#..f8$.(...,.cMZ....Y...T.............wWm.:.....1.R.0R...F.=....N..k.:...g@....m..XA...../.2.7...9@....3...8]32..._..............M.....dh....2........M.#.Q..=..\..2....j.l....#"^......P.....}D.0.U....B9a.lD..F......}....j..R.E..... ...$.;g.T.....Q...4B.....|V...%%.(..n..x.C(...+W8\P....?.(.&....|O..............s..K.q.W.n..c.=...V.8.."...=(....I/..!Y..%.a..-....J.F..'.L....=;..;N$..]JAC~.j......1...U.rl....k.8......|.5..?...1.5.2....gs[.._...Y.w_......t#..}...k...Y........\....z?..9R".d.J#Ga.o2.=../.g........u.I..K.n]n...b...m.|.......>.P..H...#I.M.k@..+.<.p...1'....6...V.u....).....*.....<i....l.T.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\PSot15r.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:PGP Secret Sub-key -
                                      Category:dropped
                                      Size (bytes):8181
                                      Entropy (8bit):7.976622528870446
                                      Encrypted:false
                                      SSDEEP:192:9UUonfQeWQUOVnWtZPbJ2dIqQZlE3jt+m7B3HU:OtfQJtOVncm+lEzpE
                                      MD5:EC79A317FE59F30E4C8DC1CC2ABA8EFD
                                      SHA1:AAD8DF3338F06F6EA8E722511B7202E40F66335B
                                      SHA-256:5EE2485AC9055C96FC22389477648B7B5C4436996F515CF7B9217DCF59914D17
                                      SHA-512:F2640C48DF7AA9418141B52695CE1DB34679413BA618E6D6CCC37E6DF423B20EE8CA85378C59B923D8155E6F70C8012C0EA7C0CF4CC6C33088CE7C239C53BE53
                                      Malicious:false
                                      Preview:...#.l...#...>...T....[D#oQ...y.6..0.zmI[........d....~E....zgX&....=......O..@.&./O>....6.S.n..;.y...=K..].....;.........WK/.2.0.....0.s>.8e}..'...2.u.a...c..H.n.O..|k..Uk..F....I...sC.U.:@dj.U.%.Z......h....&.O]..Ims.....u......ry.4......?.Dz.!s.m.-.].....[..R,.9....E...6..~.W.].]..T.QN..S.J.p..@h.Y....{.T.S.z...~it...r.$).pt..Y(aY...x.DC..&.....un.o..o.8p.0(Pk}.;.&.z.l(B.'..q'.....Y)...`..{.\.+..P.n...A...r..s...u.f.._j.%.].....B.]..\...m........,.(....|..f5..S.?.4..|..Y/........K...2.Ef.8.1.J......V..rj.-......pG6Z..D.....P.]7.}."..;.E....)...~.Kp.....,|.....3.......x;..AH.?V...M...e.[.X.?lob.-..J7Wig...t.m&.2.\.;.97..j....q.....z..[.....-.-|....i<.o.....7.{E.h2......#./.q.f[.2.s..D..r.....H<\....L#Z..63r..*.i&.ft`.FIP.a..s.YT...*s.....p.'.....A..s.......5Q..Mgja.A..-#*>.h.>cb..<....e.!.=...Sj.`1.k.9u......4....li.._M'\.....f.x3.u.2S..}<7.[..y..4.. b.2.........>..........k.n...2k..P..{S..-..S......x......+n!.._......|$../)!0...1I..T

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\QqBi7zj.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37281
                                      Entropy (8bit):7.994598340587463
                                      Encrypted:true
                                      SSDEEP:768:RnuaWv2y7f/F18VyxqjvtF1E4uck8IDAVcdnxe:Rnur2y7XMMxYF1E4ucqAGdxe
                                      MD5:21B9EEEFCDD4F0DF397419E55B4D0541
                                      SHA1:8CC3690DE5792F4B7E516C65FCD2B237BEB293DA
                                      SHA-256:321DEB7FC9FD6A15BD179347E733D9CEC396682BCA73B91417C49DD4D569B084
                                      SHA-512:FACC860614C58C89CDA9A1139CFD4D2923AD01EE2E193271EB275ED3513D0A27D7B163B7FD7DD602B6A25D8152DEE2E988D1D750882A02698012B467AA9B91BD
                                      Malicious:true
                                      Preview:~.1.F.*N.v.;a....`.n'V,.0....0...U(<O.Y(6.]....x...c.WU4.n.....I.K.e.....`./........Y.."..F..8.h...8..T.Y....|......q...).8&.G.o....MV.>.25a.g.S....Z0..P0....e.b..6v?...X.'!..<.L.Q...].+0#......N..?.9....Q.?.p.?.#Y....o...".p.`Y..et..BH.v.Y'......P.'..&9.2..5Qa{.L@..).K.j(O.f.y#+#(3g...P...._........v...T.IhvZ.h....pvJ...:.?..R.>.....6O."....q...;..;8E.....jy..%.fi....-.5....>.9.......e.z4.R.l&.."|...#.;..].{]ul.P...x.cQ2@ gqr.d+yA8z2...C.....x....T......K.p..|...u.. ....t..L.(.F.K...D..}+{........Q.2.vL.Z;...1..>....$..........j.}.Pb.Kn..<w..j.y.7...3b...e..<..r.A7.....!@@S......'....Z.Gxq...B.5e...?..lT......8...DW_..N...>d.&j^.;Y\)..D.kH.H@....e.yy..$.G1.......-LM...E...i.o~I.".o.^@.I.._.1.b...'.4'.e.2TD.7.F....|....Vs.ij..=._7?.}.'.5....jn`....>.....<.......s.y.d..?mdEb..K.$....|...<.'3.U<..n...a.F.f$c..*iq...2...h...}P.: ...<......0w..&.6...<>z.-.p......3R..9.1..9.dB....V#.."b..S....%xzJ...H."xN....KZ..<i....6..~J.x..}

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\R60A3SY.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37275
                                      Entropy (8bit):7.99506334378645
                                      Encrypted:true
                                      SSDEEP:768:hRr7BS8Nack0DtwLWAVJxGNBGc/qKA71KsvON:hRVlxDluJxGNBrA71KPN
                                      MD5:107C75743040C946375E163C69F92FD4
                                      SHA1:C53BC492E451B9DE966B5765F5712984E6454CB0
                                      SHA-256:AF078C048EAFDC620E131754C1300D8F99399A4B0F00EBF493CDC95FADAEB7BF
                                      SHA-512:E1AA1B2F20F37A15F9FA7F4B306003402A4D7D55E1382FA317CCC7CA06F0A8C671DE7053CF201C38032A955248DE4773781C244A189D0E4BA6AAFEDDF4F98A46
                                      Malicious:true
                                      Preview:4.2....H.s..D(}y..#.?1]..C....d..^......].+P.\.UC....+........Aug=.x..bT!...|......O.m+.lMj^.....(.-.Wk..e..~W..2..D.....l.Rq......?"..U.8h<.../-.<s`T.6..;.........+D.H..#aEIq{9.;..C.z...........<.:.....C.y .oZ......_ng*(#.....V.y...j./.$>@...<.....W...y..G....^i}m@..".W.`.().Z..nW.~......7~W.i......Z.%?....}...4t.....G.P9Q..U..T.B}...c.&s..*GV...O.'..N..C..E.t..h.%s.2)t..jF...hN1...\x-.>..{.5A.%3kQ...E.N.IU..d..ub.1....h...b...,.7b!.u........1..XO~V}.'.......'.-.......N....^..?..H...n.P._G....UH.|Ea].z.j.p;e.#..U...T......d.....@.@...Y...,.....!....+[rFG...Y.......m.7.....`9.2.....c......H.vM.1..U..UiG.b..'...i.1...i.....].n..dH.....B..fm.8.4.T.W\.W%...:..... (..7.yM...q..A4Ib..@..8.P....*.........p....N.n.1a.?7+.Q..H.O.D.@..8T....8.#..`2.C.^....].s.....2..|....G............U.r7......w...m.P..k.-....b....SU..{..s.p4......!.S...T..~.68F.~..SN....M..kad.0;h.$.1...`N.....s...'x.c..-)..].... ...rob.N...R..5.XA....m.eM^...L......3[3

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Sa89Iww.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37301
                                      Entropy (8bit):7.995141626745175
                                      Encrypted:true
                                      SSDEEP:768:EdrF2KuSbRzCWpuEWQ68NOgzDft1cmZ4HMVf5zvpWxzlidsvZq:EdYKDb1UFQdOgzLvOsVf5QcOZq
                                      MD5:20D2EBC41E4B8CDB260F8CA683028772
                                      SHA1:F0356A8E4F7BF606F35E2F7FD38D7C801B6B4792
                                      SHA-256:4377F098E18FBDE9794CA69EC47A8BB392FAC82A380EDDAE0B3AA6E413876C58
                                      SHA-512:E016710A879DC1672556EC3DB525E77BAD597EE2B70FFE46E0E163EFB48672D233FCD72D98AECB9B8C2FF99AEA1A493EED2BE21DCFEA0DB904BC017568AFE3E9
                                      Malicious:true
                                      Preview:w....5d.Tk..dk.-..|.>%....\5p.`.AWY...c.....Z8Xh&N...w..]k..M..U.^..^.....[V....K...."....`...q.!..@n...J....9.y.3......?.-.......Z6...Q.Q..~-T..P...f-....U.N...#.'...Q..lv...l0..p.G...J..u.....^.....F....`.d..QL&.1r..w..^.x..'d....v..]. .%./..g....L.n.(...P^Ij4.b.\..-dE?.#\.....i.8L~o..[....@..<nbf.p..Vj.d.<...}...m...T..j..@.$...Do.....*...,Q.......:Ek}.....*l.t......@...].n...".VF4....pw.w.r>w/.,)..S."....U.-...b.=a....+._..@.?.E.S..p._.....k...[......z....<N.?.j..h...FTn6U./J._..W...p!..XCv.. ,q..b+"....m..;......./..f...AvT...[*..CA..s..B1.0>w..u.....?.#v....0.?.9(..Z.....JB.:W.T........<.)"*..x.?.z.d.m..+.....j1(0@f.....~..fb.Ry.".r.O...)....".w...?D9P.F.?iQx.p.U..Q/.M*uX......X.y.....U....!D8].......(.D.6.a.....>....Su.Z..{u.........X..i........'Jb...L.T......@....~.am....4f.{]%.......6ZP.CL...@..6......P......o/$.q...a......M~.\!.Zp.C......)..h....|B...Mk.+.pS....9nr].......Q.H..q.E...>.-....0..l...3...;..pp.v.6..N.N....^e.,..[.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Tdq0kJo.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37315
                                      Entropy (8bit):7.994473284295955
                                      Encrypted:true
                                      SSDEEP:768:eXNXnvd7QUV/X0rrsejXLPIQ/B28bjmZUBT+tC/XaM8s+kVUP8l:eXNXvd7nEPs4XLPFTi+BCtiKM81kVUI
                                      MD5:6DC6355D2A55CE1107C2F5FAEFDE86C6
                                      SHA1:AF3B4EA7DF9A7D8A923EB7160FB616A31D7AA8B0
                                      SHA-256:BEFE653F5F64575BB8F94602B5A3A22F6A44DD1C8B43AB67913C9D259D7E3E00
                                      SHA-512:C18714349F22ED18F09CE6ACEFAD3B21F698E41BEDFA37E743A7F032BBA89AAF84B6CFCF881EB0121494C5F2DBD9A06BEC58512E30BA48BD18FD6BC0FBCC4CB7
                                      Malicious:true
                                      Preview:.$.2Q.p.\...=....PA....e.bT..X..S^v.......a......6M..g.Z...~...,....zu!...6....w1....\.B./.."..?@......yU.V.!&...h../}M. .t.6*......7m..!m.G....gf]D....;.Z.5B...aqD;.upN).'\...X.....Ij..'...L..m..B|AM..5.3.`S.....V1.... V.oR.J.....E..QF..@S...#I.+.....|..........A.*!#+..u..0l^ow........1...7%.{..LtM.Z.+.S.......\..)...=..j.)..h.L...^.W.$p,......'j.hi7s.f3...a.s.....bz..XA......g.....}..(..h.C.D....$R.9.bu.$u"....j.....4.z.......'j.R.B...l..n9."...@4................:@t....3c~.(5.....n..6.}..o.K..GX....M.b...6...AK..r.?.V........ ...!SU...,..w=.;..9.t....@@:M....l.wCU.`|.+w...41....o.....1..OI..a....13..}2$.{.5AB...{.1.t..m........s.]\.c..IQ...T.9H.6..N.........e>..%q.....g.$.u. ...r.M. ..=oUdK..a....U.../..sa.U.r.....Uif..:.P.....:..2.....%...M..SoE......b.25./...I...@6....D.5..c6S....]..5..r...........|....==Z..I.............[...'.....Q.y..5C..@X~8.v..{.s.Ib...#...' j3..hX/S....MG...B....u...x......<....pa.).8z8....R.0...6r....[j*...., .

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\UIx2rfd.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8200
                                      Entropy (8bit):7.976943315519853
                                      Encrypted:false
                                      SSDEEP:192:Y3TNDB7UN5tBEPw03trjZV9yNy64YSsWR:6ND+u3d976KsWR
                                      MD5:496D7CA5B1E8163F33038AB793942974
                                      SHA1:373DFDF27F56FC03BB038CFE2AF52EB945CEED00
                                      SHA-256:59BC57A11828BCBCD79AAAC2E29114C3AF541FFFE428B2DF0B9F103EAB1F8EFC
                                      SHA-512:FB3823E2E8A769AC423E91AFCC0B6F9BF8144D25436691D46F5D84F561D5FE1074DF7EB984C00C8D52D3CAE69FC14DCFA5CD63A76B7EBCE383FAC5DE370A9027
                                      Malicious:false
                                      Preview:@....<d.Q.....k..v](...[....;..T.\.....R.}9F.'..vA$.6.O.+.>.....;84..)"=......w.....|F4..0..n..s.q.@.:........p_....X .f:.,>#..A.....1 B,.WD...jO..0.....VT...9...>~.q2.....1...K|..j.vb.z..s...D....ya..u.,uX.(......<.Ul..O..6xLw:.....G..Q.RRJ..X.q.c...KY.P.Q.C..j......hy..........MX....G...I......e......`.U"....&...ad.B......=..S+.}.S...Yb.....(....RV*...S@..*b.!....:`jyhI..y.;.....%2.....5e.G...7...n...1....#Y...../|.[.G.19......./..."..X'$mkC^.K......9.V.,.....v~FJ....nq.1.'.9..r.L}..^..h.[.......cxw.....\....ZP.Ry/....9......(......^...{q.A..E.,.>..!cE..]{.`OSha)..rq.zjJ.c.r...{...ckKO...3.......w|..m.....jsR....u.2.y.+.6..`.k........F...+.P.!.g..!.Iz'..W....\..*`..?ms~."]..g......S:.....6$R>.QP..C.OQ...a64.8...Q..0..j2........S}h.m~V..P"s.zS....p%....p,.n......)..^2Mr....=...q.....s.".*.4..L.....z_D..h.4..<.g..m.n.*....~.....b....H....H.If..{.>y.a..&..?..._j.P1A.]..hMRg.X].J.<.v..b.4...k.......-_W....i.Yh;..\.Ib..iv.6&.}..@..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\VDmSOwh.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37282
                                      Entropy (8bit):7.995214888674157
                                      Encrypted:true
                                      SSDEEP:768:y9VSZkHvQS/a9G0Z88uZoC7KpXrYpQyYcJI1cb93:yfSZsBavZ88uZoCPQyYcmSR3
                                      MD5:AF014EDAC5A6B04F8ACF91CBF3E45B2A
                                      SHA1:2B19DDB286D1FA306193716449D93B7E712B9946
                                      SHA-256:A8CF7B521FDADE2F3D905B2E12B529B1F769A1AE6045A94442D6DB31D8C57637
                                      SHA-512:4F8D39C908A4AE7B0E2E498BF19DF4AD54FA9D9FB334AB5A8FF1333D82B9225C6F6564072E660AF78F21C62B0A40F4CBDB9EE91DF7BF09C28524073ECA003FD8
                                      Malicious:true
                                      Preview:.M.z.{.h!"Y.mx...........yN.R^a...b.]a..[..M....:5C..;'..V.R\).7..._\.B...bJ...y.;.Ua.wL...-Z1fp..#M!..."&.{.s.UY..H/_..(..V'..[..`.../..Z...Q.[......*k'.|...Xg........$x.$....<....J.aP...H......iX..3...B.l..T[.X."......a5".&.=.!..Lc...dj..l.%....T....'.H..#.....R..1...IX...oM.C...[y.@f../.....<!^..|...@u#...+)./..{.O..x...&.]..(%....F.4...e..Q..7..frt...T9w.}Hk+.l.#..t..(...e.Gx....s.....[.E.......g~G..D..{..0G....._....bE..:.`.y.j...4F6*P..\...........S..aF....*z....hwm....f..J.............>.m..Z.5.+..8)n..}..YEL1...b...*...{6...,.x.a#(..@.q..8..a.4..f.-L?5b..O.Z.x..:....#.WW`.=7..az:.)|@v....d.../=n.d..|.SA`1.=D....7....[.E..J.8%.K.......F.r.5...>..u1k.....d.CO.c..G..m....1._...j...x~W..^U.4H?..8._.l.r.m...N......X....n..ae).c..a.A:....`.VP.@.LN._.y.g.0..g.I.U.m...a!.*B.....>).e.K.....{...#.....(..$.l..~4.n..m....*.7..?.A].....m.'....,..ldf..r_Z.~....^/.i<k[.K.>..!..s(.`...p.c..-1..5.gz......R1..i.H!..'D...S..6....;)....N/i...6.Ol3v.)...!.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\VcbaEWc.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37326
                                      Entropy (8bit):7.994191934965219
                                      Encrypted:true
                                      SSDEEP:768:C9pOz67PTAyKyBdlDeWwWhGinn+ftm77HtDyp1rZLAzmudRoYqdDs:C9acfDJ2iYc77gp9ZLA6udRoVdDs
                                      MD5:3EABEA021B242C926E42040D92190470
                                      SHA1:67F560FC880A7C8FF56D8534893F4FF8D4312230
                                      SHA-256:34F275AFC3352CFAF8B47705CBD1C030DB4F7979C24EC859EA276016A6CB687B
                                      SHA-512:6820DD3D393BC7BB404A6E3FA88A7DFE7A5CF310F0BF1D5A02D48F4B3FCFBAC7FFDC5CB1FF77BFC1394016D4055F8A84E0B91AE259B4D930DDC4E1CDD3C4CCED
                                      Malicious:true
                                      Preview:X......$...&....C...}k_.DhE.9..E..8...WT6.(B.|u..W^..[.....Y....?c.....>y...rB0h...mpM.....H.+...N.z...s*.T>...r.+.....a4......Aj*...|...YrQ]Q1.Qk.\......,.U2..]D*.f....x....<.K{fU....k(...P.q.9.Q\.......J..k.._|..m.h.S..u.1..I..>..v.O.?"..I;.S...V.5.._R.N.....Y....z6..9.....!...g9.,...5>./fU..-....@"N..!0..^.z+........<B.... "GpUe4.Y....a.!H.s.....[.v.Ve~l......V&7...F $.c..p*.%g...V)x......g.....xy......Q.3.,..!.AV?..6.V..G.H..L...[b_.+.....A.z.<s..d>.sw..A.P._.;..._.\..q....?......%W..fW.\........I"E!.K1pq>V2...Q..a..(R..3.Q.[..#.U..Y....I....cL...C.z.....j..".M..^...M:.......K.r.Y.1.\<s..s.D.8.G9}!....q.=r.B.....z...!.c<.../..J\......<.....u........!...2..CE>b..j^...o...4....O.i...k...u...)1..T.+.5.$........6L.D.|.a.c...:..[,.+.Qd....A>...v:.z.R.....R...5{......,...9.Y.G/wT\.hu...R...&.?..Y..$...K..pkH..o......B..7...CK&....y}$...*...........D.....d....i0...;1.L.b..4...?d.:....2^.^...../..\.NS...^F....zj..O2;..%.f.N(

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\WZg7yeT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37294
                                      Entropy (8bit):7.995322375134035
                                      Encrypted:true
                                      SSDEEP:768:WEiu/6XVWoUIOfs972glx47m/qh2KQu8nQBNQWvPWozEV:+lWoUIOfy7Bx2bh0V6PnW4EV
                                      MD5:10BFB885B129D467360750FEBC6984DB
                                      SHA1:0364043B5380AC0FD6C7BE5B154C9F6724AD6DDF
                                      SHA-256:1C44F22CF9D9DC28C5E5A11E75120C8FEE7169A06090C49CAAE0A466D1CB2A35
                                      SHA-512:6995610EB1C8D17ADCE2F1A1DD2B6B3995E53C9C36D00167919A95CE2890B81FE1FF25FEE8C861D2C18A9A28B66F5BD2570DD1A08FCF158F2C3EE0E225AFD97B
                                      Malicious:true
                                      Preview:99......F...k.s.O$K.`..ufdP....!..&.W....0}.f....'.o....P../..4..cK`..YRM....c.&....g...g.:.g....K.)..............7P....-ym=.R...YT.:..{k....;....P.-#....0......+c......vB..3<.....Y....*.....&..t.:.2...Ab*D...%.k....7....3w.0..2....#......+.M......;.......7Q.h......{._0......}.2.F..R..q.M..R ......X.X.:...0..).(D...-.#..{A.nE.A.0..^..;.N.u.S$.Q.....f..|.M.c..w.;)....n<.@?<zF.....(.f........n.R......j........IU...}#...(3.:...\*.r.XH7.2y...K......R&v....\.0.)...0.T....9r....[83...{...=....x...b.'.<.t..UV.K.L...4f~....k...Z...`..f..WCQl.XHFF..u....xL_.Q..U.n...y.=...Y.m^.... ..W..e..2..x.i.a..5'f....;...kq....w.j.n=.F#2..........e.P...a..XkW}..Bb..:@.......mg.!=.!.....G....-..{,..=.6t,.^..;.1:k..[..\.'..L......c.Z.&...ML....^.s...&.>...`..R....OO.,...3.U..vn6.N(.......B..k.2.o.kl7..V..r..d..aN...i..f|...u...t[....K..f..jJ...%..m...xC!...;.Ln...&]..@6'.#3.8..}.ZAg.q.).......1o7u.i..8.Xk..."i.5.....T[4l.0........pZ.*.*h!l..uk..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\XDeAwQK.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37289
                                      Entropy (8bit):7.994316927039179
                                      Encrypted:true
                                      SSDEEP:768:B4mlfJbaSoBJV0fGuA183lfPEcqDDn+GZkl0ujfrGKfl:pJO3gfP7G+GZkmuXbl
                                      MD5:631D18D35CFFC9A0286E0B231DDEB017
                                      SHA1:95DA53591955E8C00117284F06AAE219A84CE8CE
                                      SHA-256:CCE0E1A30518392B13A0BFA1F49A8641EEFC16B993EF6CCB1E6D146AF51BFA2B
                                      SHA-512:A461CF7E540441A9DBBAB7D318983DA910FF7A13CB2E4D745B1AC5205BE9F87BD5B9474D72633A2126BE7952F04B8222F3D58E905A414A690C862F5AD054FD80
                                      Malicious:true
                                      Preview:-U..rF.=L....IL).(..uo..u@..X.w..J....n.....@E.-.IG1_..=..0..%...8..C(..n..K%.4....bI......Z.QS...=r.ue.*.d.J.....@.B@.....w2y...y..d..V.;P...jn%Q[...d.#.l..M*.....6...82..%J....=....O.&on.O..k~.)=f...Zj.B.S.nh...%8y.nAR,Gs./.0.t.r..w.IZ..|_.)......z.K..........E?.H.4.A.l...9..*.J.).P.lp..m....)..".n1..c>...x..L...z...G.m.Ub.o.".....w8.ll..>...X.lX+O.?..'m4..G.....x+...-h...H.8)z.}.-us..M#.}OJ$.N..x.Z.]n6......h.......G. .a7|.@8HM.)...i..af..a&.:.C......2.!r..v!.....q.w..i..t..+....y.02...U.@.!.ID.6....!a.i.=..R..}tz...._.Am.4...-......3.H.M..[0;.#[.d...-..jO.X.f.=................k.d.@..3.@.sH....../'.s.Jk.A2...oH3.b.x...k..FIS.gl..].y....!]>.........An.;.C...G.....q'x.......(...0.t..(:.6&...5..X.0<...].bQ..,C....."..3..HL..P...:u|...2...p[...t.M9.5z.E.v].%.y....W....n.c.-...i.y.<^....P;.1I5.K..M#.....B.!.m..m.7O.~.....dL...n....S...H..u....WzR...).TFi...._.VI)..}dN.~.g..R~.........^..y..t..w$.f.aM....J.S..'..Io..W.......>e@.`.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Y9iPdCS.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37275
                                      Entropy (8bit):7.994709169674756
                                      Encrypted:true
                                      SSDEEP:768:8HqNnHU29yfsyuwwVQr0FrjV7xg0TZsRBZ/7jLaF1JWDxPPbRtYQcOM9cBK5qLZ:FJUOEEVCoFrjFxg0TZwBZDcJWlbYwZ
                                      MD5:303E77A1E26D0289D7D744B4CF8B05AD
                                      SHA1:7FC6BB4430D6EA7F7C51644F641676333FF10511
                                      SHA-256:6F5CC15890D3105BD6C6695863A74BF84E844A95B7BBBD51700F81BAAB8BE187
                                      SHA-512:05F1E175A599E909E7B1E1DC1A41941FFB84060BF0A4939D26582F32A519AFC1AF8B5A4F8EA4081E9CCA4D3022B287D9681F1DA7B699E3F19C26CFDD6D6E8274
                                      Malicious:true
                                      Preview:$..<..|*...WmP....gY0\.x..B.t........a..#&yvk9(\+F............=P.6,.4..,.3|.,!.".t.(.......X..L.Y-......[. M&z9V.J..7}.7.4..RZ..{.S....`...V.H.dGt...v..j..~.b8...G=.i.....:C...Q..[.-...E.(u$....w.....2./..<.........#Rk...w......6....%r.(.O.....K.^E.Y$..h'?cH..C<..Yr.;.n.y.A.+...L..5..:.pq.<8.@..z.3.X......4.;..]...b..WN#.,.....R..p.a..9>..[D......3V7o"...".....*.4.'..cp.....&m.k'.b...0...9h..OD...n.,v ..|...^.8..9l...1(K...[.<.da.A.0j....c....!.7fv.a..]..$HA{.R5..s8....T....v;.."......N.b.......U.....^f..U..I.......*..t...$m.\.\..G.......Y.6;,..*.`9.N]F...`.Dx.].n .h..mT..b.O.!....;..L.8...%......... ?....JU.K...`P..:..?=...e3e.>2*....0j.R..s.wM.v..Mt....Mk...Z..Gz..4...v...5.b.....1...fz..Ix!..L/w....[..7....&.3. GdI..|....Q..B..t-..m...aO..ZV..."B21t....5,2.........H.=.n.?..#... ..o...-.....d.G+.dW..&$.....z1.....S,.m.6+$B...i5~.......G....?.....%..:..w....-..X.D.9..X.V.9/p...:t..k..9.t.D9#.E8.....3..=..m..}.n..%jb.......

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\YKT5YBO.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37285
                                      Entropy (8bit):7.994774535320121
                                      Encrypted:true
                                      SSDEEP:768:m7LtlprzUxZaitdZZZ4Drs/cnCelQvSGlMrcqQ3nZTJatLBRJhH/u4o:mtTfUxZa0nL+MYZalVFnwL3H/u4o
                                      MD5:0DAE24AA828ABBE7473F1E664C37F571
                                      SHA1:14D32FE17A4EDCA8CE64F978E2170CFEC48D8F1D
                                      SHA-256:98BADBDEC0E6496E7626C72AD8A2C0310C41C4F9B1A71E6BB497B297792028CD
                                      SHA-512:F3861E8BD4611FD00326B6565388653972D0164456D46CC0745BC7B9489DE30E4569B2F6B841C5F8A16B70ACAB5AE351747288480B3BA2DD8ED3D144AD64BF61
                                      Malicious:true
                                      Preview:..v.i.C|.Z..s.Q....7nr...3.6..N...'.....:C.n...hC8.3....R..y.@..=....F.......'..K....><..~H&..."RM.4..N....(GA...x`&Qxm....T~..!.X...S...Ji..|g..y.......5..!?... .p....[.w$.....H......k.d.iI.0(...........Ht.Z#.h..z...wE..G..I..C_..]!..;Y..Z..l..1...].N....~...F5.?J.1L-P.L0......=a.E.4.U.s.......4.:.9.:wL.R.;a..0q...e..c...D..............1.O|'....H....:.4]..=...-7....|.e}-*.."....i.|.b.....I.K/(....n..2.*....A...2.x....a#.s..z.b...-..w..<....^L....{.c"..o.YQm.;.\.G-..V.....~..|,Y.?v..S.Q.".V.......9..Y......,.7..cK.?U.:d...|..vQ.%1..\.d..b....$.~;\\..!./.].q.g.SA.d..vOe.xU!;..~..0.\G *..-...+Q..#.A;n`..p.+Yc.>.%.Tp.\.G~uB.BW.(..M..)Z.W...].c$.+......V.C.k.....a...!..|.Oe/.*EB..k5Q..x..HR.......|'o....!....bBl..D.'o...j..X..$|...]#...NJ....NfW.Z..&i..SL....Gq.M=.@..!..`.D.I....y..E^.~.].;$..q.^?.q3..dv/..=\..^v...N.~(U5......b......./x.3o.[^&w...B4..E~.........w....=..i.;T..2C.....1......-...`.OM...*.......?..#.Ev..GU......w.>.L..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Yi6PAyl.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37302
                                      Entropy (8bit):7.994929952206469
                                      Encrypted:true
                                      SSDEEP:768:ZqkOihUb5J3dKIACXcNz8y6s+3T+IeDoa7aAbNZEez5hSmc:ZdOg65/Uz8y6PDRaNNZfF0F
                                      MD5:DEB69EDA7DB8D06CEF44E56DB27AE293
                                      SHA1:767A39B8ED2FBFF9B756D7F1D25426FA3A725208
                                      SHA-256:F30B0E13058D2DE9231C9C7396746FA3C6FDD53BFF31D10EEFD35BFEB2D60119
                                      SHA-512:395DCCB42B6410356BB21A5720A61BDB5C99A7C3EBB69455EC5B2A4446EFE31FCF0383F83CE4170A975387C59B0D4B8FE838C550E5258266672ED222112EEA5F
                                      Malicious:true
                                      Preview:....v..}q}m.....YP...t...3..#7.......}..,X.P...p.9@.7.8.i...+mD.wa....o..7y..'zZ....o~!...X.h'L.....#..&...?.m..c4Z\Gk.X.Rk...z..k<. ..G^..4C....P<..ZKa.|..P.i.1Y.W../.Q8}'{k..b.N.+..R..@..sZ..m.y..|...r.........k...*.&2.Z./.....BHMx.PH.N......b..Ff.....}.....h...k....2tP.m.F..J3.|.......U.s.C.,_~]l.d.P...g.t.....'.O..Qnc .Rg".p.XPd{;..)-.......WD:.]...3.e....u.D.-....v.]...l.Y\ix.`X.w.h.h"?....G...J...........M..J.Q.m.>..........oGr..h.qYP|c}.Z....s...5..v.*2k.|"..h..$jJ.;.9c+.\CJ]...O.(^*.b..`y.q.k..Y.8.......|...lT.%.&q.!K..j.ga.v.S.f..........U...0"<...L.s......6cp..\......o...[.U.xs..Z....SX..TUm.+b}....x......H..<....l./{t..P...g.....lO.7s.L7`...../.j....{.....F...d.Q.2:@...,\...a.=....ou..I..)<-..[."`........FL...(S.0..n}.c.1..9.O..>7V..>....N..m....gF. ;.....-4?.vG&..u5.7..:....KL.e.4r.o..G*F.R.....wB.A..x.O.|..Vp..?.&........"t...9.r.U..Q..$..kA4*..'.X%.....=.......E.U')3 z.....i...px7....H.v..*...i..h}..,S...l.....M....V3.S

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\YnzxR8K.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37312
                                      Entropy (8bit):7.995299467781109
                                      Encrypted:true
                                      SSDEEP:768:s6UQwy1rrz+7hQuOLgvrEvwNfsxS7L3jdLNA2eQXawNdvS0+fj:s5QZ1j+KuOcvrEvwBf7Djr/qcdvK7
                                      MD5:F858EE56010F5FF88A434BA8545E6E1C
                                      SHA1:69A9C63AE259E3927ED34805E8ECCC934F6436CD
                                      SHA-256:F629AC16260F4752D50CA6B2D7D5142DCD03EC291ACCFEC8BDCD9023CDEA2CB4
                                      SHA-512:3E665B86BFA86114D0953DBE7CBA2EA5C8147C2218AEADDE1C33B4CFAE5FD700241CA7B759AE06749A3C9A40FDF2F51AEE6BF1E2502F171AF0018E5B713FAEB5
                                      Malicious:true
                                      Preview:}m.D z..m.(.......t.E..=..=.a.O u..Je!=.....b..Gc.......A.'...P.].Qj...A......{.,...r...v"....=....g.>..1....k.....m.o..WK.{..g..c.{L1.!.a..'./....|..e..`.<Y=......Rm....L]..(t~.%.......<..,..A....Qb.....|.@.L.......%.B*9.h..N..)..])hB...V.._.c.3(+..._..E.q..........-G.>.+H3_x....zH.7t..u.)..T.U.)Iz......F..Jc..}..U...N...0\..Tb.X.s^r.....8+..b..=...+3y...{X..<.u!....6.]......9gyG1...b.J'M.......".^(%..?t...S.....l..f7/.J...b|..:.C.&.b.;d-+....o.....1=E.y.=."/.]....d..w......lD3..(..{01....{{.....L..O.......,....u.%/....("Z...t4P.U..,.....tM:8.z...../}no.!..4\]9.@.}_r3.)F..n+...=..b..U.{.K.j.....{..V..q.R::..1.L..:..Bt.)..#a.)0<.....u..Z[....0.94T..%.nY."]wa.m...G..|.Da.T.k.`..P.jM"..h...I.....N.$....N..C...8.*4....l<.}..w.k.}...;...r.=...O.....B;_.E=..BA..}.....PV..~..y.5C...]..].*(B?@.....d~..t).Y3...?....8 ..G.I^N..f.y(V......9........m.~.......C.v.Z..i...G..4aF..'....>./.~..rK9"...h...K..,(..{.8.u.M.....&pI.D..F>....... .O#a...).e.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\aMB9eEi.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37294
                                      Entropy (8bit):7.99525486017689
                                      Encrypted:true
                                      SSDEEP:768:2RQCdtENELscYOw3MmIcNX6A4sV+Zk4qQOzNL7sTtF5x6CeXAov2NfMZ3F:2RZwEL5Yb8mZNX6AvFMYXOF5x6rRueZV
                                      MD5:BAEBBAFF6FB871A5F5D101D4F576F638
                                      SHA1:2DA7C79193BF0552EC8BCB2A13DB1A2015B59822
                                      SHA-256:37E81C292542BDCFB17CCDB21A37AAEF61569E1421E5C496788D56C90518A0B4
                                      SHA-512:5C573C8AD03DB0793E34BF7AE5F97FA16DD90719DDB7DC166D58957CD865271920A3CE438856507F879F60B89D68F51CD89FBFB3EBD5FA360796762A673612A4
                                      Malicious:true
                                      Preview:X.8..IH.s..8...n..r.H...9.b.+`.`.....k.#.I#J.F.]-r.3.?.r..\\....n.'..`:h.:.=.....0...L.w|.>..l.....C....8.&.g....f;.....1.qpC.W9O....Mx.D.N........`.*....z.*..WW<.k.ME|.....56 .<.$......C....t.Q....%;".t.9E*.....6...r..{....kq..8......Q..y..l..;....d.........H.Mt.D......^F..........Y<.pP..$.}.a..w.'b.9...JSU..v..+8WIz+z.I.%.g..I...v..V...~.....,....g.d.s.#.{E..3...9.w>m......{....~p..4...E....i..<...!.....za.?w[..V..s.5...MQ}5......2.w;.......Q........./........>.g.W..Ai0ioJ|..w.&.......(o.G..?...^....C=....I.....9.]x.........T.........d..}..+.g.)Mas..&.g"D..B....}W.z..xq!.]...7..n...N.1.....H....N.Z.5..",.B.z..t....h..?...!...+.U.B.$....U...IR4...g.(...0j0.]..=9z.....+:.J_..c1...v..3.1.>......;..:.e..F...4n@Go4.ba.....,.|...B.-f..B.L.....g ...<.u..r...j.EjD....N.W....{.n.9L........K...b&..7G.~D.b.*`..8..qR...0c-U`.K..'.:iWA.'..........\NDc#Jc4WU..%K....x7o\@).....p..&. ..D@Au-..:..'6....*;...A.q.jiL..V.2.*.U.I.........,a....=...w)

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\acXFwI8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8172
                                      Entropy (8bit):7.97710611421707
                                      Encrypted:false
                                      SSDEEP:192:Qt8aNi174KHBRGvLtyVVW/LeTshhg8o3k4kFttkwIcL98eRh:Y8aMz6htLBhh8CtxIW98a
                                      MD5:3E0AA7737F10CE3CD8ECB9E478A74292
                                      SHA1:9AD946455C69BE94FAA5DA3A7AEBCAD504EE82A6
                                      SHA-256:5C26FF2DB49BD891B91BFF6505C4719257D0F53CE74561B9BCBE12955D87260D
                                      SHA-512:8F87F83661A642CB88414A5AC0C83466B21058CCFCF4D867BC4A30C09CD3C997A4F3EBC32BEDD8238D7A484125B0292B0D7069CC4CCC6E0FD1B0B6314B3C9955
                                      Malicious:false
                                      Preview:i.......M..i.xdw.h.d$..Q7ay.s...C.......L.f..@.....$..Q......b.3.7$....H.g^..'..V.....Moh....gB.."/jB..>.6-..:.I..bmv...L....WR....Nh@*.......*3]....i....B...C].{?..t..k..#.2..]:......c...-.....B:.$...CR.,.#.=.-6@..3..|.?..o........A'P..&...@......_jd...'P...............mS&%.......N.!K.u.....{.?..p..x|R....|4.r.`J[e-....?.q..%.i...D(...M...X.~.j.:..g.S.....:.tdO}H.5......[.r2.E.t/........&.iM.......9.........Vp.G...hs.k.<..(...;J...$.)......;.Bc.L!..9.>U.`......R...!...~........0...Q.b4...s..gv@.F3.2x#...[.)....w.....&..V.0......EJ.OW`.T.M..b...1]^.....iQ...:.;..x...x8-.R......g.].$jb<s..8^..p......5...Vc....5.....eN.U........p-...0 U..9..r{0.<.'.K%Uo. f.....~s.(r.T.Bb....l...g.].../..A-..c..j.N........pFQ+?n.Mj.#[.I..0..[..E.Z}...7G>.. .=.m......_...i.j.$3[.N.n.I.~M?]..i......=W..EhD..$Y..*......B...Q...j.L.'..d]~.W..k.8...T.....{.y..+8".....n9(....;.......H.....e.].,.mn.;v.-....k.ofO.}.B(;....S.......1.7.....O..........r..s..-).

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\bhnllJ0.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37305
                                      Entropy (8bit):7.9953415144640205
                                      Encrypted:true
                                      SSDEEP:768:9TuxxvRDT1Pn5obx1LPVDz17ofO6PrnJm0VBx3dV3emV:Q/vRDZunpDh7oflm0VBx3z3L
                                      MD5:BF3B485B9923A0874F20187C2F1B4ADB
                                      SHA1:61BBBE6FAB2E94A4443ADE0B49E66478F9D21E72
                                      SHA-256:2D3B48178B86FDA29735E60D59901E3753CA488756AA9F081235F408C180AD39
                                      SHA-512:CCC77C5F4445D009A8AEA2D030B92AB916975944927937A3867B3FB5005B00B07805C1A2B95281B72A1F9D678122A8B67BCF35EFD7CBA6439518A4342FC929DC
                                      Malicious:true
                                      Preview:b..P.....Y...s5..[..../....P. j |.a..r..."z?X.._.[2.....oq...5j.t..G....Z..z...2.R&.Oz...W.?."..)/*.P.........".Z.'. .u.L0. ...M..o.........k..b.v...1.1....h....9....{..gG.a$\.......m.C...X`....>+.....C.c..f.fW....'7......H..k....E..e.p.=>.>j....$.-.........n.h{.5..NUi.S....E.]).).\..x.7.h.....db.cF.S...N..NdM.rc.3.^j..)........:......W...Q..k.9T....R .LT,.*...k.R&.r.V6.|...b..j........ .l}|..~..].qb...b.[..@L...{j.K.....g~y.]...Bf....n.G...$...........;..1..d_.+..&o.d.|t5ibfa5.......vV.......m....?.............j7..g.P.....2-%..ni.......?C-..h..z@^......z...ze.gP[..Sdu<...k.=...).....D..W.1./...@.%.nY.......B.j......l.E.IG.&...k.#X..J.......K.....V....#..fy.f.~..jQR.7..}.$...q.vC}sj7...P.h..Q2.~..L....N...|..!........L..7.k..Y...hB:...8..............I...........F.._Q......,.~J..t.N...^F.]nTm...\4..... .1........geGK.kO..DU.fj4.f..............1.:Zt].I.|qq.C..p...]....H.VAX$..-......aVp.Eb..'`..nC..y=0..0.0y.t....Q<.>Mr.<"....Q8....X

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\cYCClYQ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37318
                                      Entropy (8bit):7.995354329419547
                                      Encrypted:true
                                      SSDEEP:768:UwBKls7+amyrW9p0NHLvAvX8ej8fWfnKC2qJAizUzrs1AzJrxzgd:UwBKls7+WRD2Xz8eynqXUPsqNrxsd
                                      MD5:52A389DB86A071757EA4BB7ECD072AC5
                                      SHA1:A6706E9C25D7D263152006DCB05D26EE51737F8C
                                      SHA-256:14C12BF0B47829EC26DD2BA0ACFB42EDF1227E698D2047720D90329567573CD8
                                      SHA-512:9B0963908416A09037AC26D470DCBFE69E7D25EF99B50FC10050E0DBC2635DB7DDFDCE1FBC57121812784D71AA72FC991A6C8C987C90D08C5DC262282CDDDDDD
                                      Malicious:true
                                      Preview:...4.7.,......./...3....%Q..."..8.D.K.yV.H.}..\<.f...k./rHXi....?.s1"...g.!Y.4....K#.e..6..4O....8J.Ol............[ETu..C<.~O........z.^.P.W.WU../.[7Y.NZ.q..\,r-......L`......*...|................b0..A.$.e.*_.......Tt6.'O.....C....@...1.....'.F.WA..S.2..cwu........pU*|..a...."C..K..28.9Lb].....;..;..D....d.L...~......]..._^Ra....g.P.}.f.<u...tw..%0..8....L........t...O.....i.6.....=-4....2.......`+...6{.0Ol.......z..$.y...F..}..EeZ`.A..:..96...m.........6.7..../T...?.upq.[.....Y`..Q........~..S(..`....D8..$.b..l1.P`.....P3.=....O.{.c...&U.....F.:.T*.h...,.... S.w....J..a%e...."N..p........r....<3.99..Cx.<i....{..T.S.{.....(.|^..vX.I.$^KH7z...{.(......:1p.Y..L...W........`....Q...VE.3<z04,...\..~A4......c8n.r<;O%..j.....h.$..g.y....o+.,.({S.JT...`..y.2NZ.....mHX....|E$.1...bv..U...{......e..s..$.4..o%?$=.....O.....!l....8f...^....S...Q..7m..]d3$.o.K).....]..._E&...G......zF..m.Y..T{Nr..o*l...X..S=8.a.=..|.w[2..,....C.j..z.....2..F.l2 $7.....?J.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\cxUtfQb.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37314
                                      Entropy (8bit):7.9945919785329895
                                      Encrypted:true
                                      SSDEEP:768:usZmDdAJlBGAlC0YBZUylrDl1QfSEhTE5GmOxp8Tld226ePbp+XzEQuj:JYAPBGAl1eV71QfNw5JO8JY270zE7
                                      MD5:47BBCDE64C7954F87C11EB0580410114
                                      SHA1:865EF0B34A86AD280C91278B8720A59F6B636FAF
                                      SHA-256:14F39ED21BE749C4E259D9C6592DF69E632F29E57600DE547D0BEFDDF248F5E5
                                      SHA-512:3B49EB510F27A0101ACBB12F4160052F9C9EDF610E47B4EE022D26FFB54A31722D98D89D92A1981FA6334FA8B2A3B904628051F310D219EEAD87FA44C7379E16
                                      Malicious:true
                                      Preview:.{..?=..d".D?v]/.4.`..m$....j_.t..(....w.!......v..bPx.P.....Mb...5....$....|..;2...P..../.........Q.ZEqW.e>.....x.q.7....&).m.7.]...q.p.!.|....T...N......p.?....r......>.S.w...._g{3.....A.lbX2`.....g...Z............r.]....:...."0..~.....%?4..........>.-.8Z..R_...YZ~(f.b.S..'.Q......?....k.m$h....O.n".@.......r.8.R.......Wk.....vt.......%.z.....D.8.-.h.r5M...6..Q..O..SO.!t..p.!..%.i.1J*S.E..7........o.Q...........=.g.y].*..`.=.......-..g\.&dz.Z...p3F.VB....^r..e2.....M.G...cwy...#....2Yu.U.....B....B....P..k.n....C\.....h}.. KO....3......;:A..s.a....[m ...^.i5......c..k..,#...}=.'..0..R...$<...).6.....|.......e.S.R...Sm..8L...nN!...M.....^.=.Ve......sm3.|.1.iB<M..4.Ua.".RB...(g...Y..dY.N.s./...Q.z.r.lys.I]....I.90.... m..N.......7.N.If...!T^T....|RhC.9.Rcxw....Zo.%....s.D..".].*....}.iMM.........n).T.,.>..).@.....\..eL.HY|..OcS.%D.r0.}...h.V..+.Z....v.={o....V.......-...Vwc..s....L .;.....OY..h.. b..._=3..a9..,..3...*.I..P...o

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\dNggjpN.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37311
                                      Entropy (8bit):7.995419822615509
                                      Encrypted:true
                                      SSDEEP:768:89zACePiJ8of4R1HNnBvx/jzUfxE1x49Io0eZgSkdHbJ5/:OvXLfSvxCx24+oPZEdHbJ5/
                                      MD5:E3191EBA31FCC62ED80BB0CE971B42DA
                                      SHA1:58CC61CD8A59FF7730F16317A721EEC86861C58F
                                      SHA-256:6DDC660CA07F07F7AC5A2AC7B512DDCEC32F9D9EF466918E258E26ED1C166F6E
                                      SHA-512:0B33394B5F28B9B0F821DED605E4C9BF6C27EB0343352EF3AD136E159A5593622353851BCA8BD19E07DEF6750B8F066138330699057A01851139568053BF9473
                                      Malicious:true
                                      Preview:.g..`.H......6....! [.3q.......e.wT.....r..).../..;....X}.D)*..iI......_..R$U\.3....M)w.|4.7=..:.........K.P...E..|......<.(z.ue..[.....udt.N......l.....v.U=j..(.x.C.K......ui.j4]Y.......22:.J..u.8.[.h.iPs+.....=..z^2I..?k.r....J~`)u.U.R[..Q'......I.0y...;...X1.A._z./....{n=X.....q..>...qZU.c.V.'>.V.1..g.s.....A4....D.Z.e.c.#.I.n7..y........Za4....Mh0B.../....z..?..N.\..09.3x./.....Ym.ad.qS.....H.]).....G.AXM_.7....#~..H.%.h....R$.e-...A...UAZ..&......q...y O.#.p!|.h..A..6s.&.*..U....:x.X.&. mU.2......s.M{\...'7.\..=F|D?d............x....../s~(..2..:...D..Hi.... ...D(.j....M......:2..~..e..O......C.{.c".wK,....(L1A..:.....F.%.....7..]9..cl..\...K.[.:{j..W=C...].OU..{...Kn.]...H.kVAg.....:n.E.E..i..2m..4......."....Y7.wq.........DN....PX..Ad.|P.,.?A...........E|.x..JhjR...;........Z.......Xe.A...J..........\..._..d.D.wg..>+.......^...8.v ...s.\.7.B./...yv....._......U4....D.....',....."..D..e.f.K"..~.e........)$Q.!em.1..PiN..joVf.R..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\dV917sj.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37325
                                      Entropy (8bit):7.995435972532318
                                      Encrypted:true
                                      SSDEEP:768:YUlRx14G0vLLAQqTxPYc/hVQqwg82qbykc/JtMVDaytnmU:YUkGh5TxF/hqqwh2qbykc/TMVDJ
                                      MD5:C344DF3570E74943BD7E58D6A8DDCE70
                                      SHA1:C7B182FD52AB7AF4A58A2BD9D0CC6E0964E5A523
                                      SHA-256:0514833D15DF5B3341CA4F5DF2620F0C4DD800F2D459FE14445A011980B1F2AB
                                      SHA-512:489F4A1A273BEAB4C87C5EEA9133BB045E3DE62A541AE31D0715BD3658757634AFA05EE1C40975120625142C9CA40CE529D21146583C3BD9731B4E76C57849B0
                                      Malicious:true
                                      Preview:.p2...ae.D..4.,...v;B8...o....+)...f..n..&.]...(....;1.S........0_....$8....M.F.Y.&......&.co.W%..u]...jw...3.<..d5.j..N...p.U.zT.Y`.^3...o...K.$...._vp...J:.....:?..!......^.*....."...IPV..Z/.....Z...h.....4...zw.M;H.......[9.N3..gC......&.8......yl.=...s..xj..qj......(."%..^....v.if..Y...%Z..J.......[<L..iLsd....&)......T......"N......}.w[...=.i..._..J..K.`.E#_.t....e.n...Z......$...bG...@.(e....J...z'+.a.....d[r..E:......}....sI.....~.E'._..h...r..;x...M..Ta.Wo..0.k..k<.S..."vR.....2.....}".m.C..!v2....13.<.:{..7q+g.}R}1...H.......$.W.`..Y..l........}"bu).B..S.._/..5K.m.Y.pqa;x..cn7....x.}..v.......{....c<d.jG=.4$?..Q..&....!....5"Fa.Mn._.z...M..A.x..R"dq...?Rw...........k.HG^3j.9.Q...e....9~ ....O.)".....^B.....i...2.>...,*'......Vs.`]p.u.Q..(S|.......hiH...Wu.EH].....NS...L.:g.0w....c..{.(.:..u..[[(f.O..Q.y=WtK..}....@...P99..G{.p....!......e..<.]..O.c6.......D....3V<5...c.R...tI?_'~.yn_.....3e...}].P(.r...0..k..x..|..{../._.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\dX50pnq.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8167
                                      Entropy (8bit):7.976842901927299
                                      Encrypted:false
                                      SSDEEP:192:oX2b+kPugLAlCeiFz5KGoB4pajMrhfEt+Yv/kX2FRu:oyeizMhXjkYd8GFRu
                                      MD5:3F89863B8B82D6884EFC8070EC18C836
                                      SHA1:8B2CCFB010D52D3B8DC2EE8ECA136CB2524DC5CE
                                      SHA-256:B0819F3691F475A726F3446384D218846BAD39A9963D3A50E24228AB50DC9AFC
                                      SHA-512:3EA2E332E85040974B001D027EE805F159069E7728F131621C7E602C6631515E6BA3F0A849CFD01628F3023B6929880EA2030CD8C02B9695BAD062500434CE28
                                      Malicious:false
                                      Preview:-Es}RT.......h..'..........w.;X...L.z....e.w"...U..iS.m..h].....n[...?.>...h.je.5..z.3..a..j.##..o...&mF\}c..]=....5t.9p_...M>..<]M.......t..8_.b....E.].....^..mqt.x.Q.i..Kx(..(......H..N....P.u.6......V`.....n..:....B.D.$..*,.g./....<.-$}....-dB.Y.. .........e....]H>U...)..l......nf1.5.%}.......'..D.+.N~....."....h..hW...!..Q.9.:Q.Z..M%J..-S.$......Km.}.$$....\...f....O..O....c.B..1......(.._.]"Z.76.j....qu.:-..u.T.....<...M....6N.^.){.-. .1.\q.5...M.7..Cs..e...t|4...x.M.|..JAy..7`.7..K..H..<.I},.m3S"<...:....q,LoG....R..G-.(.....<.g.:%..N...bt.w.. ]..v..R^iyT..=4..k|....B.._.P.....vS.....%.s...h..6.+/....A9.-.i.......[.m..:.&..F..T!..4K..R..THE.Z=../..."P..1.Xk....xJ...Q..i.......~[......7..d.....]b#?...N.....m......zx..gz...)U).w..E....-({KLO..@...>T...'.....&.?)..%.5s.....5...5...@...S....1."...2w:.....M...<$.@..\..O......I.K?G.w#...........T+~./..S.T.E.8.\.c..gmK.k!..u.'.w.,(...".....)9......;..2._=..+.....b.%.F....I..,.....l..mcq.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\dlFuARc.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37275
                                      Entropy (8bit):7.995254747393438
                                      Encrypted:true
                                      SSDEEP:768:W03b+70o2DzvadgG1hXW0usrE0bVQV0lNTNypbz5pZSVmq:WZb2HvadgumIrE0JG0l7Ib9jSIq
                                      MD5:345E9F1520E3AC30DAF1AB3094B14FEC
                                      SHA1:4663BF4A83BB56AA2836060E4F28FF8A5F7E1E69
                                      SHA-256:9176BB5D201EC8584C04DDA5D09A91952028313FD21A5D5A9EF99664CC3E4FE5
                                      SHA-512:014A9578E11DBB874F0232E942A8C4E5EF8F89867A90079A8A43C6CBC12BD639025D6D70B2718D4FF2E458E5B02D85AFBF2CAE530334C843D53BE60CF28D4D97
                                      Malicious:true
                                      Preview:?J.7}1..H...=}..H*..C..:......0...[......H.,O..IDSS.fY.2..*...AZ]...U.Kc.5....9.!....u..m.@.Q.......%)...L7-..e;..0.:.z.U=....8.Y..=U...."....&.^"vy..<$..5.....!...].4p[4.2L.j&...A..P.#L..W.Zt..Un....._'F"eL....6.I..>.o..!|..].g.7b...1.....v..N...=..x..-.0e.o;.[..%.#.8..=JC..y.H...w..$.."4...G....S.kL..9.F.Mq."h..p.......PU]!..A.}..c.h0n.*.g...Z1..IB{.....Y...P#/@=|...+s..e1..,30-E.......Nx.&......p..O.......Z.T.4..ve..m.o.B..'..=d.-NN......lrN.r....`}(~r3...j...|0.{.;FpZ..u...NG.=...7....,t8U....0_..,...Z.....h._.KD.^.7..G...A.H.\.|E.g.y?.I.j.<..`|0QDz(.]..$..|..@.BZ.5.R.0.U..w~..H.....{.E..=.....NXz.j..7....c...-...$.!h......Af......C)...%$..9`.....o..F.t.2.V...M...G-..x.S2?ih:.6...c.0f.m.T.Y.W.....J.9...w$.....Gf...0.f...U.4...9..qZ@..|ub..X.._QqF.._.R.f.@n=.....o.."......qa.0...%....v.Fb...%.l.,......b..:..,,`0,..@6.G.-..9.&...m.G;.bG.<._>9.j..)..........O...K#&..3.d....k.J...I....>..H.Y.H?.1.?%.J...R.<EKA;...^g..(w..X..h.IS."q-

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\duSe6Cp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37321
                                      Entropy (8bit):7.99517541472234
                                      Encrypted:true
                                      SSDEEP:768:vMOFFUJAAlBA9kpC0q5HCsaWqVQnwjKzd8nU1ZgTj8jjWSt5xj3KZ2Go:v3FyllBAj0TdXVid8vBSt5xzY1o
                                      MD5:49CFB28D560D830FBB5BCC524AAB3A4C
                                      SHA1:C8A3FFF0973B9D5AFB455AF1AEAB64D54DB2A7A5
                                      SHA-256:CADF1BDB6EA8CE778E50DC79D21C9C51932065A54CB2512C898DA512BC318190
                                      SHA-512:C7EB682BD039D2A42032F778EA3C1D2458EB6A7C0FD37835D21D0849C57659E2DEBC6CCE0FAF924BC7338F9BA2DA1F33B9F5027EA8EF5DB7234E3D2357FC93D1
                                      Malicious:true
                                      Preview:.dd.}.........x...9.....m?.Ku..."....q..R.....tI..C...UTx.......*..Q..,.....=.T..g..y..P...J.s.L.).....UM....#|.j.VUp...p.t...O. W{..K..{.[;../i.Z?......V.O..e9...;...e/.R.o...Q.{[..H.).O....O-..p......g'.g.v..K.X....r...`...Z...e@.....jn..'n.-..'.;*[./7.........ax.?....I..B.$..S>....Y9..{<..d....5d..x.......l...o.].....'....v....+.nj......e m.~...N._..ot..T.JH....g..`...!.t..~.\e1vgb.S.2+..8.....%....R.61..:......$._..."#..$....[...y........s..u+CPn.........[s"..6........$.\s.B.t...gR8Kp.&.l....=..d.r.=..Q...{...d.&o..*%...-[x..........}r...qAt..d...y....Fq..[. .B.... QT...-.uS..p../;.?..*..\.>&;ra.*..6.J...Np+....T..&\./A8..]W.'.v.[.s3^;....+*....>.b.f.*i8U..jK..T......R.vNJw....._.VT$/V.;..;.X:q........ZS.v.s..;{.U......|..-."......D.X..).5G...P7J...O.s.~.......1...M.....]&.rw...[j....v\..6re.)w8';..ic...[s4=q..?....?B8...<.....%..5.."...^.#.0.g/'........).8...$..FK^...H..._.W.........\.G3n.e.Y.....NB2.B.N.<,l.{=..Td....*._.p..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\eE2UwNb.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8175
                                      Entropy (8bit):7.977880674814007
                                      Encrypted:false
                                      SSDEEP:192:eBWn1O8knUliHm7nLs0MFA6E19wQeq5/nNZL:eB+jgBQLs0MG6creqVL
                                      MD5:877D2FFD8C8EBDF5361FE0721B6A9AB0
                                      SHA1:6C9758482D52F90942BB992AD886913B6E9C112C
                                      SHA-256:F93E5D9F26C1C2E7D2736305C115A7388A99A1724BBFF0612AAEEB3CF5BAC80F
                                      SHA-512:214617F4C587C765295F21E26858E8748EF40067B4302495C6EE930E1F55E6E7EEB6C585448661832A1F62AE77141F9032F25E6FC3F15BFC59C4C847E578E7C4
                                      Malicious:false
                                      Preview:..&];.....5.5.U7.m....I..R..rc.d.......#.~.q.6...P.....!..* ./..F..O>.'J....J.N..m...I..%....,a.Y.e.m.U...m....bC....;.ny....\/K.#$...0.^A}$v.KM.0....;[...a......AC.1..$.....'..+.QsJn.V-..{.uG.^..<.......=..g3.i..-.<,.2fR...A..R....Mf.....|..~..7-.l.E...]P.....OQ=...U..v.@....#.2...%.T.)|}.U.L91.SF.....0......_cw..%/M...m8;..7...5...Ex..$...fmt..+..0"_.....Y!7.es...E.3...M.s.&..."t,o...L..._.T..w..a.9^...q%.sG..x.>3..ghg..s..Q...4gR.0.q.@p....Sw.Q..........l...(....<.....`l.2xE.C.b.38"..p.L....l6....!..30`...z=,.a...Y.....:n.P..(.HR=....\e.+.....9..j..>..S...;%........)....Z...N.a._.t.m..-^..6..z..g.F.......HtY....*[.u..z..)..{uGD.0_....k.X....L...#......*6.F;#.,....*.b...\T.&Y.X.Hd.....*...a..Y...........-..J...b_...(^.z.F...{.3u.=..............%}........o5.....4.....56..=.....A.K..(K-.Jk3....\.v..(.I......{....-P.K.72.....V..#..4..fO.I..YK5.B............i.%... .R`..V.t.mu"............0.6.r.c..<.....s..a.-6.Z...m..Nm.x>Bb..=..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\eNCVpLq.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37326
                                      Entropy (8bit):7.994800331509298
                                      Encrypted:true
                                      SSDEEP:768:ix8fhK17UtEYaSS1sP9DOpJXVdMcKeU+gS0MZwahsdEHfs48d:zfSYaSXP9DENGeUpSLvIEDS
                                      MD5:09B91BC2799F141202889D606EA23ADD
                                      SHA1:374F6B010AD384FA28392F834CAD12704A334681
                                      SHA-256:567BF3F0A26C7B9ACFB7E7911CAE234887D14A9CCC2578C2864FC7002F45A8BE
                                      SHA-512:96A249D15659843F8B19C4597EFE9F6C511E49A8A179F117C4E41ACCD0E53BC0A67FBBA35A128180264395FD901AFC5C1B79A823F4BAC454E8E8A1E1BB6E31BF
                                      Malicious:true
                                      Preview:...h.....L...:...Y..T../i.l..%=.....l.h..2|...\........p.D.......A.s]..j..Ew.q)..'......@..W...)Ig......*d1{..O...c.t.._.p.......;l(..h.+l{.....x.Z.3.3..Yg.+='....../.5.....+.Y..Q.e.O.......v..E.....,.......:&%<...U..P........-.*G.:-...@?....q..g.1.>>..a0cL9..h.....V..a..@.....8.q.3_*gi....w..9#:..Q......j....P...+]....(.*)...z...C.o<...~.5...~.Z..V8.6..S,F;... N.\P-...M%P.+.!......Kp.5..X.?'.iLy.v.b.C....=.].....f....gT...X>*.%z ....O.4.#...q.N...F>.u7.ii....k.1......R..gs..t.<-.Q.....M".....M.!-....up.{.b.;.......('..........mO........`..A.e.0bG......sN&*........9....%~.5.g..~..5MI.Y.'fS...LI-.U..R.*.......0.9.H......:.%p....M.\D...7.....7...i/x...qI2f...{.2 ql.N....FZ.....G..L..4t.......(R.C.g........fCEs.i....W.n....W.J`..W.........mQ.Z.~.{.]Aj.......6..k]!...k..._X.:...f......."...P.m.sZ...|.......^..zV.Jo1m.f+..U-...\E....n...s.T.l.s...L.#hb.....g.i..$.|9.j.......].Q_.x"...O..O7M6v}.n.j_\.A..V<...E...eF...O....._j...;..R_..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\eckcujo.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37320
                                      Entropy (8bit):7.994838366017412
                                      Encrypted:true
                                      SSDEEP:768:Frq+Z275ydpd+SVnCNe3NXI855NzOfeJggSJshtG0iMh3IGv49:4jydpd7RCNe3RIwNz4eJSxvM49
                                      MD5:E68EBCE02680335F56DBDD017630B9FC
                                      SHA1:BA36B535ACEE4EEFA5937949C7917EFF6F8C99FB
                                      SHA-256:7FB010441AC1E26510B29890A330D95E38719B6887FABB6229E9AEB89FDFAEC2
                                      SHA-512:3A41DD3D678EF35C466F08AA4586AA370E9ECB31102924468A1969DEDE4E77FB1D995916BD26EFF7C0C44F1C69B5523A5C152FF09E510FF2B56E373E1F5A3098
                                      Malicious:true
                                      Preview:.xI\..%..}.q....?.!.*......w....i.........m.I\F."9.8.=.S6..%.!....@.. ...........5k.}=L....Z..........P.....6.......kd...*.&=.".2.p.TQ...mh.Y...p..JT.X..(v.L...x.r?i'..CN..?".....1_..Yv.?...y.KQ.L....8........5..m.X......'...Y...z..mN.+F.....E[@.:..l.gJR...X..IZ.~w3.Cd......B.q9<.r.`...R....lG...;.tSE...0Lo....UI. ..S7....9..q.{.}.!U..^YMI%.x...j......$...Kt.gq+/...4}..2}.3@..S...z...K......z/..8......Ml....u9h.....I.Q..,V......fn.3.v.Pm..f.5......K.2.[.R.......G....(.....5..<_- ....V..Neh|..HV....].W...n...................x5~.X.et[.zTp|....C..g/G.j8.og...S.-..&..+q.....;V...s..WP.........*.J.0.qp.RQ..jgu[.E|..V..Z....t.R.........`..c...!W*.....VT...........,_.3.O1s'..W..hS.Zl\q.&..=...d/...z<.1..2.S.u.n....(..Xk.@.x..o*..[.d..........k......1..x...7..r$<.~._3.7~..j..0!.p..I..Hy~.......tL.=.......[..i..C..%f.J..m.O....gj2..7.m{*bCF.C...-....\..vC..&.mh.....?..A......:P......d....;.@).m...w..!.....p..qg..1.....!.'x..?...^.......!..X....C.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\f4rjyfY.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37322
                                      Entropy (8bit):7.994555298524819
                                      Encrypted:true
                                      SSDEEP:768:ZyoSFT6edkEeV0/4zFd1ck9R7pIj0R3C5GvOKn930PWbaKD:ZVSFOO+06O8pIj0RBvZ9k+baKD
                                      MD5:054BE10BC1A3CD7E47D02BE83C839F37
                                      SHA1:F8E1E3EF47134CEAEFCD6EBF4ADB93D59BE033A1
                                      SHA-256:8D5A3B98F4320A44DF74BF7721C04AC6E1D9432BA91897B1AA6B4C6C56E35DFD
                                      SHA-512:A30769DACA8518A2952C5608EED3AEC9BFE53532DCC72A7A3AAA2AFFC59417B438F1DF750136DF2E2CF1A4AFAB05C86D182B675F00DF64CF5386EFCDC758C172
                                      Malicious:true
                                      Preview:P..l.o.o.;.?....o...-b.$..%Y2<o.......g...H`.5.1F.g8...iX....J.S3.........C.i.h(.e...!.n..R.......2<.........=..N.x.. ce.w..t;../..E....)+..O...6M{.P!.p..5.9.I.NI..V..c..e.b..hU..r..x\...(..a-.ab......(.M.....n....wy...QrY...8.v}.e...!"...{C...RXC.y.y.1...b.V...h....|....o...&9c.c.)...z.+..5rb..Pe.Ku........".."..Va.&.f..`p.tZ../.+].P..1T.~....M.j.8p..._....=.D.E'=~...`1z.....JEu..y.....a..... .E.@..#F.O..[....`c...Tn....p....d...vb.(Tz+..^.L.._....@......~6..5i..:.w.....e..!S.@.....do...{.l.4*....qmY..A...G3....T?j.@...:....p/>.. g.q....'M.....).u.?C...o.n.U.!|.hv....(.....y..a.S............@.b...W'..0....HI..zzw...V.....I.pq ..7...:..../..o.L%.T..8..V.....5k......Z0..0.q.|...4|..S.M..........s=\K^.*<j.......Ni.J-=..v.<T.R..^._rZT3...E..XPC.|!.Z.l..+.....[Qj......7......Zn......p...z..Z............*z.#..u.Z.Z@6..k(...V.>@.o..5.....]....y..z.g=...k....JY.fd?....z.v...+..l:.B&m.D..v|.yO.._..+....~...K..........q.E..:wo......<.K..6.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\fjWevQE.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37286
                                      Entropy (8bit):7.994995364589583
                                      Encrypted:true
                                      SSDEEP:768:kH4xeoYuA0hue6ftxyssaUgJHVn5reHXFIQa+AeN/EHJfu:kH4xeMhunGgP5aHVIQBAeN/Epfu
                                      MD5:80D8B22380B21B7C5DFA4A9B1ADAB274
                                      SHA1:1BD16B9E25CDB6D375DD69B9C96BFEEC69FC4F81
                                      SHA-256:ED8E944388D076D234DBBB353FD6CB90C88C9A98CED2B2FFDBCCE268B57B6147
                                      SHA-512:1333D1656E6E79CDB36A23DFC9BE88CB5352906994B8E65C516123C8B3296043769E3CF862E81588910E233F07A5BEBA1780771D6818C09922874011C9E96D02
                                      Malicious:true
                                      Preview:.M.....q....DZ-....,.d....j...W!./.....>.?b.g.'...t...~z.... &:..............C..]..nG..\.(.h........H.)..tX...%....x.......o..t...W..3.g.w._..1....#.......\............l.....J.8c.F&v.....*qO....|....<...pl28gNS.X....r.4...fLS..80.o......&%..F[9......q.oY...4^.J..7w.&..$.......Z.k9y..r....4.S.t....k..4...nQ...H(*.}<...iC...l~.Sq..K.-#@.......|_qJ..G..tk..y..[.._..f<.......mk...TN..M...H.L..^.Np.....J...&#.:...$...c.0x.......@...}..9.>.....uZ...a.....a....q..C..}uf(...=AG-.o.....5&.~...G.?.&E........h..@..R8Y........@,.L.*.@_N............@......X"..............E...lU.]..+.[m.\u.r.y.U..M~B..B]......"........Y.]........mE.M.C...'....H.m.:..m..a.b...\5.....!.n...C3...... gj..`a'..7k..1...C.z"J#.@$D.n..U.BX.2Z..Zk....H..X#R....i..n6....N.KF.-.>..-.F]^.....sg..xW...!...=...Y.....:.!.....G)..7..WAV.....Xh....HT......m`bZ......l.Z.....Qxl\.I.w..."_@.7...J.&.....Z.L..=....<....`.<.7C.F...A'.....(344[.u...A......qU..].KA..#DejH.)...wk#.n..[}...Z.Z...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\g8r1oNu.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37294
                                      Entropy (8bit):7.994815854974353
                                      Encrypted:true
                                      SSDEEP:768:zmuPBC6k2xJWCeuTlBGHLio0NVGJwYpienHMqsB7dxp:zmUBC6hkymrF4GJjHnHMnjxp
                                      MD5:B881972EB4F3AE920EEECED5CA0C838C
                                      SHA1:268824E3259E62D7C8CD832E7BB70BB5425F1E41
                                      SHA-256:3E1450B5F45A05B25A62B76B09ED662B44E1A87D2100567A7B3E91884B319429
                                      SHA-512:F8637D99D38C16680D4C546EBD850209DF8C7D8A495CA00E1EFA193CF053B1A4CDDC614AB95183C2599C40518F1D1ADA8E899A6E0629377919A50B4EBE58FCDA
                                      Malicious:true
                                      Preview:1Kt....J.N.?..=..i...~m..........$.PB....9.`j<..i.......1I?y.nUP...'.G..O.....`m...y>=....)..H....D.I..!x...p.6.$2R.n.R.{.u.tC`..h.+..pk.....^....:.;A.mI......5p{S....y..w...D.c_..n.\w..|.....F..H....`.UuW..v...~.B..j.,...A...[..H#.t'.%1.V7h5..3.1\.1..Ot.:.4.|..0..._.M......%.. ...`..S*..~.0.#@..W3..<.;.?...7x.X.....=..Z..=.....x.l.!..krWGX...9.j..2.r...+.R..9..}...pb.F.[..e=.0..?DY?.?u+v.nIo...........]o.u.......O..?d...E.bY./'.._.....g..8.F......q../.#....-.2....fq.6.DP....x..hdj$..#;....|..[}YE...P.?X.P..T.......u.I^p.9...lCA...^....3v....4K..3g-L.O.$..n...<....5.~%[...ox...)s6.....-_F$p...O...n47M .8.p.......Vf...ff.O.Qlh.....<#..h.J./...q....".B.vH,..-.u.(h..4.Hz.......%.3..T`@SU......z.Z......d.g....-.. ...l.c....B.<...x....o....+.w.P.,PNd....M.....Um.+..Y.......g..e.....m..a;..../:.]}..,...u*.u...........h..,..e...E....h.2...I..&..?;..F.+.)...=|.m.). ..h..f..eHY.".a...7."}w.`.../...Q.w\..V.fe#...f..|.>ni.....d7.. T..Kk2.L...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\g9CYSNi.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37320
                                      Entropy (8bit):7.994352995185564
                                      Encrypted:true
                                      SSDEEP:768:NKF7Wvtjf3wKEq9YGRn6qvJE1q9P27A3kTKEE5:Q1OtjPwK19YeZJv9P2mhEE5
                                      MD5:A766243D5309024F81AE8641A94BC705
                                      SHA1:0FE0172629482C7FF7D0A57AF5A82BE1FEAEA1F2
                                      SHA-256:1D48058AC9A91A89E9F788BCF5D61C6EB401248F7473BE2755E2D96658EF92F1
                                      SHA-512:8E31673EE5CAE612E29660985279BDC90D1EA21DA2728A0945D302231F8D44941179BAF7A2CE1EBF1A45FE5C2A437A968F402C531A3F92BC449DD5D4EDDBC951
                                      Malicious:true
                                      Preview:....arxD.g....#%..2......d...{.Z......jz1.....6..c..Q..9`b.;.:......H......"%I.....JE}?......%8.....7........W..F.....tP.M...C...L.......h ,#|..T..J....r...W6!..?.n.h.Ft/#.W.TG.d..]B.]..j+..F.is B.._.t...j..W.{...........;.Z..t...|...{.!@..c...Qv.F{..........Gq.D?)mo1...ePv[..z.I.......s..&.......0.{.f....6..G.g|..l...8.....a.Na...Y8.......{/..B...s`$Hp......)....g.;LM.l...5=..m.*...F...K..V.=8..+.n.Y..(.E.H...?.6f.}.O_.......|...;..O&.$......z.e+p..{@.@..rQH.N."E^.`..Pd..1.G}l.c..(...>..W...vM..u.....^..&x.$..y.3.....^.^.......5.".s=...OS..;.............(....T..4.$fda...6.W&.......$f.....M..Q....u-..KBIi.....T....@W....(..m.OE:1..~.6.H..t...s/V..L....^.a.....T54...p0.F...S...w..=.q)...$7.F.I.k.G..N/...;.].".Ns9.....p.sn...L....9.(.....}j...g.T..w.T.....L.A..X.T..O...@....{.:.dP...E~./..=2.OK..Y.d...nx.|(.Cd....K....&'.KE7:.;.....6......s..\\..G.|.....4,../*7D.Rk.l.Q..>^.9+........q......U....0+$...S...l...B...".3..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\hUpOPop.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37342
                                      Entropy (8bit):7.994688506459279
                                      Encrypted:true
                                      SSDEEP:768:xdOn0x/lktZ24RupNhuJ6z5imgnU8WjpnrLrBRF9TKhotMIJKDGaAC:xCclktZ24W+csf5Wtnzt9TcotM6JjC
                                      MD5:E3A828719C1B123C9EB995FD0CBDFFF6
                                      SHA1:0D8FB45AC1DA060BC9483E790B208E51F23AD1FD
                                      SHA-256:092D8C5E2B3BFCB7EC549BDCB68CCD79A2075120D5C42BDF683DF03D9893D1E8
                                      SHA-512:9D182B5FC9E12A053D57E84A9842853420BE5B955EA3432ABF57E20345C50CD3CE6F5F11C00E1ACB6F6BC50F0F7CFE2B6657CA53B6E8EB4E72F520881D785DE3
                                      Malicious:true
                                      Preview:Ms~>_......A..G=e..V.S=.T.r....fNf.......k&.v...}].rkG.qU(C.4D.L}..v........"m6~.r..U...5dF.P...h..D.p.....w..D...Po".n.~aM.B.y".x@....F...2...v..$zH..i.ak!..J....t).X..[\)/..........M.K.15]...6.Hv.......at....Si..W..!.!lG......Nd...2.]....u.=...A(Q...T._rK.C."...pp.k.g.h..#..)...m`...".C.Z.z'...&...@.._.D.AMi..h*...:...i....|...c.7...+H,}@..G.#.."+..M.S.n.CVI..].z..0u.......&n)....f/......Fc..^[.O....i0.].&..}...|..VT.AzX.R.i....{........b;g!$z.>...g`b.A..d...x..zG$...}.e..E."DL...+..D....+.&.B.3.m8...W......E*......P......[.g...w..t..W,{..>..].;2.d...K)".=....aWw$A.cRK&.......@*.:........&aC.....M&.....MK....4....h../*.8..jLV.X..w....6Wu.|.....'.2.....)..e..h..:...]..g......r.>.Y...}.{./D<Kq..Y.......#ZJ.:.$S...h...C..r>....m...|.6E1r@.......x.}....>S]..kN.Q.l...lv.....~..2.E..]g...t.o8#....~....R...*R.<..eu.BFI.^.[b.....$..`&2OkW..G..D<$..{....K..$f..8z..0..|O..7.A8w7v..y.".AU.K...V.E..+W+p"..]{G. l.5X..q.S?7./..K.m.<.<.u...V

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\hz6Voz2.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37312
                                      Entropy (8bit):7.995521154588252
                                      Encrypted:true
                                      SSDEEP:768:cHrh+vwdngpuA6qonoTj/0eYAw0e7v1BdkLl2bZ8D7K1fNDcvB:cLhywwuAlIo//Rw0cjuefNDc5
                                      MD5:7FDDAE9D89B3749B9DAF2E6AA3E1F9D9
                                      SHA1:C50D54BAA4561EEB4EE4CE32FA9A12E88506D71B
                                      SHA-256:8DA8DC65B053F5406A9EE82A2B75A3FDB5138534E5A0CC866531A5BEE34BEAF8
                                      SHA-512:BB70B34C9B00C1222B6909142FB125739F913D186A440F810732BBA90551869D6FCB115C211FEBBDCAD86EA15B0B67DC504B64058F4A772210C7654EFED77BCD
                                      Malicious:true
                                      Preview:.>.%h...:.....i6R..Rt7.".i8.*5q.p.S...P{.>.#..w.x9.9.P......[........j3].. :.HE$M...p`.+........r.~..#..X..c.,z..X..K.].....O...St..!}..it.x..8.Z.|...W.WV..W~<E~.{.).....u...9$.K...o..[.zl....ufI.w...1.......@.._.....B..m5..&t....Ue *...vZ..._.S4.[.]...5(...rR..Y<.........E..q4D......3.C...c......^........0..+..?J.4.%#a........H..<.z@u9.H...kM...Yf.*&cY.........%..p0(..:.....K.(.!j..G.........M.My#^...Rj*.`J.mJ.J..g...o.v....V..H..+..M....1.......R..e..h?d._...q.&.xi6. X.}(.....G.1.h)....=......S.'U..".....U/A.'...F.Z..am+1.D.v.ay......=....Da..*.;.JGZ......Mf.Y...".....9X.I'[....\..ZV0.....05.M.}s...p2...>&f....^@P.{#6......?....i;.bz.x...n!..Y......cu..T......l.bX.0x..zXG.*%E.......Gd.a0....1.>..dK...Z..k.c..u.3.<!.P.x'.a........$.Eg3nw-..y.n..f....O].+...@..?.gB...._.u.&.}...},.;."7w0Xo..$a*8K...+.0O2.y..CS.L(.7........r^C)$gH#3z...#..nrvs.%g*d....N.U.i..B..@.r....U..W..:*.Y..Z....7......b.r.<s]k......@=..=..v..ZY.._L...R...-N..#..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\iDY7dWc.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37299
                                      Entropy (8bit):7.995558617638541
                                      Encrypted:true
                                      SSDEEP:768:9BMquD80ZeN2ugR3t27uOoypImd4xj8xg7WghwONRUrnqXkfe4tDgm:9WquI0pz+pIVxAOWgiOYrDejm
                                      MD5:D042084644A544A378D5D472FCE772AA
                                      SHA1:E774860F51E596BD4BB583DAF115197E24DD5744
                                      SHA-256:E0E1150B80430339D66326E57608A5993808B53D017C31785C7D313E685EA63E
                                      SHA-512:E344C23288BD445510B9CD05823F0A96AACF97303EBC57E03837A6126194AC6F4719F0FBFF12AC66F69F4377954E0BC8549BFA70E4B93F4AD55A5EEBC58F0753
                                      Malicious:true
                                      Preview:u.....ot.......~..5.J=LJ...Z..&dv..`..Bsvg.d.I...y...C.-Z.k.....1M.-a..3...YV.!..O..yV..[.O..3......<.@..2v...F.z..#.s.......+[..s.m\e.......Az>.J......C..sf.9.yT.TDJ..#,..).u..0l..f.{y.."L..#co/.R@......!..Mk~.%kS..cD..A.#.......){;..o`.k(x..r...l.'.'w....*...]J..Al?........1...h[{..T..........mzj.%.ye...\...4\M.6r.{..Q.j...$p*..i..L.n..7M(ho.-.G........q[..#;.`_*~P>x..8........*...4..>4.y!...1...$.^..Ip.u$...B....=...4.JQi.\bB.C..).'.tZb.$......ZN....4.@c.{_\!...:............i4..w..z{.=..<~/O`....v.....lM......5..{.!.......g....Kq3.......Q....i..u..7P...l...;.D..,#]...7p85......X.V...Mj..3.6..i9....)&....E/i.xa.].....p....>^...g.0...I`.?....m..........3Po..>...!$..#..`GZ....jq...Wy...tJ.jR....M.B.!.gm..y...*}...d..zQ..0.kP...|.>..Y.......z..C.(~...*..a...xB.....x..+....V. ....)..2?./..W.'y....=.o%jy.B...(L.o0...tCX-......L.$..'. .V..L.g..G%Q...?.z8R..w.m4&..)5.....J..k.AY...v.pR.1...U../.c.i.%X[, b...4.x..v..8..........Q....G.s..sT.l.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\iK9NSTJ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37306
                                      Entropy (8bit):7.9948645215993315
                                      Encrypted:true
                                      SSDEEP:768:rP+yVk77b1Be7Mska7grD9QfMSfYIeVpnGXcRoy8Av+2rRK8crEyfPwhsp6lJCeh:rGyOhChka7grBQfLipngcoyQ+KEyfPwp
                                      MD5:B07EDF13A8537DC40F6467FC54D74B0A
                                      SHA1:6966B55AF29C6AE560E82998F217C255AE70EE69
                                      SHA-256:1E8A30D84299C731D20FD7A4E9E087BE0ACEFD887409DB9460F0EFA19AADCE71
                                      SHA-512:036169A5305240A1FDC0A177099C92076C9F230044F7CD9C43CD12C84BCBAC28A84E83F2EC2CAD43D4E400166DD8D444DB26C3DB73C34E19843E53E99BDE39F9
                                      Malicious:true
                                      Preview:,..p...6$.&'..Uz.~G...&.zE.w.J......;%s.UW^..@...Hsp.........(..Y.ix.) N..2HW.=.B...$........Z6.5G.....v......p..SA....N.+..zoM.w./S}.....h.....a.R..y.......j..~.....3,.U...uX...D..&.w....(..NA0...&.x.{.+?t`".r..I,C@Va.R..f..f)B&....(..&]..qj..HH...GR..........w..U7..v......Q;.f.Ig..~..T..X.'.F...D.N.........H....}D...&.r....}.Hr).Z..c...9)..X.l.3....m..":r..{.k.5.......e.h...b.e.j..6f$..x..B$....P.5&.h.Sqr._..?ww5_b6%...2...."a.e..*...).gX.@...C..~..N~...T..,....c/..j.....l..ns.{...8i...."l...n.F...~[..S.l.?.(<"....#.3>...#...[....r....._....[..t...eS...&)p.....5.y...MQ.B.....R@6.b.V+........9.A......b..r.f."wrk.o...R....RP^.6A........T.2..e........{.s./fE.&-..F....y"...H......:.......p..+.q.w.|d.ql,u...".=x......q...r.!...f..Kfl/...~.O.....2J..Ro...?.....NF.....y%.s.d....@..N.alO3-T....i...x.4.."..W4..U..*..(.q...}P...4&Ktt6fS...E.IR..7.a.y.m...Ze?!.;..L........@..guu..e...Sd:..x.......$H..Z.T.$!.F..o....4...LS..*;q..3..<.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\ic45FFK.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37300
                                      Entropy (8bit):7.9945655081293525
                                      Encrypted:true
                                      SSDEEP:768:ZDMl03yy3TOXRKCTr9uSjTpQceCkHXws+Ex0NEWjtpC3A:S+3jTOICTEATpQ5vXJ+w0Fj6w
                                      MD5:29D732E764DF0660FE02BE871F5D6405
                                      SHA1:A276335926AE570411A6E15554D23171C11CFC4D
                                      SHA-256:22701DADE5D1A85699DF26263BF9A6AFA36074D7EBA671D1D33B13C11B61C10F
                                      SHA-512:4EE0DD83A80653974845862BBF0F805C843553C019BA8B0560E5038938B9106333D5B0CA9886D010188B0E56F3F9991C852FF15F7578142FA48A2AED6A2BBAFE
                                      Malicious:true
                                      Preview:S..5.$jC.|9G. nC.}y_'.I.A.2...e.P...^4...F.J../yA..8..U.!m.p.3.$.kS._...H....?.-}.....Y.......6]@.......g...U.K,...-O..p.....:...m...&...?. ..j.....q.O.A .o*....R.U.>@>[..0.'B.#r.Jc...*lP....O..n...S...H.C.....2..u...8.|.....Nzd$.E`..%.!...\..qm.~V.5q..YzHEIb7.7..T.$YBy8..;`....5-O.....Gs...h...O...e....:p.b...H..... |G$.A..-?..C.;.........8....\....s..urqf.Ag..b...rL..OF..Wd#!...UR...G+...l"Aq....g........hU..=t-%...vg.. K.........N....1.9B.tN>.,.j.....5..P.n@=g..~7.K..2$...+4...YO{1..Y.&...,h._.G....W....f[M.../c.f.e.$6"...9i]..a..x0.@S....h....{{..f..j.m.D..Dh..y.=.b..Y....k.....zt^...U.j........b.GI......&P...*18.M..v..=.zr.......-..V.k..A7..{....v,..=..AU ...m".....J.....%8...6`......=S....,{..&,Y....{.......~o...2B......T}.I...#....1..j..2.i.OVa...(.G_..4xc.g.[...Q........"-.f...=~.R...S...1..l..u.z|.r'..qs.._.*)../.$.s....O}..#.O^..e..B%3...>.....3...^..0`'...L.sA8ee.. ...^i..]....;2Qf..s.(..7....$.G!(A..........+c..)..S|

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\kC0E0oV.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8169
                                      Entropy (8bit):7.976317530481742
                                      Encrypted:false
                                      SSDEEP:192:1xuh8UVWDa5MTKl3r5nqxCh/H+EpCYrx63st:3Ml50K5+WS8t
                                      MD5:56BF8E45A8D95CB4E7C760BA7DFBFEFA
                                      SHA1:53CDFDD501AE4272297F9CD09CAB9120F4C91E07
                                      SHA-256:35E40752D6184E88C683962AB55430DE21942BC8D7291508138AF0B3EFE6DA55
                                      SHA-512:8E351F0D32715F2E641C28A691A9754596EF4022FBA73B1BE05D4913C940B7F5D3CA99E71650CA33B5ED6EC3BE62F02927F0DE3CCC8A3CCF18D01B250928049B
                                      Malicious:false
                                      Preview:I.-....np...m.L...A@..'..^..K.0.LoQ.o..$/.o.5j...../...-!)..}........7..lq..| ..JY.....5.v.>...B..R..V..LZ.zk?.w..|.........CX....?g.Wb....+|.....G..,....n..~.cZN2..g......es."0........J..V&.w.0(..9Z....p.ei.#..d.o..{7DI.N+W......#.*.a.Q...#......v..#.!6..i.......O.D.v5......HtS.]...z.qw.y7.!.X.b*Z..M{..\bX.....S.bg..i...P.=..aj..^./.<y.)1...I..3.C..t...b.>S...l".[g.O;...2..*=NFd.R.q..^$"g...B;sC............l..j.......o..X.M...JR.HU..%.~.<.ip...Q.kEe..(.<.t.^.....3 T..\1.....O..k..q..z...;.b]..'5...<...p.]p...R1r..o.3..H...b..M.G.+O.*..4.b...tMs..9.8.Q..9U...k..}...g*..0..j.......8[bFU.~.l....K./.....3`..S...r......>q-.5.p(.SU.F.D.C.B.@..l}.p...|..B...u...\F..d...9..N~FhV.h.....=_..qi'........!.....M....\...........;.7..[..MQ...xZ..a..<.q>Pf.$.T...h&...U..p>..........k`.>........c..s...1.o..P...P2|....!..{.w_.I..1..g="\..T-*3...R..|.*.....Mw..EbTw..'..W.C..=.O.w........8..ZP..x....8.2..1.Q.bc...rek..B.........P&.. ...Y.~.c.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\l1QouX7.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37301
                                      Entropy (8bit):7.99555126019695
                                      Encrypted:true
                                      SSDEEP:768:s6YgNzTtgjRcbI5+DtumEd231zDcn5nSpAWwqIQ1BAAtn5+Bt:fxNzTjErNdg9cN9Wt12AyBt
                                      MD5:4B8E10489E91563AF81C77D69CE60502
                                      SHA1:51D302599B9664BB7FBD54C8469540EB56CDFD49
                                      SHA-256:EE71B6A012E554DF556BB7607FE02217DFADB70AFBD029542C493133ECCC8870
                                      SHA-512:A9D8B4128E00F96151F6C72D3875EF1D826A8F805EAA08FF40FDF8E1D65FA3244DEB516916C0FDD6E8D309DB39F2BE3DAA4925C70C5C12F6D317F96932B8C707
                                      Malicious:true
                                      Preview:g.O.m....6a.T.-.=...2....-........2..b9l..]...<y.Y:.h.Bj..;.....~..w/....i+..K.......He.Sb...X.....*.R......C..y...b.R.h...y.C)aH...z..-u.;r..~.}A.`rqX..E.......z..}..%..Z.....1Mvu.i.e-[..q_......2H.Z...CHv..?._tfh+..f.0.'.....h.\....g?....._.).`8.c..:w.....A...J.w/.4iCj.f......''..t...I.W....(`q...y.D...)...Jd^..~.M%.G^.k..3.Z....D.i.."........F........m3.....<... ......].=..J#....A...J....T..."......8g..a.{M.....i....g.*9...4.#...,dX....(.Y..(.z..`:..m./f.]...F....V.=.3..w..-.X.....0~v.f&.h?{Yng.*{.ai.$w-8,g.L..<.E.5..>)4B...._.8>+..A...e.E.....[......N..5_2..........o...r.l..<...:Und..#c&<.G...x..0..Fz.......h......pf..|.BT...SFH...H...5.N@.y..:.}.=."..cw9....R.b..5...H.E....}...<.v....[..W..J....m..YD..'.!._9o.2..?u-.n.<...J%v6............3.{.t+..QE...C~H_..&RY..P..p.i...3.l....g.....).0;L.S&.1I2.h.k..!...9.R`.]z...aF_....1..$Mc.L.7/......a.9....mK...7...z7..c`... .1.w...G.(.. .E..g.:j....I...K(.X..xM.....Z...?._(..;{...r.*Dp:...;.F

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\lC3IX32.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37324
                                      Entropy (8bit):7.9951367513633
                                      Encrypted:true
                                      SSDEEP:768:qhYBG7Tt1Mv5S/EScfba2VLtj6gMur8FbsIGBilpD6p8kG2:u6G7UxS/EScOoLB6tur8ZsIlSF1
                                      MD5:5BB76E3439D6FE0DAB8FE5695AE4B2C8
                                      SHA1:A34FC912DEE0EB658449E5484241572889367861
                                      SHA-256:44031B93D9B397CFD92245240C70E2D6D45D9D6D5AE883BDA9547A6AD420D250
                                      SHA-512:9EC5F7ACC1D8396E7B46BAB7DA50F9BC08548F34AFF1E8BE1B5FCB9C67BE3F9F2A969BD773B491DD3AE28620BBA70C71D1C4B5F6167A20BFF3F5189711BB1815
                                      Malicious:true
                                      Preview:(..........Vw&C....t...n.8.%.-$p/]3.d.}../.....i.....|p..Z.A.\.....'.S9..O.xk..TU@..I.!X..3A.....Q*W.|.@.W3..../..T..5q...3.].p.y<...Q...%...G#.XeY......[...:...H.[.x..H....P9......6t...J._.......%..-....p...f..@.G./.y.....O...'>...QC..b>H.:...K.eu..c.|h^W.......q....n.)..D.\..2..R.......Y..^......rW..H../..V...H.3....n....!...^.]m.....{.....I.Zs...;.Z...c...K...."..}...f$.ab.P.f|.......D....N.U.....6.......b.....K..\...=.....e:...`S.P....y...?'......U.s..G...._.PL..N..k.......(..r_....P....z......~..RW.u$.M.].La...C(N...l2...5*..S.0...Cj@.b.;#..U.8._..4.^..X.hE......D.....>+..!~.O......4_....p1X..W./..[E.@,...veK.>.s..3%}..E..lU../u!3g..5..T...5.'.$5P.O)Z.&U..........l~...h..P.v.NU{.aZe..4...0.t!G..d."/D0.:...oR......a..Ga&.^...!.....o.c.g`.Q...%%.....R..`.}..`...WBX..e_.m.....#.R....O..WlC.H.f...\..........v7.S..fwY.-.&..@.\w...z..I...t.f|.H5d4(....z.......RG;d....8.Aw....B.;v..a|#G.,...4..\.....S.+Vq.F.}..'..$p......M.......

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\lYRIZRn.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37281
                                      Entropy (8bit):7.994241407119088
                                      Encrypted:true
                                      SSDEEP:768:qg5sZ2XvdQjijuvc90wRTfpe4+dMIOTcjxi2Oj/4t9egU0egj:qus8fGe0wx5+dMI4Ai23ogzegj
                                      MD5:D73603A0CF61D753E64005F38939C84A
                                      SHA1:4C040B824DB7488F33B942FA1FA7FD831E3FC384
                                      SHA-256:FF9FEC705669C8C1177B66B1CCD7186D4C3BAB69B364F563EF066F28458AB020
                                      SHA-512:97D5DD47B4A6C76BBF145A777BDA985B8A4AB191006F860AC2BB289F4081CD067D234CAAB21DB061C3DA1A3C3B1EF31377F2B4F7FA22862597D3A59253AB7CF8
                                      Malicious:true
                                      Preview:..C1xS.WPe.PyY.!L.i"K.:.V.]$........Q.a....3j/m..<.Y..)t....RE.(Rv..xl-L}.C?..r...0k.49..S?#.!..*.....<.;.~f.v..'RGm&.j..lv...Sv...%.'F..4.E....[....5...9..>.T.#......_"n.....9....m...1..1..sC...KS.A.o....y.(.....(./.,e.7F..y......t.._.....(.U.V...~...KH-.`.kx..RJ....... .>.6..=..~.'..O..I.....i...|y.....}.@.F....yC..e...T..DK.....,...../..../.e.............]...W.@...fL.W.Z...cr-.....Q....." D..].;IV.}%.....|..NQ:q.~.a.a.6.\.\../Q....,!.p.To.X...:I..q._.gnQ.=....u..8...".z....'....y..w......W..{0...>i.V..|.......%_.p....k.......$..f..$.y.....Ga...V].{...n.o.w...v.js..I.....v.....B..].LrH..M..i.......7... ;.l+......B......g..)....g....&.T@.......u....3L.+._........%...VO.......nv.......!h.d.....n..EL7Z:.V...m:4.|.(..95\...j,...Y..`+.......Q^.j.....m...........>.o...i.........-!..........x........tK..0S%&xH\..{%...X.S...$...('.l. .W.....~5KUS.. ...L...YEL.&.w..xV.I.z.4!0.\..`)._.........P.I..|.....2.B....J...Pl...D..h@.02..wS._.X...=.G

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\liAG2zD.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37301
                                      Entropy (8bit):7.9955907615198605
                                      Encrypted:true
                                      SSDEEP:768:i7qDiJNpNOeubs4YJPgiFZR/lq+cQVHrT1cYoP6XCHw5B6gb:gcYN/Oeuu9geZR/M+JVHtcYcWCSB6I
                                      MD5:F851888E0A54F3461BEDADCE831BC53E
                                      SHA1:D59F0819FE4DE88E0EBB5A98E9D488DF11373FAE
                                      SHA-256:71F8213DA395080E52B1780FFB2166142D6CF2DCEE365221BA6D68935F807C45
                                      SHA-512:8619107CB3E7E518AAD9D7082C07FFC360E24DB964150F6B34DD8FE6AC8032BD0168CF10359A2BC87B05593ED5D7DF306F6B176A94BE5F950D386DA398E106D1
                                      Malicious:true
                                      Preview:jkdx@..8)..[..p>.K.]d.Vb#..;n...Y....A`....`{X..w.}.........n.@.:[..>(vUnI`={r.K.p...8.p.$.`rO.:...MUe4..2..8.0a,....j^..k1..........3.o..I.>.b.g.....V......I..e...b[],f%c;.u...x@V.U*.qA_lb.....V:s..<..V..OJ..Lt..`{..Z...b..TN.'K.-.M.f.n....=/.=.P.$W...[!.N...Ue.<...mC..yx.>.......9..'.a.......+.V6R..`..F.'l\u/...#j.f.56K..JpS..J...I..&e.".*..T..y-):t.+Q.f.t.<h.D.l..n...K..?./...F....z/h....#}...w...G..Q...S...Q6..5;.8i.-..S.>...<.G...N.I.."...%`;..=..P.hH/.66..K=..=,..4...1.> .qj..h...!...#nSc...r]P.G..>.T.\.f......Z.6.....q.8..{.X...0.m..V,.......|.2.....,V......r..x.X./}^..&...K.R......%.."wez410<......A0..!O@....oPI?j..)lYo...*.y...../. .)..>_LaGRy6..."y.<........|`....t|..:...m....(.u.s..;.nV.r1.+xX.H.%...o=5.f..r...U.":" ..=....[.= ..'..+.{....!{.. T.q~."KQMS.P...N...a...C.. ..x...,..6...9...j..%.......Q.......k.$.5.;G......8...J.L.....0..c._k.3..v.....p'.....4X.3.^0.|t.n....k=......_.k.M(..?.....M[(.`.l..O.}..:l.M.....{D.......(..}.b.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\lwwJ6bn.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8172
                                      Entropy (8bit):7.9780171511592926
                                      Encrypted:false
                                      SSDEEP:192:C7ZPcRkLjb7XNGk0sfXg3zRdXCrLJQ/kKTUcoSZI:C7t6kH9GsfwDjyrLGkKTpPZI
                                      MD5:F98B4D270ADF3E307992724548D504AE
                                      SHA1:B29FA8C7F5D36EB7352FDECB4E64477D42F99B87
                                      SHA-256:C07E973462F2D2E94A33CE7DD68D54D10A97689AA2BDF94113BF6B221CEDC5A7
                                      SHA-512:CDF837E1B0E913998B22FD770EFDFB6D98CB3375E35FE0BB79CEB43895065AB0F000BB15BB8025DD8ACBD3086A62FBC4935F35475C4B4FB40EDD52ABC9A0C4ED
                                      Malicious:false
                                      Preview:?........h.~.6.L....\..g.#../.:.W6..;i...iP......)....U..?..HR..wn.p..FS.w..........r.n...".V....1e1.Yq.......<s{W...;..JVD.iL..;g.iP8..\..g/..@....td....A..h..O.K$.......FA.X........P.....|;.GX...se.]......G..H..}.L..6}........ra.wm...Q.....}j..)......}>BN'..O..`.n'h.|...}S....e....E....p.1_.S.....Rn.Q..-...Io.~.02X.Q.-..l`.d...7=U.()........>..4....Y....P...`.f.L:........i.Rk.!....cN.CjV+.#~..@.5\.R..qz.P.......GkF.6.7f...hn......!....(......7A.....4JC.g.1.x1[Wa,...tx{..c..c]...ob.Y...{..r.:/.&s...]U9!.8(..0I.Z._..%.H..W...v.pD.=S...V..@.._..............4..].....*...`..^...:x$.R.1Y.[,..u.,..V.......k.Jc....KU..A..;.7y.....QS..^...O.&i.^.4..|..b.<(....b.....s.O...P.!.\....S.l.....[AS.hAl'.8..j..J7..T.H... .....$...TW .......P..s..m.".-\..;..1....&L.K..M.......>l...?;...T...Y...F....p.fr>....6.:L...S.....-m.q.......h.;PGHx...m....;.K.W.....n....&...r~.q...sH......k&.s.;.g&.,_.........~.O...\..]5.....w.&..:...4@A........}=...|..(.zN..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\mYJTpBA.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8172
                                      Entropy (8bit):7.979445347765549
                                      Encrypted:false
                                      SSDEEP:192:EtcHObOQoxY0vbuBG4Z0nSvFwJQa+B6k+7TXTLX7XsvcuE:EtjOTbuBG/uTB6zLvX7XsUZ
                                      MD5:1CA131F452D02D7FEDFA29D573BDD4B1
                                      SHA1:4DB144DF35666139BD089F2480657E548255EED6
                                      SHA-256:F3817A8EDEED17CB94D079F36FE5F45FE00D740879E26C1303DE31206B312CB1
                                      SHA-512:4AF6E839688718785D3E1D012D0AB363E0FA7B835B3D4C9622949673805777B03BCEFBC0B2D1A262649543A14E2E0E38CF6FDC449CE225D6F5839304A72B3716
                                      Malicious:false
                                      Preview:[..|.$..*.G....A..u..Y.....j....c......8.&u...\..M...u.Y...i.t.....rPl.e.....w....e..D.D_.4E.I.j.Z.Ha.Z.s`'.........Z..L...i.X.Z.q.M.d.}....2.......K.....D.......T..>...,GrN.....6..J.EeEM\j.X&B....^.g...r...Db..f.p..H(..:......g.XJ.".4.e...>... .&.........}-o..H4.W.mo.R.6...V......J........c...ID.1.|M.Vd{....).0.2..".....K[...h..rGT.@qT..Z...7.dp.O..pO.j.:"..=.O...C...]..o.\g......s..%7...=.......P/.....l6...m..c.!...9..$.kR..pI.n..4I.3........0=:......g.L.w.E.d.D.x./.....5g..F.%..v.g..L.C..t.djV....".?...;2...B...ElAW.s'....>q.f.P.o>Fac..WOz.6_n*\{...<.@.)..z.z.xO...E..r........P...y...Dz...+.?...O..v..X]..@.....}..12$<.f+.6.j..kP.V..4.......lQ........s=...0.CU.|s.}>_.......M4s.F......7,....1.TYk...Xi.)....~...|.WO.........S.........<8..Q.4..$..2.W.........-..o.C.a%H!o.C4*#...?W.1.....Q..k.......7L&.7.!........dY.TJ ...sK.&.....;Z.......e%.hl0{?.E.Gk.........F"(.m.(.......G.#k...Y1gq.W.........&@S......#......<..iD.G...j2K"......;

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\mapuGD5.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37322
                                      Entropy (8bit):7.9947881467361706
                                      Encrypted:true
                                      SSDEEP:768:iOVbqrSTQS08LCo9jZUvIs/jv/a2qf0PheLtUDgj3Xhrlf6oNZkkI:iOVbMSTQS0saws/e2y0PgLtUDgj3Xn3U
                                      MD5:F53A725783F5A708EB07234DC3D39482
                                      SHA1:BC0E065A6BFF520D783C749B75645EAAB62304DF
                                      SHA-256:8BABDAB06F48CCAB16A310F7EF39C462AEA45AAD694411AD4FDF3CD64A7E8730
                                      SHA-512:367A67FAFD40A71128ABEF5A6D3FB160203E11C242696704F1AA3405381C86334A643A785F2C7888669F56DD568B9C8A7F7F98BE9DF25A2E2335390824EED872
                                      Malicious:true
                                      Preview:.". ....\S..NY.w........,.lLT.o..N..t1f.J.....e. .#.qf6.).......^t..(S.`../.>.]X.@...N@....-.<...gP..e.*);..8\.)..P......E..Hr....\Ry..f>.R.al..R.....d......Y.f...H.Z.8B]{...mpK........V.s...X.........L...Z.=..J.9...y....3.W..H..D..Q.g...m..50....+...L.z.......{.x/.....'.../2..a..W.t..........L....1w.o.. .......-......#...c.X.]...[.....9.9.>T.C:..8!........3Q.5..lu<z !w..N...'B..?..N..I...+V...`.....n[......]a~...b^!.Y... ..g?i.U.n...=..29.c..f....lN.j..7..M..w..qujJ.RW.Z.5!............/0.2...2...T..6UhOJ......T.#.4.....a.>..q.T.l.Q..Y9};.l.i3.T9......>..o....w..g#....`F..kJP..R.M..H.H,].._.2...AW}..}D...'.....Ep...?..Fk....EFb...5.2.....\n5......4..L..r.ZI....T..p...|QW5.&.....'..b|..ZY.f`.;u.p.#..$..Cz..m...:]Ud.q....W.V...V...j.*.!N..3]Z.e.<!...x..y...cn..Cc4v)..Ec....o>;.~4..r..o....B....(..$....W...g.^...\......./..|.......R....s.qk........OY;....:.......f.O.B..R.m.E...`.=I.^..*a...k.\..f.}.#V.8c...H.1.........S1..L../.j.h......~p...t..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\naPBDt6.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37301
                                      Entropy (8bit):7.9951340447982515
                                      Encrypted:true
                                      SSDEEP:768:Vn2NdXTpztYZ2jK7NkdBlazyH+HFTuOgGZhEOP/benYW:1CdX3YXUwuATuOtzCn9
                                      MD5:B18E2A85A6D1F48431297ADF67714E9F
                                      SHA1:0458EE3846037D502DD7CC60263DECC244E09EB2
                                      SHA-256:A4B71A61BD57CD2A2B8E635E3A62185974FA79A8FB59FA4C092A6229E69E0CAD
                                      SHA-512:C1560160D8C05953FB7642D812E981C347097FC28FBE3CB10140080F102167A08C4CB9BF42AE950BB9E3E577CE3D8DE4618F5472710CEFDD012E1C9A606997D3
                                      Malicious:true
                                      Preview:BGE.l+......B".y.x..L...)[....X7.DLYw7.M...wV.r.{Y.(.."..D{.g..'NXA*.MC..L&1.(|.m...t\BR...3.....8.U.(}......$.~c..hl5.yj4|./|q?.P.A..,.3rm....w.s... .....Q..".....`.'Ib.v.f."2j.O..]....f......Y..e.Z6.T"..QE.....! ..>@./.H:.._p;/X.7....R..k'U.,ghXt...E[....)Jy........C3.dpY.j.....W...Jq}...a;G.9...Tni)...r'".~.j......O?.`.,.D.,...N!.w.C.b.kzn).g.j......(.q.?;.....qU....WT2.....v).. ]z.!..~.li.N....."....B..'.! -.^...x...sz.....oH...,j.fU.3....~.^U.p.r-......C..}w"Aa..2d.x._.....c..+..d.9P.U...[.[.=../r.=.fc.>......QH!.v.,;g~.!0.O.:z.....N.._.....'%jm.......+..Q.TYX..a3.2..<O.....l.a.X..z...Z.59*7/......-XR.VD.P.""/z......s...k.m.....+.vo.S.3}.......c).^.....2hA.+....M..]..n...R..C.G.KZ.+f.b...h..`.].SA....PP.@p.....,...=V/.|.D>".u......:.z.o]..... k.94~.&~...@G.#.!so...W..B..M...=iJ.'.!..i[......_....@B..B..........x......"=.E...&..D?../ri.9.R..n.w!3Pz"...(.../..f..5....`W......=..V2.....KM.e.(.y..S...aO....CW..r....vq..e.h+;.i.6.......

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\oJfdn4X.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37281
                                      Entropy (8bit):7.994550918710652
                                      Encrypted:true
                                      SSDEEP:768:/o9iUKNEPhy7gaJ6O1mHyq9L/OrszS2vLON1JNNw3u2:HFEPhURwOq/PzSkLIP7w3u2
                                      MD5:24D0E9554B330FC8319DC5FB43965E99
                                      SHA1:DC0F25980AA741D72EBAB54114F21E1640EC767E
                                      SHA-256:CF4B583B010E836A6FAF94F5338DD15E0653D7A8A909A2FB4657DEAE9B2FEE7D
                                      SHA-512:69989D2994016F960C23DD8AA9AC8ED51854E17FC55BBE080959634ED611B3A76EF87DC2F52899A775CD50195B4B5CF2A40C0C27C7293B62ADAA9398C5D4E82A
                                      Malicious:true
                                      Preview:.zz.........z7..).^.c<.`.kRw.....v..K...^.L....|...AZF.u..*...k...<........<.n.z.[e.U..8....c..fAG.../..X1...zL.Z5.{....W.....;=.;+.%....E.r.....6.......F.+........T... ..?.....~.T...x....4....z.p.CB ].m...;.....@T......H...|.Z.y........tkI....:K...=.~-9.s.{O..3`V....D{.]...+......W.._..~Gk{D..d..Ws.....S... ..c.*.g..PR...m.......j...bZc..xt.."U..!...[F7.0.+....s._.|.A1.'...u.....@.+..K.......H8).......r_+..Ho..0........]....I....ET.9hm-.!...^$..;..V...fX.4...n].=.O...B....<..@..nx%fd...W/.f...N...30a-.vV.*.EXw}........~..v......X0/JMmA'y....-..^.9p.`...l...4l...]8.}.t......N...f%_..d....m..v..-.E...G.......C...A.......3..`9.z?..F...T.Is..SE&.J.Y.....G.#S....a....Am.i.aB.y.U..BA...S|......Yr..T.[@.\O.....AW..|...9...4.!...N.......$: hn.~..v(...{m._....a..b.d......F9...u5.;...u.....1T..jF.h.......D......}.{i.v..._$f..Z.iM..@.{v4Y.../.)....C..>..'.b.vf..u..Z.....~....M...1I..v'.#.o...e;...#.9..v..}@......e.uZX./..7gA.}.>m...9....?...oe.M

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\oWqeWwS.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37300
                                      Entropy (8bit):7.995328077025911
                                      Encrypted:true
                                      SSDEEP:768:z1jKSWTB58nrmfmZSSR6CuYic0YbQnwxcvhAdZAEd4XIYsmanqm:zcx8nlAG6CYcr7xSh0+Ed4XZ7aqm
                                      MD5:5607F995755C2EB55FFA59CDC300D153
                                      SHA1:2EF64EC96CBE63D000333C310A5BFD00092C6E59
                                      SHA-256:B8E1E08EF7BB2B90DCA9B78A58829A22FF5B874926C25E51D4920E3C663EB1BC
                                      SHA-512:5FB96F61AC85915B52390CD9128FED7996CC5A51B93A8C4AF41FDE7690252391DA1CC18DEF173F6B6A89AA2791565161A2EFB8855484692EA6460CA3816D5D6F
                                      Malicious:true
                                      Preview:7.F.;.Q....e.Nh.j%.A....e.)..y..ZJE....{..ar.......j..rk;j$8.k....L7U(D.+..qM.....aL..!.....$.k..n...z...C.y....k..J.Ym..:..A.^Z..T.RM..p.R..h.B.F..)!.x.B .zXq.7.P2..X..>.Vo.}as._...\.E....Q...c....5_7..R...-.\....)F...2.......e6..6..d.....Y..]..X.M...a.a*.og>..u..0..yr..S....L.."%.3N(.....JG..I.yO.............r....zV.........^.B....,e.T..w1.4...|..5F6\..6..|]b..Y.uS~!c....5K..}WUf...`.C...Uh.....x..V.....} ....r,T..*.}2...C.-.<.I.y.P..X|.j.l7...7k..y..=.....rz<......0.~}.=\.U..2g=./..p.&.Z....s.._M.....:.6.......y(...b....~.9...."R.I-:..=../U ...iw..,.....xi....@.K,..`G^..a1u-.....$^.a=|4..d..Dc...y./..s...........Ow.D.G...e...M.L=d .......0.b.Q..HL#..$..=...y.p>_bs{&ON...w39.1.;A]..:.E0...*..F..xc(..#..z.`.o-..z.........i:i...\.....Y.....7..L........U...,...X.*...k..... ......Y...F.'.u..mX.7...@G.]...E.y..........[8Y[...v.B.i..U1s2m/..Cz(.3Q.......?..l.....=.........t..Z....#..)TLn.m..`..........~..l.....`%T.a.5..)9`m.';t(.. ..f...?N.4.}.....>.^

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\oajDB6n.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37307
                                      Entropy (8bit):7.995971884175536
                                      Encrypted:true
                                      SSDEEP:768:gOx0voOtdTmHSiahiFPr0tnczouXsB7QhGcfpEAHVyh0vYW:fExiahmjWCqqbCqcnW
                                      MD5:CDB84E886D304934D7D4424723CD41D3
                                      SHA1:90AC982505B81222324519F69AC4FDF1001BA84E
                                      SHA-256:790A6515BFC737006A2459F90B438A630E420B011F039C90D52551B3A6F11D1E
                                      SHA-512:E4A595944773F8D4D2526398FA0CB669C291981332B17879008C55155E350CB85CE89DA3834EA9C55313BA663F9312C73A2DB3C987AB80FB250F2CCEF1BFD85A
                                      Malicious:true
                                      Preview:!....z............L......\...O...T..G....bDR...O^.....p2?@..t....F.a..m.....pn_y.J..3...'Dh.V...t..5..6...s. .j@..@.....F...sZ .....]....'!..UjX.M#...r.u.p..Z.W..H'.D?.i.7./...l...y..c...t2.r.9....K.!U.V..8#..RY.....4T&f.k.....bE.Y.o.>.%2...7%.+0}#.b7.V;k..R.W(..X.q...?p.jc....h.e.A(1#e|....U..Jv.!Ad.es..P.!.^.X..k^..q|.ZfTm%#....._......jN..S..?......e...?.i...pA..~..x.8.%........).....9..8.9.p.:.wEz_.......lm%HF.D...tt..k. O.6.~.:..8.S....W.w...x..4....B.....+r`E$r....kb.#.U.H..1....~5...g,...i.,o...b....m....._...<g.E.....DV.k .UE7.K.U....U..M+.o.)......D.v......;.!A...z..8.P(.......2L....vp?......+'vl.sFi<.u..d...p....O9..0^@.V..;!.9 ../..J..g.Pj....2Li......=......z..D...ht....bP......8..D.L.C.M.P...Q{v.L.L..,...`...PJ..l..t.....%.......MCxQ..3...uy.w.0f....~../.,v..T...4.....td.r&>.S.._7..#e....Q......|TZ.d..1.L...ZK.F.[J.K....KX`.P..n..u.l..i..........v..P.....O...5......V=|A.g1...e{.X.....9....[.......RO....A..`..c..g...l(4:..P@$..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\opyt6rz.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37280
                                      Entropy (8bit):7.995211657867898
                                      Encrypted:true
                                      SSDEEP:768:iszztI4Wr14cM5YvIR0h9Pebv6SL0lJqBrs8uT2KW6w85IFkFtVyEZ9MupZ:iczs14cZJh9GzdLaEO8CS1EIFapZ
                                      MD5:3AE9F23629F16DF5676FF8EA62CEB111
                                      SHA1:B9EF5D9FFE816EC004E0A80E043C7567882E2A96
                                      SHA-256:C8670A8CE73691321BCCAB667F6F9A474A1012EDE4CE57EE018C77CF6775D28D
                                      SHA-512:EF2964F26E4A8362204ACEECBD4A6F3580C8B3253B5FF5A125B964ECAF10E545A5C826F12D7D65198A8D263BC98EF5353D28C60080C32EE0A19B94B75E2C0DFE
                                      Malicious:true
                                      Preview:..e.6;.M..3.....&.....k...}.t.v&....pO.15....X...^...f..I.."..>/_..x..~.X[4......g6.....c.._..>........yt.&.jL....SOU.9.:..h...=....f..Qo1..-...c.$g..n0..f.c.. WP[f......f.C.T.X.#.}x.../.....E(..SN?d&...w...[,......u=.t...T...t...b..8~..5OS...!;..F..y~..W.....\>%WV..F.)N=A.M..i...y.Ra...ZJ.S.{.]c.R.X.._..a./....5zn..m......_..S...\.....0...%e.ga8.t)..,y.....-......iM......Y..-.N.....;.....Z...*..}.c.uVe........}Y]._.^.XtA........nW.z...k.....c{.`1.V<.>E...Y.i.Rx&Y*.c<?.z-.b]...[$.P.q_.h.R...=l.P....f.L..<_m.D.2 ....%..........W0._2v.Sx..E.D|.G...!..../...+J.Q..3<Q....jI..k.e.v.'..v..4H7...zn.+.x.dP.!;.'p..P.'sx..A+=.U.B.k...."..>#?...d..;.%.f..i......X=7i....~>._Pd......6.~.|t!N.....3.5.`..g_.gE.G.....T_.....Y...N..#..48....#..O.U|.O...B4_.o...X....L.b....2...!..QIz.......i.|....m...+...N~&...[...7..EI..I..0.#....T^.....q#^.......?U)..;(f....-s.....NZ..N_.kO...].Zl.>...`R.5.psO...1uy...H...t.5.M...>[..H.....k...Y_P...r.t...`.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\ozHCh9b.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37258
                                      Entropy (8bit):7.994802774956151
                                      Encrypted:true
                                      SSDEEP:768:TEAhYUe3diPCVJsCcUWzitmWIrT19DcbYY2gUOwn/:rYFkKJu2bS19Dspmn/
                                      MD5:944C9FF0A6F822DFAF6E228BCB647012
                                      SHA1:FF7C0499EE70E8C9870DB811E0F7A2D578D536FE
                                      SHA-256:A35CB7B5F92A22C13D8CBBAF10C6A165F59F573B0790E32BFDF9925CD97282AD
                                      SHA-512:626D4926A3142DC4590CED4BC25798721CF71CBF0E75D32B48FDC620C8563312A1CF36189F3B36A23F3D8E92E553D5350D2A8A4CAD03FD4202E7036FDCC27DC5
                                      Malicious:true
                                      Preview:+SD.kMw9...Y...2..^...S.( 3....,p.......cV...!K..+.....9lvX.........X.V2A..@..p^.>n.....:........&....,.........{..G..i..s..{..t9o..EQ....|.......X-zI......b.[....Ym...s%...<.!..i.z\..G%Qo.lB...35...YA'...\... ...Z.L.Au..#...@2g1.NRAp|.._E..m....v..z5..Z'{.U.^..].y\..>_R.....n+@'X.LW....=......-.w....F.;..\..l..!..X.....v....)....O..,...a@...|X0.I\....m....%...)..L^.....x...Az....Y.?4....v.T."......A..X.bXp..]..-..j.....4IcJA.....j....$...y..b.&."...y^..;.pL=.J.O......w....I...4.#....h.J<....p.....?.Dq..g...[.<.T..*in.`.1.lxK.0.(.b.....wS...5.Wpz.."..#.\.....I...[K..L.+....=..U:.g56.5.R.!tX...<M.o..^.16.)......./...A.> .m95.(-`.F....<7..:..n........g.!Ev.]e.H`..B,VR..c..3.Z....l..'.BJ.!..}<.1..?.jv.cV..#..M..].S....x3m-..1....+.aU...q..&.{.H.z...e...V.v.U.o...Fu.R.1..7.Sw.F.....Ch....:.p..I#........Sd.P.F.?..... X....].7..)..Y....~..n.4L....H?........"c."".....f..Q..M...[.\-.F.E...@m.`.$..I).o..%!...%....hWqU..`wN..........

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\pBohiXa.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37327
                                      Entropy (8bit):7.995238390941283
                                      Encrypted:true
                                      SSDEEP:768:9BWNlLNCqdolUdYmgpv6Mv6EePwctUHoXXh9kGQleIa6pim:9BWNlLMVjfPv6EebtUzleDe
                                      MD5:EDD1655D38BAD795CD97794EA1CBF5E8
                                      SHA1:358DA7DA96F299DA67716041E5DCB328319D605B
                                      SHA-256:372DB9AB9CEEF65952147CAC6859EFA40C900C09D3AB228D9762E1E87C01D63A
                                      SHA-512:7520325CC79923A0A43DDC86ABB3D48D938B008E9105B63E71E72A7042D83C384A86CE844C937B130E25FA42D1631ACF5019AFEB040C7C111D84BB0B711DBB78
                                      Malicious:true
                                      Preview:.%...Yws..."....:...>Mm3..c..8<i.f..>.`#.o}..NbJ......V_.{i..%-t{N..A.FA...$..X.V..Ec.....V....B......O...\.g...i.!.|.=..3.R....`FV|.0.....C..~;.]h..!..G........;S..y-...?9..3!....I.8....W.k....v.FkR..v.a..5.Z...q......l.e......b...>mg.!.B.6....I$s.(...=..B 25 ..~3..S+rC-y...Q6...C+<..(.....y3..?...DE__.\..#......6...~B5. ........lv++`..#MyG.I..nl...S>...p{...]<wB_...\...l7e_k.....7.."...........#.......Ojv4.?.0..p.......&.N.T...\...,V,.k....7..h....}dm..Gxe...S.L..X.~. .._G..,n..y..w....... y...!.3...+%}3.....Z4.fbS.u@. m..8U<.....'... .)1h...s..Qn{...[..(..).Sz.|.!...\....u.g.*4.GY.@.,O..}..XoU......t.y.....G..,=..$b9.~=.......b .....E......8.fwxAa..m.Q..zA.d...T.N....7Q.....(.l^.;..>m......V4b...?.G'.nPdu...J.J....'3.uD..*l...o...F.)..2..-s&..{.......au../v-.8..4..!.M.^h.:...c(...m.......$....6...C }h...4;...,.RBea.@:.[K].....z.U.w@..g.T...H&G....z..%!....[..Oj..u|rGQ...D3..\`.~v&.y.`s...c...whp......k.U..../W...>!.F.-*...lc,4S.hQ_.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\qdyGCZG.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8196
                                      Entropy (8bit):7.9775703185577385
                                      Encrypted:false
                                      SSDEEP:192:yjKc3SZc6A7GyEwukh5P11VIGXC9UUdP9AwId+GB/EXv/t:yhSZOayCklI6Cqu9AwBo/E9
                                      MD5:9756B6301A60215BE53BD4B0EC1116B9
                                      SHA1:B8B22663ED596843FD3CE3BF8AED68CA84D23562
                                      SHA-256:86B4F3C943FD0D62D90A26CE3576BD20E36D5125E08F5601881F3B6BC70FE6E4
                                      SHA-512:4BC3AF876D2F03661225DD8D5964D4A134AE77F31D6A8E41AF89A0F87842CFD40C9C223A077103A154C93BA65D684A20AD58A0C4D2A49F8AA72EB76F65963998
                                      Malicious:false
                                      Preview:...B._.6...v.<.D......$.......?.....E-S!.=U....[h.a.;....w....Pn.~....1b{...)\..NX........F.q(.a..H..:.........Lr_z..H."....g6....)BA.Gj..J..S.d...LE"p..F...F..C.i...S.J.{.a.@e9.t..7.O.....Vs..B....V...>..tu.&..<....../...=..AoT..0F `.-.Dt....Q ......-{..5.RTB.J.u.......'...U....LZ*..+3....r..l..."L...+..Y..3|...MCm.:`..nT...J...oo.4.v..'.O.;......!.......1}.4..#.cv.%'c X..>F..M.@..<S..`.Z..Wee.........~..G........H.....s../...%.c|lY]..j...\f..i.d#.qv.p..M.5o.........[.~.......g..^.....d^.v..p#......9.\.ch.{/.N..zx.h.Wf..j.o./R...G.u;.-f9.nF.T....b~d.<.."i......q....cs..P./.)1.c.,$.(....:.#Yk.T..yF...[.....[....3...F.0..j.`L..%..>.....uC..C..,.Q.S..d......a.C..j....J.E..*.r.<.S.k.V5.e.".i].aA..'..R..E\.U..&..(..7E$..E.$..f5...A_.....L).B/.................'.mm.n6..cf."1......v...G..Z.B...q..i.C.......X.._..&.7(%.>BO..U....x.h.kC..|Cr|.?G;.P.rxj...v.....ij.x.ops.J...g.......].....'......l}V..A.oW...k..#..[.......e......U.X.....M;.tj...w...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\rAyhZg8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8170
                                      Entropy (8bit):7.978696331374636
                                      Encrypted:false
                                      SSDEEP:192:g+mY54zL8Mhw+SqBYiFEnFOhZ0YhbOKqL3ZvwoL/6sCAJ0P5:g/Ac3NBinFOw436woLCXx
                                      MD5:57909E6C71644554B9848BC243B2C0C8
                                      SHA1:C3F54246CD9DC325FE04EAEBCD2E35FA0F1B189F
                                      SHA-256:8C3FFAE4BD257E1433A3512B98F5F776C6EDCECFD17543E3D17DD03E963E4327
                                      SHA-512:AA10AEA10C83006D731CBB2641DFDE2A605ABCAB8820460DB26655966BCA19043442809009C3A1E3B42C5A2D6FC33084EE5B62769D119A529CDCAFA78D0B2010
                                      Malicious:false
                                      Preview:....PygHf...tq...9A....l :...~#.c.....L..I..o.~.V...{......c....j.MS5.wy5.9.Ek......j.}~ ...Z..(!i..;...>.I.o2..^....+..j..8.-...e1t.@Q.W..&.....h.......Fz..0yb.._YQl.6.w2d...X.r.k.m\.......F..N.8...).....Q.F?{I'..%.\..|c8&?...G*.V.+.e......BHPd......|.vO".........`^.3..*.9g.....Na..V..g.^..y..K....+=.S.P..M...H...c....wl.b..c(.........'..l.#.......U=G.v.=~.~.E...C..'.L...<....0...v+v..i.b....lU..{.....kx.1.....TY.......s.G/8.{.'..... .......Ea%.....o........k'.1c..N...g..RK\=.5..=y..[t.U..3.5..6.|..........d...G..N.i|!..B.^p.G.GF...q.W....".k...iZ.,.... x/.:.~._...:.^-......,)B<.>.0....K..t..V...R..8...e.`q...71Pw.Q%..mF........b...`".?m........T.*.....$."/.YG..l..y;.c...s.'.V..........|.pH../.E..Rf.8J@.$..W7.}..@Qn.......F..f...s...$yf.....q....f.bU... .%.p.....;.g}.3JY..>A{.f.o.9 F:+..T....jM....B..?....)m..QVN/..[@"%.o...0...9f...?m...q...&B\.h.......x7{......_.._c?......_X....>.m.".=+Ebn.IB.U%....._...QP.....l..}#<.)..e.....y..y..w

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\rBH5oIw.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8170
                                      Entropy (8bit):7.980016052785014
                                      Encrypted:false
                                      SSDEEP:192:g/q7tGuWhFMq2710bxliQ4JLh8mu9QwAjzORWUCoK:gS7VWhTHxkQYl2/+Hd
                                      MD5:B08617B9640BC26FD9A605BB027C9F7B
                                      SHA1:918C8C1766D3EA80DDB57AE2B4CE67EB88F30D1B
                                      SHA-256:13D62CC501335AD02363AC72574A4CF5D3E529D4D2C1B4DF91C05F6D81C52F21
                                      SHA-512:43A2AE1A5E4FF8E4C7E324E98A66A308B46E724BAB8124520D13B7ADC93D3E484AE917788D29C513CFD239426F62CB74EC4127A37605CC21AA9EC5ED722AC097
                                      Malicious:false
                                      Preview:2..y.*.'}=...}.R.~>..G.....#.../.........o.].-.S.6.w.dx...QA.I.;..?.....'..op..... .H..b......"..@..L......|..A..x......_n... w...&[V....h...p./h..E.&...hN...b.c.@J...."..Q]....6m.@.Z......|..;...=....csMcb.hL#..L.....Tkl.\.EC.=..r...o..V........!..C.7OX.5F...L...".h].~28c.(z.J.V.@..R#J.5.s?..5H.}....)..B.........*..,....|..r..N...p.-+...V..?,M ..#...d..I.;PjY....r.\L.O...I_..!,.we~v.2'.O....T..`A....}8.S.4.....d.x.)..~kq.e.Y...>.8......./.t.8.L.w.....+..3..W...8. .C.\N...=...}.%.).(.p..CQn._...PddsrI.]...P?z........<.O...c..'.+~..S..>4.<...Oo.....e.....g..xuX..6k.m..D..s....9.L...Nk.=..A.......T..n6RI..#.<."@.7..7..$.B.L.n.[6V...Wbd1e......%A..dk..b.L....'nJ.... A8...o'.@.a..-.,R....).0.A.../.5....:...s.h.[x......r.../.......]6.HIM.{j........r.Q..,...Zz..jcaT.....d..M......L....x.29HC...;..N.E..C..d.Gx.s.> _....K...D.2.aD.%..h.8z.q.n....3...P.r*..R.r.....D.....9..c.A.e.s.6f0]......w"T$.....z...0.i`..........`s$.10.V.Q....P.....Q.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\rZjTVQS.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37245
                                      Entropy (8bit):7.995479148076788
                                      Encrypted:true
                                      SSDEEP:768:VQCKnuiND2pwgk3d797cLiCZzbRRPYobqny90la5Savf6gCW:VQCKnu4u+Z9YLiCZbYQPdag5
                                      MD5:36B9ECD1C40ACD550C8B3CD0DE25424C
                                      SHA1:ADF0F6E46C202C0F24687C81828D0BF0258BED8A
                                      SHA-256:B95B578198AB7C898C5C8F6574B91E92478888DFC7EFE84E2B2ADBEFB3FC2858
                                      SHA-512:01009E4955854FDFF128587884F41E7465F293343D0EF3618AF0B554758D1A30BAEBC25712C7551347B34EFA79B32C67742BD32AACF31A96D6360DFAD33AD406
                                      Malicious:true
                                      Preview:..D.#P.Y...2..@..\....3].=.n..C.._...l7...%..........|.t......ZXg....m.RU....I.7....p.6...W..(`.~=..o_.#=!.RT.O>.,..Sw.-(+]Q..JW...B..P.o.R.y..Y..,J..?..l.*.......I...,...`..K.B. .>..z...r...:#.xy^.S..&...7wd../..0.}.e..,....>CPhwi.....X.DJ|.x..g]F.'h7m.:......`....bvl...T....E......5K'......z..2vQ....0.?.V.....I...[O).U..P...P...i.v},.x..E=...6.nY.H.W.J......P-.M.J+lD..6.9.u.<.<=9.V...vm.@*....R.....e...B.j.a......=^i.DY...../........N7...Yz..GV.W....].H....~.z..{..O.+.q..../..z.+.| ut...M'..x.u'.S......#**...Z...f.EA\j.[...................[....4..C..G..9..aG.h7..i..B.(|r.1....Q]1..6.xN.x@}.,......p......r..Y...{...K.oB.+..E[.?..0. .)...Q....;.......?..'!........g..6.....uL"..6....B..V...\|Q..<^6=..S.|..k.aJ..B?.... ....)......0.~..L.......gN.......2.0|}J\......v...j...$o..<..VN....n?....{.....(R..&.....t~br/J..+..22fl."..T....l(@.bkh7..A....\.-X.....iu.ho.w..\...0..........9?.\L}.a....m5p...e~.(A....p<OQ..Z....7[.Q...FJ.;..(....v.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\sex6yk8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37325
                                      Entropy (8bit):7.995069544512666
                                      Encrypted:true
                                      SSDEEP:768:NuFj+K1+i3tUyvgbkeVXu47ox0tTkp+WCZ:NuFjCidUyvHeluP09kp+JZ
                                      MD5:A28112E548B3EED23D1D369557C7619A
                                      SHA1:8E7E96E9F3663B7D0FFDF9EDA204E2CC74470F2A
                                      SHA-256:013678EF5A77F40893869EAB4212D43E14DAB529D4BAFA52C0E0EF9E6B4DB9F1
                                      SHA-512:04C98862638A51DFB5B4A0FC77D574788688569176C21C9B29B0B8F414F28271FA92F3D5718051D18AED8A7AC0790AECE494F9E5C149D8393A34347DA0A0C6F5
                                      Malicious:true
                                      Preview:...3....`k.6.MTQ~<...v..9..CNX..4....y.I..1.X-.....V...p..'3.}6.g74.E.O+..+.S.}.(....H..d..E.%.dJ?8jj.j..4......ri1.l.q.....*....Ao..9!Z.......V.....w.+.L..(.{...w=.84L...pFf.....Ug..tj..}..d........s.v.../..&;icG$..U.T.."_gy...<.Q..7...)..!-..f.6E..;T.Pc.."....L..2.;[...6.....o... p.W.Ud....^."d.H.+g-.(<}.@..~..W...?.(................v.\V.43!...".....@....`.L.y....iq..l..H..$.Y.....>T.~.0&K...77%..$....sZ..k..t......".Md....O.cq.....,.O.........J..c..}..TeO..{G/..=c...l..q.....e.J..5....lJn..3.......4..|...y..+...=nV.. ...U1..0.A..c..-....3Q.^.b..Y.Y7.6.......l.....T..\Pu $p|W.\=.7.)....*....~L^./.)c..@.v.B...{.V...K7K..UX+5U..@.T;i... Yk.E.......E..~.{.V....1........x.S.B..).....D.o..Q.U...X..s..k?..@..6{C{. .BfCV..1..;0A..L.rS..@z..J......O.2L........U.E%Q...Z......;T.zn.....h%.2p/K.z.;....2.B-.......<..Ycd.|.......{.......|.-...a....P......j...Kp.7.........."M..Qs.4..3.....T.&.Y..p..x.X..>..g$.A........>.P.].+I$.| ......h.....S..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\swK1I7z.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37309
                                      Entropy (8bit):7.995236755739886
                                      Encrypted:true
                                      SSDEEP:768:nSqGXwG/cFhtMs4ZV8lsX40kdSmPr2VW+dUgdPWKWpljdHRNSh0/HXuK:S3V/yWs4VnayWjgQp7HNXuK
                                      MD5:6B54647E45DD2399973BF974B8E82630
                                      SHA1:F100E4EC6EC55DAF7520FF2BD1023C55508F106E
                                      SHA-256:DE889AF3E78BAFBB9B81EE5C540A74F2333B489BA0C405728FBD41067C4F9473
                                      SHA-512:DDE4FE4DCFFE25D2594EBA54921BAA8F5E15AC6DA164F416D7A513A90F4F0986A6EABAD649BC9574F6A3BBA37EA9512F1C16C9E03238F27CD52D9FB416AA0B91
                                      Malicious:true
                                      Preview:=..|...F.....Ji...$u.o......tc.1.|6mf.Or..U...........}.;...;y..H..(.F.3I.."..qq...K3;.^....>..........Pa..p.X_|..<.'..z...."..d.X8.'F.o..Y.....F..U."...h.>..;$..y.F...R'.O....$.c.9.Ya)...Ld..^.....h.B...>.r.....*.$.&.V.q.....x.f.U.VH.^u....2..1.X.d.{.o<....~~.7....S...Oh.}n..........2..J...:V...R.b..C.}.1.i.}.$...l....d.d..........Z}......D.;A..E.J`v^..(..NZF...j.M....n8h......L.9.l....NC.Q...:J../I..21..H3d.1..|.=...(.r.$...$../m...Fa...C~z...y.v.A........}.r...xtJ.k....B...b..;..1=..............j...%.>o.zL*.T.P./.......6>}!.X...*.~.)...$+6.Z.[4...!.<..am.=...H..P..$%.M......Fl..A.R.P..H...Bh.8.C.,l...2v>0.8.m...v..t....AI.A}.e.)@O.....)...5.rCD.w.Q..f`X.#.]...G...v..`].D2[<..?...............|.t....'1b$.c.>..\.B`.......S.|...D.......x{..c.....X8...%...!.D...!....#.....Z,.9....8.Y...mh]*.H|z3.<...H=...Y..Un|O...{...h...#{..K.......p.@....,A...+7%<....A...@CD.p0$}t"[.F...}zQ......@&..a^..h.....V...vH..43.8.qF....p.4B.1...2.h...|R3.c.@kq..E

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\t4YyvCS.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8170
                                      Entropy (8bit):7.97307334286005
                                      Encrypted:false
                                      SSDEEP:192:duBOzWGkhLsKp44RRSYhj9BFhOk8u4QjkBdl8PKkgi3:C3B5suDR3P4tBnj+3
                                      MD5:EF248F4762E39795657F22E4D1D00713
                                      SHA1:582D89C871267062525A968D2BA804E6DA7C1229
                                      SHA-256:989CCB625C073D118CD5C4B849930756147699C88616E260F7A93DA2B12926F0
                                      SHA-512:399C03ADC29538F3DB37B5AE4AB3CF7302F2C05CD4FC7BCC827E5CD14590351DD1A03DE341B7B697DCDEC898A65F7F4B94C8E2E73689D05472356C1194E6DB7A
                                      Malicious:false
                                      Preview:.xOP.%.i.%....(0'...a.......=..uk.Q......._O~.9..N.S}.J.Z..Vh..C......cI.H/.@...X>.).}..4...[V.0.8......U.......)....Y`,..fx9..B.<.jn.'...aa.A?.M-.`.#..{U.>.7.......e.u...%.:MQ.....I.>......U.8Ou.#~......,.=..)M...o..v.......iS....>...QA+.`).v.?...J...).`C?W.,.....V.....I.z.6...OP..0....y.W....&..g...3.o..R.~..Fj.(...o[.S...L"......{...l2........*...~....OOp.Q.X.OO..~K.RM..m....T.y9Y..b....K......R...Z.o....z.?..j.Un2.e'.7I..l...e}...<$..d...O.}`........Dal*......;|.....6..q{.r...K...w....%0Q....-xP.k...g...5../.o.iYRK6...V....'.2!...1.....:... ..@.S..A..n......J....'}vB.T...<+SC...;.ZH..l.O.EQ..P...=v.....T.Kc..6...~....y.u..8$`.j......:..L.n.0Xo.] .0:....S....E^.#Q3...;.t.. .fL...[E.....r..Q-.q..X..f..b.bz...Q........j....{..(H#]..O-.0CwE...@\..;S.9(&.JKU..m(../.G.bdJMI.1.o.[..>d3BL.[.|#Q.../....K*Q...#.3...F...V.C...8.X9...M...{.wd...."9...x.lm.D...C..}./..&c.d......m_.R$.9aK".K...Wd.:Z......1.......".-n.-......ifT. 1.d;._....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\tEn9BbN.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37306
                                      Entropy (8bit):7.994579705592296
                                      Encrypted:true
                                      SSDEEP:768:EyFJOetc5bFi/Wj4bISWuc3tfQGMBUFq1fHyQY8pMP:EQC0WjMISnc3tYtBUFSPy3CMP
                                      MD5:16E47503B0A78664F1A1EB5B803F766A
                                      SHA1:E7AD334D751072530E27B9BB2214787030514EEF
                                      SHA-256:6BE71999E407ACB5D7F405268D1072533AD7A15DF81D473120310AEEAEFD38DF
                                      SHA-512:09C002F2D135BF1F101F9352F1F3CA0C6D26A33B998EBEB1E4677213BF045A28A92B4AC2D7292DD244F5805514E7CF3C52BBB97E9C7D0A2C9C286EB68444CCD2
                                      Malicious:true
                                      Preview:.)...8...z.3...ac~(..0....P...s>..u.......%.%...%..;..1......e....8-LO./A.P....qq.[Ld..,.8}c....(.r}.a...BXwQ.p.o%,3T(...$..=,XX.?a....%...;`..IOL,......^UkV.F.".0~[...\"....dS.).<.....,..T....=+)}.$.DC...un]..]o..^.v.BQ...R.._......U`.{..txv.RA...K.....U.-..v<..tM.uS.$.L.y..a..:P...... ........f..{.5...?M..D_..5..i.!.n4...Xc..)..IL...:....gn:.6..^1..+.C.L..x....+....l...n..%3....C7.....?r..Vh...d.k...c}.S.....K.a.;0..P.."6\.J........".P...%.D?.G.g.d.._6..[x..i....a.&..fa.?r!..'.......t.S..2.`NAoh.....P.....b.z..~.z..R.G....3.. .B.....7.{|....."..{^.}..t...^/.6Y...%Zw..h......so=..+?*~.....\.....E......P...s."...q<[.|..J...a....a...35.H..%.%...:......-T....Z.N.L..YH.Z..d....R.>M..A...C...,..w9.m?.Cl....Da..._?.......O....@%.....=...`...P.. D?.ut.O..]..)6.8C.k.&..._...2....fK.'3......+.f.b3o..k..=.\.....qq..Q.x`r.;l..f...._..cW.;..;j..p...4nZC.....#_]......U..pDb}.$.cG&..7N.z..H...,.....x.P.K5...rDh.>..b).P.0o.....U; 0p...C.N...-..]2.,6

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\uOzS8gV.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37300
                                      Entropy (8bit):7.995323075951715
                                      Encrypted:true
                                      SSDEEP:768:QFXGBpE+cIbZsIX7jPqACDO/FugO92WELfGBaPfasFDzt:5u7pQPCk/892WNGfPzt
                                      MD5:AF5C8CC76F043BA6E7C7DF6AAF6EEB49
                                      SHA1:F4FD0412BA12E09B5D5719ED8BB53AD289A99C5F
                                      SHA-256:750F2B4695DA240F193577F46B9BEBDC38B713C7F7A96ECC3E94F36A123C8412
                                      SHA-512:2C37DFA3044DAA8823C371A74E7AF94BE1352C07B262DD2A87F1E723BB2B9FE4BBFDCD46A3B2C662E89350A73F49A452DDB7FE81313C2C58A89AED05D872E650
                                      Malicious:true
                                      Preview:8$.9.T..!...C.V.,\?...:....]...We..48....bA.....^XtMG>.-.B..E....[-{v....-........7..7u...@.`..|j.]...q...$.%.......c...W...R(.".[....x.M...m`"...;..N..v...}n..|.d....G... g.H#`p..>0.3..0KG...$.Q%...#B0zS...3..;.('|.../g.ss.LS....Q.6..Z.......U.84..RUkv.htA..Y.+0.X.%....V....So...W.{.O...q.......-..T.%.JE.2/...v.6...E.._.t..CM{..p.R..wnwi.OR.)...$....W......c.o.s.L..H..|.........!.=?F.\....C.3|.....By.jip.%....z.ZJ.J...]%.....E|6..H.....}.oV..9.A..{..>+V.6..>..[.@.t.].~.......B..R..>.q.>~......B9..-.L...M/.....m...!J.Q0._.z..w..kST.....:..&..^0_gR>C.D.[./........j.C.I7...c.x3...k..o.N>.j;...l{].[.w-...e.%.Q....J.].B..k:....^.fL'....w......f. 8.|e....... e6>]`.!?...f.c.].E.p......+Fn^..... #........}]Ny.......@.N.@..Hh...f.....9..rKyi.e../m`t...&.|...i7j=.U..&..,.Go.is.DJ.U"L2.k........2wG.|.?..4!.h..G..gR.........BX.\...x..Y...W..H...e.<sT./..0.2..Q....9.MO~....zj.{...:................[..m.....jR.5yh.R..2....3G.Y...C.Ga..ww.~._....`I.....+.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\w7iMD8h.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37274
                                      Entropy (8bit):7.995506065148806
                                      Encrypted:true
                                      SSDEEP:768:cJA77c+BsI7NW+lnpbzjJxJZ2F5Jgn+eomcPY5aN/ygSHuagk:c277c+BfhWSpnFIIn+eoRPY5Hgdtk
                                      MD5:14110F6A3C42B1FBBCA9511488A09490
                                      SHA1:AD7D1371928CF1535040BF143A056D23380C749A
                                      SHA-256:BC7F6A072DF953CA842D2AF6751FA4996F48D472608DA20E1F4CF9E3A6D827C1
                                      SHA-512:BFDF0A14C900E0A4964E66BABD820703ACC5F88B7508CACEF80910F3D78C09FE18F1968C432D6A05F4D6BA29A53F7D0887BB32EBF3D31ECB5950CFD3E543B8D5
                                      Malicious:true
                                      Preview:.NN:Zj.l..9.(..$F.!.W.';8."Y XV..|l.Xl..&.Ss|..q..#..?.........H`..I)...CeU-....o...6B..y...]s.Nk...\... ..0W;.F.O.r,.8e.2W...W..(.n.l.9./..@t....E3.b9.K.S.+.U.IS...~z.Q.e...Qy.Q.F..I....>!.O....,P....j)t....j.HD.'(...4.....p.q...@x..A.4d..Jw.(V......`U..Uy.........7...~.6.".r..t..,..`........FU....E....7.......P`..md.U. ).h[P.,:..&.o..o..........1.N+.F...g...x`1.....B..a|X..P.6^......xZ.A...^.@.......K..i.....pH+Y^..~......{.m..a.....bT....4t....*+....n.I1.%Y?...z6.I..9. ..`@...(..Y.\..q.!...iN..XL....UT..4.....VU~..t.s.W..Ob.7.=.|B9.>.......E....DO.?P<;........6.(...S.oL..)lL.@X...+/2...D.'.....t......zl.\|.$q..0{...r5..[..I.1..b....,....H-5.'..... ?.a)...WP..;.,[..N...0..F....8.w2...S....S(-.,...c.......r.].u.K..k......$...:. *...w...].h5.....8.".z.........m&M...|c9h8.7h....qT..)...f.......M.KTIxv...%..Gp.e)6.....U.JW...|.,.. .L.D...X.....j.K.t5.....,.m...f.i..Wo.)8....0L.}w.}. Qn.4..w..EA..<...@..^......R)o...w(.s=.k.....z.'f... x...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\xLRcjBR.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37307
                                      Entropy (8bit):7.995548079684162
                                      Encrypted:true
                                      SSDEEP:768:fHh6O23PUGPC1uT1TT7Uc9M6oUVkJwbnjUaTql3E3TNH1M:fB6O23MmXT1rumbnj92hET0
                                      MD5:3F370B1DD4C743E157B9FF4B4294EC68
                                      SHA1:00D89D93A17F78BC0F3EF1AD1EC5F29C1FAC8ECD
                                      SHA-256:FDD13F622744C2B0618815AB660EBF600276360939B3BB319EDCF57B340128C7
                                      SHA-512:62C4DE5E73818091E4C8AAF0A131670BAC8CC6696546DC57C3A3788BDC1EB3D653FA97ADBEBC1C500C04D9C8125F676A5FA619F2CA0FA2C897DCAB57633D5196
                                      Malicious:true
                                      Preview:....!@...}.B..Q...C.....M..n_.$.l.Ra'L..i.h.:..C.......^+..5.......~..>~c3d(-.G...QD..=.zT.9.)S,Q.:...:..(#........c...........,"...&e.X....k....7....)F].ZU...;...~R.<...4.-.^..X~.,;...aH(..bAHc.....>Lb...F._Udn(.DE..u.m..l...G.C....$B~..`.H.t...g..}....`.F"h....V&b8......A..SD..Z..k.*.;.|C........6q.\....E..A.N...'..dao.X0..D....k<z.W...W...(7M..TN>~..*.'`.."#.....c.eU .B.AK...Y..M...{...N...y.E..3Q,C.:.d.a.b.`.%...b....6@'\.Da.E.[..%.Hb.l.M^<.~..K.3..Je.R.|.'K..yP...ZQ..e....n....3......$...e.x....(.i..y5:.p..n.X.).......%.Z.{bj.+M-..%..B...aREF..}..8..O....@."7h.Bh...X.......K.!..e...........*.B#@&.q`./s.n`...;....*.|".>.!s....-.av.k..K....@...>...V.Lq.......A[|.+.x.xk....^....-,.. Y.......~......x_.1..=...|3.8@?p.?.0..O.eu.j...h.de.r...x7.2.k...[.$......p.A{}J..@........+.q.a....J.E.)...o$."...j1..xE?n...n....%..%ne.|...XC.).B0.0to...,.a...v....M...>D...~.........,v.v.....s.E...u..Y+]....^.O....3{...WK.....44V..S;bq....=48...`/.....9T......@

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\y56issZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37277
                                      Entropy (8bit):7.9945039527286825
                                      Encrypted:true
                                      SSDEEP:768:J/G1L+W3UYA0eaZFuWLXGmGbbY1NLA7I9e6sNv2l/wPQPBL4emN6:NEr360pZU+PGI1NLCYeJh2l/HPBLK6
                                      MD5:C50D82F95E552D7835B3335885315DBA
                                      SHA1:C6CB3F452864581AB1BABEA23E72D6A3CCD6AD36
                                      SHA-256:818257B18F70328DE75B256037C00B91339D142D99365E1BAB36B99CE3C82A76
                                      SHA-512:8489BD1D315844F706A1CA852531F33F7C2F4AF1E162360F1322B1074C6F33718874E0D72B09C9984609FD0C0CC91D6A89C4E8F900637CB6FF109DB368B020F9
                                      Malicious:true
                                      Preview:}I..H..I.Pr[OW..v.U.T.9T+d.I.z..(U..gB....?.....&..5...,V...:5G...N.....f.1.g .....H.m.\..2@.u.#d]E~.~.K.C...H....v.{\r@.g.....=.G.:..oY..m].I.l.#......lxz....u...iWoQj.P.....32..|.78v%.9.l........d......P8>/...J:.n...y.t.!...^[{.a..p....'mD9..]...u.s@....j..e...>.u.d...T....oi..@.R)dY.g{s;..o'G}H.C-\..CU.p.9U.{....s.\$.M..3l....nGi..i..\7.n.D..X;..=.....X..Q.f...GE.T....W.O. J.....yz).sI.:.+....(...s...-....\?;.'[...y8.h'.J..uh.p. .0w...GY...`*..Z.d..{...4.O...5...;v..p\?t.....7E.w.......(..`.c..f.D...@./.6.!....O^...d..jw......;.)SD.n.H@}.....+.s..........9...8m.w.*^.b.>g.d..aNQ...yI. .{.V%.P.+".......83.b....] Gxc....=...@.......*p[:+A.b.~.3..8....m..I.x..3}U..t.6`..H.......,...n.w`.7.....Q.|MX%..j..........#.SH.9....H..T...Qv.K.pg...&..1A.JC....J..m....n./........Tg......u..U....H4.U.Xf;a..4.7..:M...?{c`&Cl.!b./Nl8.q..O.S5.\BIR..tuS.?Yk.Prs5...!.=.....e..Y).~@p..'.~.7.X_^...8..Uo..A..e...#.J".B....,....X:..v:..kG#...*#[.......k.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\yA2eyTn.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:PGP Secret Sub-key -
                                      Category:dropped
                                      Size (bytes):37285
                                      Entropy (8bit):7.99387227088445
                                      Encrypted:true
                                      SSDEEP:768:1WIKb35pkzk/25HR+Tj8CsbYcalQDXgNvDuv09AGE:1WIvQ/iK8C1cUO6DG9
                                      MD5:BB902076064C6610CCEBB7D37905AB3D
                                      SHA1:4356D9D434DFCE3EA13B7701F446A0154F79AD51
                                      SHA-256:C6A55C312441F07011037D6477BCECB002C32144218488587CEA1D91346A5B04
                                      SHA-512:19A4B64F56A985B97A58C38946EA8951D9812A5D7F9149B176A920BC0A059A01246E729A7BB31D8E081FB5E5CAFA164AF6A59C46462E6B3CF24A3152C7BD2A4D
                                      Malicious:true
                                      Preview:.W...fj..)LA:..L..o...?.JV..C.....[...f..64.,....]..0....4Me.8...?Q........kd.o.............s.\$Q.4..u.<..............g?z....Mt.M.^. .zF6.fy>.....^U.uw..n.n.C..E....[.9(.4^.......X2.."..\.6...f..j.......n..Ph!....7.p...Q..x.@t.V...p)A.1...T.E........$J.\..........j.?....}..e.;.@.e9..*......Xw.-..P4.ev...O.7.G.|c..\P.J.9.|.o..o..z.*.)..o|c...x/.(...!.xz.DWnh.CP......z.u.|.......I6..a.]...]........].....>....2Z%...@.0#........S.....HY..../S_n...J:....gR.....>.gS..]..A..!*+.V....R.6.|..'^..l..h..V{....o....<.....s..7...s.,.&.54}.Ey.W00....e1..3"......n6kXp3r.F...Q.....a.w.>k..|l..Ed..(.uI.......{Ps...W..2....=...&..}..;....}..7...o.w+.+.398.@t.)..EK+....2.l..A.K..+....].x..m9.....a...7y........... ..!..Q...2..$5Rda.....\....6.b?...1....H.)L.bV~e..D|..S.....#c)..J=y..V.h%..e[Y....d. ..........T.<..Z.v....^6iyt...!.qk..xDTYn.5H.)....C$.>.-..1...2\...F3z_..2L!.Y..>+.C.C....|..A..(Y..MJ8......y]o/Ma....k.I..";9....5.16]d.&.3.v....x".lm.....t.....

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\yuzXwmq.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37293
                                      Entropy (8bit):7.995118527824674
                                      Encrypted:true
                                      SSDEEP:768:1Pdf3uruv1sLhMK/tfn/fwW462WAbWvHnlr3bXzvv3v3tfFGd:1Pdf39FK/pn/ZZdBrDv/vU
                                      MD5:1269B89CE03263A156ADD81219B7722F
                                      SHA1:E86468ACB776E59A823251D1934FE118888412C2
                                      SHA-256:9DA856D3ADF8BEAAA9B34FF90889FC3D708E2487D4FEFFFF7F1B07C81AFC0E80
                                      SHA-512:185AE240EA1D7AD8EB686118D8B6F3342A3DD78DAB78D6102C87DF5218D8814CC7712491DDBEA3DACD9E9C7AA82A41F2171A8F2211AB2CB972E8898C44244126
                                      Malicious:true
                                      Preview:2.JVYD&....{r.....]...GX1.^.s..J8.7d.s.|";..A.+"..."...#..g.g....N.......2.IM......2@O;.\r(k.K=....V.....Q......*......s.......q.Dp.....g1......cn+...........j.Bz..Eo..H.oR]'...p..oW....G.x._..N.H..N.....F86..Q..s..".g..N:4.{....o.!m....).s.EP'......G...........0T.....;..nr.F.I.0.j_..B.T..95}FZz...3B....L.....1<...w.2..o........Z^_.....)....../Y.{............l....U..."jy.....k._Aj.}tD._b.:F...S.t......N.O|.*}w'...1Z.CwG.x...R.*@..nW..|.....\E.....y3....'K.O...i.0gR.D.n1.M.A....*.Ox.lc.[..r..=..0E-XWv.i).C....'lJ..}T....I ."..6b+.N...&.r......Y.t.....(...C*...............|....C.d..n6..=...Xq6.,..W..)X...fQx.r.*.l..R.@...T!.............t........]....:...I....&9A........}..q.pX.......(.....v......M..pqa.1..>.....Q..gYZ...1....G;=........|..o.....>.Y_.N....c.......E.aqz.....j...~..Z..yG.q.........[.Q.lh{)......I. .......N.u$.cG....U.......@p..P,.#"zW\.3.j.m..[X..n,.s......"0...cwXV....\z5I!.......HtLr.k......h.B..t.00Q.P......._.E.~[L..'.r.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\cGhUszP.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.978753723533733
                                      Encrypted:false
                                      SSDEEP:192:/aqpj87krfJvOLR+RyI4AVN41mEAjMbhnNaC8j8UAo:/aqpj87k70LARyrAzIMMzY8Po
                                      MD5:58CE4F025E5CA5993481F57044DBCA53
                                      SHA1:F0F28B44A9BF276CE9680A9D5AE27BAA8245C6B0
                                      SHA-256:8E2C429440F78A0457C76D589FDAF52023427C380F714478F0AA7FFE8C1C1004
                                      SHA-512:7C20D3C2C4A9E1BF75D1824E57B2E1E8D23751833F4C26D28BA93E59BC6F9D657FAFA5CC55CEE8C4D5224AFAA11390A58048B4FBBD312740085E9027EFA571A0
                                      Malicious:false
                                      Preview:a..R.C.|.f.cg^W.=..Lqwf.._...f.....BM@...O....J.\....!...&.._..tu0.\....|.'.8.g...S.a.au$.k.[.....1..h..xL.RI._0..[m..T.`..(.*...~.0..'.\.....U.hG....s^?6.U......R...S......./p........&..+qL=Z.I .6.q8.......%D-....#.A_V'.Xr....swe..d.Gm.C%4.Hp;.,(0.#]W....y.Z..z.F.C.|...(2.F.k..[.-.o.U.8.1......................<0..<.U....2...PT....5.%F...p...%$.,)~Z#D.g.."J@U"O..du?..ri....Q..x.._u....l."..FZ $...tS{QE._..P.<}............Kr.).>..g.0G...u7...l1....C..j%.0.]./.Sa&......4.O...W....;l.F..8.u.[.S..w;.n:.h.....A.(.~......s..&.. .3...QIm...!.A...?..c...'@]..}.....*H.+K....w...6.X...N...2..Xi..d.?..@z!..}........'y....8.y.#u....)ia&..yg3e*8e3W^..Fz(..B@YNK.l......f..w0......r...n..N:.<.A.f.L6.....PUTQ...+......T.yxJ....p[..M.8@+...-eD..).iC:..dA)P...Xb....n.V+.pK...$5.....E..s...JJw.ta..D..4.[N?B?......)cJ....x..L].t.>...fN.bo....8.". ]..I.5..Ni.sU....../K.Z}.mgB.QG...pb1s|...r.^..*P.g...d#..9-].tq.=...~.U..p... d.....m;...q...@.|..u<g.i.j.{$z..8.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\jPvuCyj.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.976149276205004
                                      Encrypted:false
                                      SSDEEP:192:t7s87jRfiWQIuYbmlJDFenxvWQ6HTHdfpJDiCh:t7s8JaSSKX29iCh
                                      MD5:81052943A6C873EDA6B906A1FE065132
                                      SHA1:EE84EE5BF379C9A8BB3DA618F6E8B832948F377F
                                      SHA-256:395A9FF10CAC9C29EB5DF3C894EA62EB7763AE032218AB18CAB43CF16B830DA1
                                      SHA-512:D754A65FE1183C7686CF7FF3B95C46348616480B11E58C3840D1FAD81D068669D4C8436420A408617235B20EA9D9C7700A4988D2B7E40D7B989682BB6A4AC86C
                                      Malicious:false
                                      Preview:'..`S..8........]i.).......Y........~0p.{.T(...%..xS.OB_..R...t..w..R.7.t..Y..%..5.E....U......z.&.U`..-..?....v...n.9........~.EhR o..Zw.O.R..|.)..]\...m....`23.p.....y$...C.N.......y76.pT..J...1 <O.....W..(.kDe~?p.....G.)..J..*b`l./].d.ld.v;....).y..Py.p.#.3.M.ao;..1'.!".*..VF..%.K.@E....O..|P.V..$.9.....F.Y..e^.V#y.l.u.q..J.).X}.,...x.B.y.....{.g...!]...?^A......~9.MZ~LT...0A..6(wT.M1.8..W.,0E.C&..dCU.[..=n.)s>'..q.).F.u..6}....+...8....$............9.C.Mb....%..[..'.....LU.5.^...;......i..'M.i.$..s'4/]Yk7'.J..<~..~.........h.Y....S.....Z...w.Q.t..B....2.........z...f.}..Z..'Z.kK..5.>8....z1.q..I.L.3U|...M_...0...f.Cp..]5.'...;[......@?..=6.A.g.....4.7!...-l,..B{2v9...R&..:...0....}.Ea.$.#*..,.M....vp..kz0...x6.7H(.E.9..f_T......;}LT..h-.+=(....1....:...U.I.;.R...P./.......{.+...uE~..:...kO..XT........v.08k.?...b."...I...c....."...`.e...i..}.z..Iqn0.z.v..({!3.VL[kJ........A......*..+..%6.;-......N.nY.4<.....`}t.2{.8.<U./.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\v1cNwPK.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.975706423663083
                                      Encrypted:false
                                      SSDEEP:192:RVMzulUufkHAe8yBKJ6fPuYjzx1oxiQ9OVOY:0zqcgetB9PuWx+OkY
                                      MD5:789CE288F69BA2C2F13CBF5995031BE4
                                      SHA1:F49D8028F367F0F5F86788A4D099799A010C1F09
                                      SHA-256:4129BED86EE7FBBE2D1D7D277E9EA1F140DA481B69D29D53EF7E61CE4B9757EB
                                      SHA-512:4CA0332C1FCB2940438373DAFEBCBE8D15FF72F5B77ADAE5F56B035AF96D7BCD222D014CC7BA0EA4137D29847E9BDEE0F9259A735CE096ADFBEE6CDFA103010F
                                      Malicious:false
                                      Preview:.M~Y.23......Z..._y.=P7.^.4...GA>....}.f+p..=..cX^.."N.W+|Gx&..t.)...f....P.}...D..c./.....A.~..x.<.d.u.._..A.s.q..p..5.i.fm.?.3..6L.<6.mJk%...!r.U..0.:.....ba..2d.....T.+7..!I.q.s.....Q.-.d.....ORvaD....L..D...l......d..*...UIiB..}.....:v..$.._..P...U...D.`.....q..U.y~.p.lO`.Hl.@U..>8cU+#.;.B(......j..b..Yw....:...NvT..u..~.q.8.W.7....."...L,..u...X.#)..,.C/\!f.Q.w.ctCl..00...1.....#K2..N4.V2.e......|...g....ks..s..>..J.......j...8._.n..[......J.r(..<....b`.{.Z...SBQ..'n..-...y....~.(.9.......ZA..c...7b.|.[u..5.i..t..8...F8h..a&."....7@.......&..f..8...Wz...........'Y..Pu..6.:....{X........r:...}.f...]Z.......|..7..Q_.@._.T.g.h..OK....~).%-...E......y...6....7=...5..^....b..w;...{d....F...^NA=f.2..)...........1gO...y.pN.......^....1.x_Q.*...._.n.....}$T.y.2f3..zIX..F..@.y}.>..S<...sK.+k,Q\X..z/I...4..t.......9..._.....q....CZM2....x.JT#><!...".f..}......n=.`.......3M."...rK..9...T...vaBw7F.:...I./.{.Rx...{.Q[..C....2.m^..c2.9..@.`...E>|

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\OYJwGws.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.978784268114719
                                      Encrypted:false
                                      SSDEEP:192:vYcj1yl1776gvkDZW086+0mIi97PdFHi0PouHgcB:vYi2J7/gQ6oIedFCvSB
                                      MD5:D27A5065C17814702737A89F4C894376
                                      SHA1:D31AC0579BA881CFA548933054AB9BB809E6BE0E
                                      SHA-256:3F9853ECB4F302EEB9216A58C59D8DF2432D9E1B34943048823B8B5619BBCCDC
                                      SHA-512:263FC00EEDA07675CF237207DFB4AAF3342B404108FEC1038C72B64CCECB29551554697F499921A3253062EC53D91852357AE814A12CA2D215FD4DE45A66450E
                                      Malicious:false
                                      Preview:../a.w..d1.......]..1=...U......./.cB....No...= ........(...g5......g..c......Q....;o.+..`.........M..."/..|n.;.m.......l.h2Y..J;~*B.......SVn.N...|.u............38!"..A#S..X.+...~.O#KR.B%7p..@..,.}..p.......UC.?...t.;...).Y..UKL..C.a[.....q`V\.>..-.R.h..............$.G.G.......l.Q(.y..<I.?].V&OK...... ......6...[>E....O....A7.M0`..*..U."..X....J8s.....X.2h$#.f..;a..2d;LZ......p*{..$L.`)#...@e..6`1....@&..1.UWbr>....wyO.._s....a[0~....L......E&...n....V.}.b...15..........R3...5.j2Zo.kW8...>.s_Hl0....E..\..... 7..W.g.z.;..1..h..5.<$&+..*.w......G.}]....L.W..O.4........5.RYpxW...[......[...R9.i..<..E....#..L...euw.2..E.Je..K...Z+.n...'......_........C[.i..ws..."?E.0......f..1.} ..'..)...9]......*..a.I.X.p..Q..Gdo.v.).7x....s..P.nk......8.Z'....2....h...+...-|...:.lz..h..U.@....`<.!...V...MXuc.......=E......[.(.Y....M..:j..H..Tx3.K.L4d..O...>.t..@H5l=...h.....x..(.4..\.|.....BVA...#}O...J...K..vw......V..KY....=.t.b.....%...ae....vf..T.L.+.D.5.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\JErmtkF.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.9800198962979945
                                      Encrypted:false
                                      SSDEEP:192:u+ReIo9fRLN31hfoUR7pHYtlkW+UJpwHtamB0:uwQfRLVVEkWTktB0
                                      MD5:75E526472B6A5FDBCBE7407E3947A82E
                                      SHA1:EA31F51E712911EE392CD928C1F2C241D764ACB6
                                      SHA-256:AA6B69B5AA6475C7AF2ED360C7249D47DC1598C5C2B91F8369F4FE0BAA30BA37
                                      SHA-512:95E03110FABE31C9F06EC00BD60AC839F8185C61E03A6A13147477C5B391E0AAF89980E5B545C2357E694CA8339628E891C50E5D1123BD9C2FCA9ABAE2C88E5F
                                      Malicious:false
                                      Preview:..$."!I....-VOe.M..[3....O..E%...\../.k.;.#>d.>4..Y.....~.%...v....,......(&.......c..QM.....3Q.s....Xy.$....e..D.H3Or...... )(R.._..V..(Ve..5.)..r.[Ix........h.d......=.X.....Z.|30C.ldP.r#.6>^R....N...k....N5.h..h.`G...m........x>o....b&eq_.mW.G..'..s!...Ty.v...PY"g..?..B6k.,.W.?.5..:......!..+...bl].......7.}D..i...%.N..........s3;.Sa.34F.Y*.q,y5B.I.0....k...uh.. =...Qh|......`..-.._'...<..s..64.R;jR.Z.P....... '.J..../.}?..QD.6.U...;[..&;.....?.f.'.../M2......._4JE....+vC{d..u.>..A_B....~^..5&"...6....i..Fm.tHr7.?dv}X...<.sr-..xv.\..........k<j..Y.*....U..z...!p..m.~M7w..N_..i.}*}U-._...0......X.(.+T.Byb.]Cf.vb._.cN\6..........$M..lT..,0..J.!.`.....h.!j"..TYA..l.^.d...W.p....g.......!2..|...#............a3x.3.Gz..w..<...wtM.u.Qa.....Q...m:Pp...@-`.............z.,......./......>~A2U.. ....x.....'.........c*..IK..T...hLg.r>..im..%|L..&._G.4...n2_..x9...4..H...P(.E.h.`..#...../ ....N../.(.......y.+>.3.p..*w&...'f4..!+..}...K..9...?.2..:

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\jhOooXF.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.98050279511079
                                      Encrypted:false
                                      SSDEEP:192:xIbbcUyMxwz9W2Ajs/kLBBgLql/7dWXMZlxpwo/6ZSNOc8QCx3y:xIbAl+L4e5xosxGoSZSNox3y
                                      MD5:8E5B28FD07136DCA2D21718CFDF558E0
                                      SHA1:9390AAAED48AA0AD16913DAE01B43199A4692811
                                      SHA-256:B98F76AAECC1B6940582A0E6AD805B1878F35EEBDAFB3E59EB1B3F537858487C
                                      SHA-512:6D764248AF7046DDF9BB573B6B3EDE799FA5C055D1560F550A9D58275DD429684F5A504B912ED2E79A8C4780BEC963E59113DAFB3F8F9DBBB77DC6F3DF87064D
                                      Malicious:false
                                      Preview:.C...xPx.~[...............$..=.C.....U..Y...ZQ...I$m....Sx@.r....r..FZR......l.@a...jzm.!...t.S>.......k.1..h.=.%{.q..$v...`0..+.mN..zH.._....Z.;.....k<..".g<..........z..@..r..7.{...-=../.h....[~......}k.........au.3..0.._l.X..I&Mu^.?...&m.....E".j...3.n......I....]_..2..d-.s.l..4.:...".V..bS.....D.l#...S.....,2...0Y.bn.X......*Gr.\..8KX.......?..>....$.C....Br..E..C!R.....[.....S.....vk.GB.o.;.k\..6y...].....\.<+p.{.u.^)...P.l...r.\"./2#w....x.d..>...{.>......9....Z.n.Y..L........;..7$.[.J.....*..../..r.!.|]....P..H..V,....~W. V.B9.Q.....O.c......f..9|..eL....F.J....]....Q..6.. ...T.b...z.2b.c|....K.~.a....:!....(..".!&.....B=.7&.s.*.l..@j./u1?y_...QF.6!5..nwx..2..0Y~.....Y....L...[s...}F..z@..G..h.lX.h}...%....2."...4:=../9.s..T.Nh....@.......yTFp.:?.M..<..3.@.X....`...F".....G........{..t.X..........2B...(..._..&......A.R...;..xI1..9R|..pH..2/P.g.yh....wq.s......#.IvZt.}..~3....wC.a......B.2E...D1Cu.W.....)....;.....tzg{F.....'m..n..

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\jMCHOk1.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.981679156218574
                                      Encrypted:false
                                      SSDEEP:192:V5mw4B1SPM3vv+Kiet67sqzmvLs0zdG58s8Nnbqfn0ix:awSxfuDV0VtAn0ix
                                      MD5:8DDB0A0AD64AB742C650A394369926E4
                                      SHA1:C981C08C971273CC2DADC1A9F3A53A0576898E08
                                      SHA-256:78EBF1F2066F3DD49BA026EFA73185821A0F90A98AF381F4AFE2E5C2F3D09BD1
                                      SHA-512:5BC4EF8523FCBBAADB3B5DEADA0C33603BC512BBD57BBFE266CFA66755BED3EA4E1694848C9E5CA86A0EEBB395AFACB77A8B079B782FF3D0B9681B4F65133145
                                      Malicious:false
                                      Preview:.=.q....$.=.Z.*.DP.p.!...[...x..v....BWx.v....VY.......?..Z~`.X_)%.l......*...`,....T!".gu..My.Z/L:..b.O.%..l.....R`..aR..A.O.....f..sx.^h.~.`..MZ...%.1...{2J..."..N.\~...#o......F..f9Eao.X.dc.....Z'r#.}OiF.=.......g.4M..On..Q..(,.&..,IHw..w..B-.RX...7^...G.*.n.yV....e...r.LF.......N.9.$p..' ....b.j^..,..U.....N...U.....n9c......e..FG...Q.t..l........A^.P~X1z.y....aO..rh\...;..6HO..o.i..9*../q..ue+.Z..Rf.i..G..Y.(m..._(..5*..;....)...&..4e......et..3...~..S.4")...@....>..0..d..t..B.=9...<0fx*,...L.8..........&c.[.&..7.g..o....EN.1.8K.Y........-.....w.....G..x1...t.5p..PL.N....A.x..;......b..2R 6j..I*9=MQ..'....EW7...B...U.ahAr......e>.8>.$0...1..(......_._Z.G...u.;.u^.J......i....M..0...."...>.#H.c..mr......(.2.]xk.....D.^.h.E....u2.{./..k.1.....m6._..EU..6qp_..$MG[.o`...k...V<O.l*M.BmQ.....x..$HO.R....<.j..Fw.....N....Z.,..[.k..s..J,..zr-...DH..N..&.......Q.V.g..<..)..W.x..._.....s..B.).s.Fr...,.3.5.}.@...=.9...[.>c;.v.=M..[^..!.;.\.3...d...

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\GzmXhAd.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.976802209873318
                                      Encrypted:false
                                      SSDEEP:192:GlJDIRSvn/9Ze/DPhulaRpLBusSgVKE9XyTvkQIfni6moLF6ouX:kIa/90FQ6osSghxmMQIEpX
                                      MD5:4F19FA7C4D2A809FE9323201E9F989B2
                                      SHA1:6BB5F7D8729C6C4DCDBBC29CCF3880BA8BBCE9A5
                                      SHA-256:623FE7D4C9B4658415493FBD1ECAB6AB063B20F7F0F49473F54780832C4356CD
                                      SHA-512:8851E4EE4EFADC23ECACF18075BAB9997A70B76DC92FD02A66F246CBB35E106B3203AD0CEC8742B3C89976685A50D6BA008E3F7ABC3CB5E9013AF4DF060E6D26
                                      Malicious:false
                                      Preview:cS..M.P..r.`.;K.r-.T....t.".k..:..i/.Z.......w%O.......6.D..H.......!]\>..&.E......*{..7e#.V<L.Q..........S.>.C./... .T.|.O.[...d.@....^....x.W.:..s.....s.....4...iW&.I.RYe.|.....x..I5....2w...".F.Y..AB..`.Rz...X..+7.e.q..a>.rq..3..S..2.0...."......$N.2...2...|_..2*..K.j9_...]..K...~=..0..>.D...|..K5'......h..,...e.y..~.Iy|/...l.7.?a6T..2I..3..-H.4f.Q..8/.........h\.IH..8.!}..r.j[...$....~.......^,...?..-c...sM..k.3..`.4\2V..E..}....v<..qah..:.j,r..E...p.k .j ut..R.>.^......4...d.#.g.j.4S8....,s.......a..._.d+).....JN.../..7....A.u.`.F.F..L.36.....v.m.;....U.Z............Jh[9X..Z>g..2.u..#....c.:.}.FP..%'.#e.HOw...I.=e..V.-..a..).t......O........Ee[^.c.)}.[.............B......1..s.'.<.e...D5nc?3f.F...4..-...[.....3.)...rfx.k8#...l?............$U3."2..P..<...f.;.E.,t.;..P}.?.C..%.>|.b..1.~.#u..,....lg.i.X..!;0...8...........Ox|.?.-.v..../. ..peqv*#.,..+...].Kt. R!..........~.....].R...fm}.$c...Y.......(.sw.._.n....u/.....&;..I

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\nV6n90A.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.9784544984541546
                                      Encrypted:false
                                      SSDEEP:192:r3qL3bufg4wCr19p6cbbUwxMbmrINgCpAjeOxkzdwP2vUUFfe:0uGG1GvVKVCOjnxwPpe
                                      MD5:71FC34730DFA6B78B92A896E1590A7BC
                                      SHA1:100C097004FEFE8AE0BC46E2B7BE5ED0E4AEBB88
                                      SHA-256:D86F4E38838650335C45B7D495C3C716E3BC5AC9D53296581111A5C26D876A67
                                      SHA-512:43F3F624127991CFDDEE16E89C9D063AC25776CA1A9604EDB88652407ECD0C644626B9AC974E9DBC02C538BB9BFACF319E9B439E501BC6760E91641660B1D945
                                      Malicious:false
                                      Preview:1.........E......:+..}S.........>.d..:.V(....K_3..V*.N;.KV...`..L,.z..G.j....!H.[WB...}>..6..p.>......A..A...H.@vz.t.7.NN......^V+9.u.Q..I..f.7...R.9.[.V:?.n..#j.....E...U...[.....O.Lwi.U....?...9.....F.W.lN.'D.D.|.]E..,J...Z..@.....X....Px.zjI...V...x..,. .\.&.}t.fN....0.Ri...1..L.V*.;...*.x.c|...y.U.~.Z..d..d....b..O.f.IC...y}?"C.^...>.bms....)g#..r...................W....*R...._...9.U".9.K#....y$=/.O,.5..H...~c.F..1.M...eXX.Bp&H..MVI.* ..Ib....?.G_...FW..PA.0..px...g_.p..n*nZ....v<`4..^m$>3vf.`5..........n...2.....2.}..".....)fy}.5..z..p.p....b.......vd.&.Eu..p..z.r/..:.....t.&.....*..z^..{..C.!..)..........Q...dl..{...jaI...;p..B..R..!dA...,!#[.+.2G......R!.m...V!.....A.]...#.Gb...G.J...e...$..9,.n..].{...`V.....'.......um+{..:.^/.Z.N.A.E.4..:....s...(M.\%...x..D..^..i.tF.^...-.8..+.......^:..'.......i...LqR|.?....V?.o.W.....B0=.P.;.:.R.F.n.GC..5 ...gGB.\d..:J#.Ruj ..:...>........%d.!A..Yg......C.QM..O......,.\0.[....]$.OD[.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\XRk5niO.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.974578501793252
                                      Encrypted:false
                                      SSDEEP:192:Y7RLwUkUrXHY7D7llmzX7sDcF3F22HuAUgsRQjoFFIZ1uxk:qFwirX47DazX7sIZFSA9sqYIZ1uxk
                                      MD5:38931DBD64F7D3B8629BA4949D5CB901
                                      SHA1:5344B9B0D895D92025402D4164966AE9921ECB59
                                      SHA-256:36C17887B42D8F07F53E9533065BDB8F83173DFF9FB60FB496E30EA6B1E99820
                                      SHA-512:0B08563D2FFC36E8D1DB3F769172D3E9F379F6EEB13C0D53C56A9DC426C43F17ACDC5EEDB84ADD720093B28AA9EDC79399B3F84C9E624ACA36DE334AC947DD1B
                                      Malicious:false
                                      Preview:1.3!....x........y..^6.UQ.:{.0.Y..3`..4...........vs.A..pPP.4GV.#.;...%BZ.I..n..R=........N...`..*zM....:.U.......!..r.5~}...Q.....H.h`......i.Jd.AV.nN.Y../n.N..E.l...I.N.?.bO..e|}..,..O.cp!..i....}y.4..dMDm..N..D...z..../&...hdG]..YN..y_.59.F.$wG:~N...8...<.k......]...Y......"......Pq.w..../.+..fd...D...R.....g..`1..1..{...L.\XR.V.<.E.d.S..eP...._..B...K.v.N$..RY,.1......._.m....i&..,.P[`.r.....^.=.';..W....fZd.......__.)...O;r........t-Qh.a{.......\..)..}....{H.l.A....*.P.D.%.....|.\.0..SX..l..I....[.Od..M.._.z.....<n.\..c.x.k......%..@.....`...S...HA..a.VvIL....l.2uo.p.pilA.pAugj...8...i..E,.....@C.r...........f....._....v...w.Ts&.xW.`.8.Z....?=....V..Hd....+(.#..#...%W.V..v......u.*m<9...o70.p.?qP......A.].$.=.3^..../~...4u...c....DP~.h....;.#..J...).ZZ..?t..h?.....T3......R[+.P&.....z=........LR.B.I7.|o..........s.].{.BX$.|LBN.(....aH.Q.BI..k..N%....^!#......X../I..k.L...u^.y..tZ.tm.&."l.......;...?.....F}Mu...T....F..}.

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\SYEDTlt.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.977446760243773
                                      Encrypted:false
                                      SSDEEP:192:vMKgcR31cHukex3E35zw78jNdsSUXArrl546Eq6sqVWjmaZ:kKjR1cHukexyzw78jNds3XArPkq6VWi+
                                      MD5:DFED257EC292BB84B440AB96DD25BCF8
                                      SHA1:CD4878B9C6A63D8BD508CD91E75E1319EF9B9A4E
                                      SHA-256:7A5B6F38E93DC447AA4797CCB15EC56BE3AA97D7A49599AA1077649FCA8DA456
                                      SHA-512:BFEE26AAD8604CB0FC3E3C7B041C56291B0109F64F808C41B78F10BF7DD986A51D089DDAFFC69B6BBDABC4E3EDA2593A6D2101B4A7D115DE9EF6D8C5C7EC60E2
                                      Malicious:false
                                      Preview:.. =....0....MO....P.pa.....T.2]Yb...... ]Uz.}..=. } .B!p..um.8.T...T...yC%|........I..c{V.'~[..."...zc.Z..H....sm.'.+...b].}.k1.....%`.P...!dY.....%Q.H..U..pz.eH.%.B....l..O....?6M.N.....I.....Y.3w.xb._.@..d......T./]O.3..|O...7...~.F.4#.u #.F...X7n..<...*)..eT(L!E.U.a~"o..1.'...i..|....eW2..gv.#..*r.P...y..3$.....I\0..|.q..t:.gO.4.ds...74>...2G..I.p(..j0..R..]..b%..h.......d....qY_.1.Z.T.2x....M...ey".#.t.....w.%'e\u....O.+...?[k........=o.T...D<....K..%....(..F......9.2...s..8;X.....>...#.+6.....A=..;..=..d..}m.v....r?....A]...s..U....Ed.P..A..(v.u.G}..N....J2H X....Yv..=+.G....:2....9I...A......]gs..p...s.K./5?].z.k.y.T....La....>*.sPU..r....=....JL...F...C.z..L._%....P................n....g)...`.....k\V..u@=....^.9e.N!.u..R..w...e.2.......8Z....#h....m'.....!.U...{.2..G[.S.oD..{2.......Kk......?..zr......6..W..........dcy.WDP'..zk......8.r.#.-.=.K.$.n........e^.@.....j.....\.F7....>..........,.._vwZO.ZhpZ?.^3...(.wk. p.l......{

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\waaRxwP.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.978945810491704
                                      Encrypted:false
                                      SSDEEP:192:Sg3VH2nKQ9xMNPyjX1sjLNjw1gZZgjkfH0Ua435uH5GPIJM9tZnz+:Sg52r9Ko4N8gfyk8FM5s5GPIS7Znz+
                                      MD5:7F06DD6151567663B96FFF6A3B25611E
                                      SHA1:EE957D833899F7ACDB8BCBFF3F87C8D3A9DE4B46
                                      SHA-256:5D5137563735A286B3E6A730EB1EE3D012ED1CC3E299B0C0DC9F09C056572A6F
                                      SHA-512:267233C12CA0B73C8470690D4C1C77B604303F601D99B84994B23A8772A1879B711295CE5CB9845CCBD631455CCFB529F27852B176AAD9A488B77CA5AA0A9ED2
                                      Malicious:false
                                      Preview:.....v...rm>.....V..........E.8.ra..,n..w....._y.?....#......... +x1...)...sT.pe.#..7.T.Z..BC.N........Y.%Q~N...X........?k3^..g......j.l..&E2X..!.)9.8.g..../Qv..M..IVr.m.....*JB..#.-.9J..'...............X`C<...L..M...m.J...8.....q...\..s3}.\.dYv..S.B....'O!]....e..l..Y..j.9.L.P..4.4..f]..G.2eW.....V._.......9R.4......^c1..2.%.X.1. ..F.t8_.{..L..........&...$e......w..A.J..r.-@.....e*...C..d..|..y...r......C......iE6..........Do.....[CR...d..]7........U...-DF...j....Ve>d..*7c.q..z..[.:.L.yc...........ik3l8B..c....1!e..0g....k.....wr.M.oZ.....In&..J..&.vmf...$.&g..K+...R8..DA..x.}......Q....;...e....s..^x..P..A.>8...E..|n.m_S.74v...!.<..E.n=rF....Y..AwT....$V.y....-j.>G.].|..p...#S.......!...B...v.l.ak....w.,...$...7....)(.P..f..X<..U,zK..:N.....x.H>.`o ...y.&..Q..Onn..3 .]...(vU..l..G.....~..L..g.D6.C..H.;.B.....<0...$.L[...........ti..~%&4{./4....C.t....V..]%_.L,!X... .Df....g....QF.K..m|..S....\^.../.....4h}c..s{\.tA

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\UkD1jGv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.9774652500379
                                      Encrypted:false
                                      SSDEEP:192:RTdYdRR6aUrYES94pzZJoeNLjVOYg0cAwbmWXLzY:HAr6jr/S94p9SexjVOYXcjbmMLzY
                                      MD5:7416A5944FF426389373536A2302BBF1
                                      SHA1:68D5ABC5143334844C184A51B2D8ABE1BFD90A57
                                      SHA-256:44F4832AA78BE63453240DFCBC931EAE8671E153174FC1E06EC38174FAE2A53A
                                      SHA-512:003C96C799EA2101C17B64CC2CF88DD057221CB0A9F8709E7CDD1E9C1805F54B7B681AD8A4D3009869AE8CACFE7D498214F1E0F33612B8AD368455088DFE23E3
                                      Malicious:false
                                      Preview:..d>...v. ./k.5.........{...^..-..].I.....>.?E......OJ."..}Z.u.C...........M5.........:.....s.GJ...p-.*.....et.(...d....!99k......G....B....f..Z..`...#...]......."p.)h.W....@.[..Id...8...[.Y.*....Q.._W..[..7..X,9..]N...Vc..i.....2.jE...\.E.{..7<<z..........+....+.e..@.o>..<^...n.........PcS.....g.._.1u...R..F.7.A..[....3....$.O..99...GH.-....qv.|..Va.........p....cT.5*..U..jA....1....p....`.....W.E B":....L.SW.!.=.T.gRaw...?..v...=:Rb.SV&..5.z.V5>...G:.]..Ej.....{..K.Q.._.oBTc...q..O8E.......1......>I..E`xr...Yy...g2...RX.[....FL.."o..8.w...[.-.....g..?.......I..Y;J.&....R.._[.Y...........g..-4rL.p..P....u.....G.1..j..^....n....>..d.<V..y.9.1.O..D.q..?..9.Qty)E.......dc.{.SRL.i...{.2.@..JG.+1f.Nf.o.N..b*.Td.,.!.v..m.s>.^.Z..`..N..}.._.h.#J.vb.OH....y!..a0......>..*a......P.4......|..E..K..r...t.....5...L5......'....b|...T.3[...2J.."...../mGW%.Fa..T|a....O.q...qk....;k...R...=.....C....Z"j .k..1.}}-b*.,.e....&.1....+..J.:.k..

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\qFP4XwD.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.974822740795228
                                      Encrypted:false
                                      SSDEEP:192:YgAPVx5KFcs1IRPC+5tg9twyO/VlrMmlfL1zkg41dy9bU5NJ4U/:YbPVrKFcsm1N5tktPwVlrBlT1zkg4fyw
                                      MD5:7C92328EEB4E3A91C954E022962CDC5E
                                      SHA1:24070CFF7351BA87EB7760F0E4CAAD19C109D89A
                                      SHA-256:0EC5FA05FB9F70F954C95841DF99221B092C57939CDE3EEFBA0146AB7B754DB7
                                      SHA-512:4976666C166F4AEDC79C93E95B5CC731C94209C32BFEAB013FA136FC51E47F8F21706D8380395887069DA7A4694A1F3CD6A8C443CE2F50A8EE8EEF15A52931AF
                                      Malicious:false
                                      Preview:&.2.d..>B...t6....Y..W...7vR..S......TMWI...R..& .....Ji.9..I2...$.qSg}H.......r#..B.ep...SpN>x.L....61_.7,$..E..l.L..3(...i.......t.A..D....Z.-6r4........I|...0p.....5.......q.......5....pHvS..^d..........V.D...}.#..B.....^.....2..2.B...Qc-....QA.u'#.-Z.a.r...S=...d..Z....#.......d".|iY".jD. ....{.=.?......W..xy..'.]O..a.c].deK3....Y.g...a+...........M..g.<L&I......u.^).\.U;.`.8.....0...-.).6.z../.....\....$.....n...]...-V..Z.d*..W`...h.n+|O.l../..X.;..J....a..Z.O..V....x.'k'j.....PR...&...KOz"".D.hy= ..9+.7K..d..tT@\..P.%h..c.;..;3...H......oJ.S..?...c..hY"d.+A}x.`"`.m.~.......36........a...W.j+.ANd.....,....1.C.xS.<.J.t.`......|.n...6}bS...H=h..........\gE........c..q.u.\NK..K.#......1D.dJ....se.&..?ZD~4.......K4....D...&......''.q?P0.Y.1.#c....m@.e.!..P.A...5.<.ee.......%.p.JY..B...#Z.)8v.<..q4.B%e3..iz4...3...|......v[*..].Q.5..HPYI.........4....z:+....T.........krn.[...x........fd$3.. .......#...EdTP.;.I...m..K..v.\G..j(MS..G-o..#.A..Q..

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\ari4hHM.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.978619281219655
                                      Encrypted:false
                                      SSDEEP:192:aTzLjCRv6kKSD++dgeuk2cezEUNCJc6htM+L+r:evCEk4+ddqcaNacjA+r
                                      MD5:CC32F77195C22DED690E4FA772B483D5
                                      SHA1:7903639515315A5A4195FFF5A9854F0EC2E5FAD9
                                      SHA-256:CE427ED33E028C82EEC7E1C924005F39854BA754C06AA9B83FEA2E59F80CC8AE
                                      SHA-512:6B12AA1B0FF3D20306E28C70B1A65052DC95BBD41BF169E550BA5EF39DC764CA450834D7C07AD384AA188E75886774FE5FED9134C89044755C4FE37D58727C45
                                      Malicious:false
                                      Preview:......sH0q..5...T....-!.#...nTq\....&.".........n.:~....^{.U14....%...!...A.....a../...~'...R2....lG...%.W....1..=...4.$.E3...}....N......0......r.S....0.......qs.......g.H...Dp....4sb.=..'.....[....|.....[.......E.B.)..k@.T..(~.......U..~D...Mycs......E.......2........F........g...r......rC..(...{.......e.1.A....h........,...xe2...AAa8.";....1v@.[.6.$$...d..2.|Q..".q...`....Y.$W...`{....$.@..J5..UB...."r.5..:...N(.D.. ...;[.8#......r...58Q.;\.z....~....R..9.....Z..$...(.{4&...=.&...=....>.........u.y.<.(....{].N.j#l..~..Fh?..#.=...."O.Y!\YQ.._..X..>Z..... t.X}G^{...?..vwp..^...)&..._r.._/...Z.o.+.cr..W].P.9.....=.....u..y..cA:.(W....b......`.&F..)........v........CvH...........equ.........T....E.O.)...4..g...!........V.\mg.s.L.._..Y.D...nng..#...wC.......(..L.+.....'.k..Wm..d$_..Z.........! .Oq..i....q[*.`..\...........F ....AD...w..cP.4....`Wsz.]..k..v.gT...O0...hEA..RX2.).?sZ...M.*.>.X..q...7x.t.X!.....".&..,.}].7..tZ.:.....v.

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\ZTfkI50.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8431
                                      Entropy (8bit):7.979100481659586
                                      Encrypted:false
                                      SSDEEP:192:TXpDixT8xCzJsQrPn5c5ToHdq1A3Mge82P+rz0nXqfImSZ:ExT2gsQrvITo9q1CMge82PUw6fO
                                      MD5:0ECE2FE65C9D1FB3646F81AB8206FAA6
                                      SHA1:02C3595567C43531DB74C431BE14D43ECA6C4D6A
                                      SHA-256:6676746499C9ECF686B69F3A778987C9260F3FDFCB090DBEB74364EF3666FC04
                                      SHA-512:267632286BF784C827B23CC8F132A6FBE6F172A72E1CFA59C92573CE13E88B5C5E533B4140E58CBB3463D7CFD27D3F8DD4743224A51FA8589B61C53FE485BE1F
                                      Malicious:false
                                      Preview:....k.%..............WV.X...C......I~.w..*E.E.........~._R.WI......'WP..rD5..(./....=8K8.`...2.,Q.Q.....{....^..#$"_.,u.>..w..zyL{z...wT.r...iC..,X..[n...}.a+n'..9.V.....7N.|..k..8 .+..U...O...........A1...$sZq.=.pL...W.8\..t....<..3.h$.9..T,th.........f................y........@..F.3....\..X....w.8..-t])..[.....5.A... s..3.'.Y.6...on.2...6..]a....=B..$,....A.]....h._....:.+...Z..z..l.7re.$..g. ...4.z..Do......hl..f@..5.Hz&.cg(R.k~._M(.a....ev3..p....u.......g........5Q..E..} .Q.Q".-.[.....M....-.+D.AT...r.W3..{..........u....F.N...1..v...O.i.......@:.p ...'.........a.lV...{;T.....h.2.Y[..d,.`.....l.=[..&Z._......nzl....v(.....kZ_..X...].H..h......u.\.{U...<"a'd|L.J.....iT...V-Q..#...|.2....h.1...q.>y.U..s..l...0.t..JA.#.\^......J.PQ[.9j.....0.....%..T..Y.v`.....e...r#sX*..+......P.;w..L.!..Bm.\.;.e..4{...}_...Z...l....qG}o.{&.d....+.....hv.b.5..Y.N.yC@1.1|f.L.@:.`.~k;.v.....hY...."/2..<.....Wa.......bM..=.......;.;y.../.3.E_K.!E..I

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Local\Temp\Diagnostics\ONENOTE\App1732023800298197300_D36BF1DE-0389-4BC7-BC84-A0F0A14E3447.log

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:ASCII text, with very long lines (1981), with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):20971520
                                      Entropy (8bit):0.014108329995367555
                                      Encrypted:false
                                      SSDEEP:384:If/TLKxLMkS4n4M494K4x4L4eXfiuDvs3qhunm44/+49I54NI:IXTLKVMkn4Rmvi0WiuDvs6YzaL
                                      MD5:47D7F9AE5A167C00050F48ADF1983501
                                      SHA1:CD8119089373BC233DFC80BC573D5F4E071419DA
                                      SHA-256:BCE53452BAC85DB2F8214F07D66E5DE6C7A5CC98CB43E7625C20E2AE51AB9FB9
                                      SHA-512:8255A9BEF4EE03BF022554C4D279BE7970E7328B23EAFD618A999F7C25F1B28AA106F0EF22CA8596EB93DF19AA29DEC0747EC527EE843735E75F5BF0E6F38228
                                      Malicious:false
                                      Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..11/19/2024 13:43:20.570.ONENOTE (0x16D4).0x1540.Microsoft OneNote.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":20,"Time":"2024-11-19T13:43:20.570Z","Contract":"Office.System.Activity","Activity.CV":"3vFr04kDx0u8hKDwoU40Rw.6.1","Activity.Duration":163,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...11/19/2024 13:43:20.586.ONENOTE (0x16D4).0x1540.Microsoft OneNote.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"2024-11-19T13:43:20.586Z","Contract":"Office.System.Activity","Activity.CV":"3vFr04kDx0u8hKDwoU40Rw.6","Activity.Duration":13595,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.F

                                      C:\Users\user\AppData\Local\Temp\Diagnostics\ONENOTE\App1732023800298860500_D36BF1DE-0389-4BC7-BC84-A0F0A14E3447.log

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20971520
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3::
                                      MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                      SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                      SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                      SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                      Malicious:false
                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Temp\SPL1013.tmp

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):65536
                                      Entropy (8bit):0.4298657863072527
                                      Encrypted:false
                                      SSDEEP:48:grmMxV1o7ej9GU6EepOlF3S2BAOCcNafqrNsylVlsolDPZ1XKDq:grP1iej4KbmckO8/
                                      MD5:71AF2AA39E8C04006B55F3CD01CA57EA
                                      SHA1:98D2C35D502D102F8C38D5511D15DEDC0346B45A
                                      SHA-256:BA554A9B23D89A8A097F016E3790921267955AC014B2FE5EBDD4B08FA293B73C
                                      SHA-512:17211FF88DF4E71611C997E1B7E031C5DE6730ABB524DB2B996661420A83A26B31BE93E47B56C7BC3A7B73436D38C808A1E5C124DFBC38D3CCD723138D25CCB0
                                      Malicious:false
                                      Preview:................................XM...p.. EMF....p...............l.......D........... ...............?....f..P.r.i.n.t. .t.e.s.t.....%...........%...........R...p...................................C.o.n.s.o.l.a.s.....................................................................................................@4..=.y.....v&.u....l+8w.&.uL...@4...v...v...........tL...e..........u............X3....8w..y.....L...0(............8w..3...........5wx..........u...u......5w....d......uH.............4w...u....d......udv......%.......................................................b...........d...................................................T...T..........................@?@.@'...5.......L.......................P... ...........................................................T...T..........................@?@.@............L.......................P... ...................................T.......'...5..................@?@.@'...5.......L.......................|...L.o.c.k.B.i.t. .B.l.a.c.k. .R.a.

                                      C:\Users\user\AppData\Local\Temp\{019E8E57-EE2E-4111-96BF-55D2E0BA3E3E}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):40884
                                      Entropy (8bit):7.545929039957292
                                      Encrypted:false
                                      SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                      MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                      SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                      SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                      SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                      C:\Users\user\AppData\Local\Temp\{04D17511-AA24-4C7E-8944-09C2EFE11F59}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):52945
                                      Entropy (8bit):7.6490972666456765
                                      Encrypted:false
                                      SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                      MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                      SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                      SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                      SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                      C:\Users\user\AppData\Local\Temp\{06B7069B-FA1B-49E6-B9A9-68519303E0E4}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                      Category:dropped
                                      Size (bytes):2898
                                      Entropy (8bit):7.551512280854713
                                      Encrypted:false
                                      SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                      MD5:7C7D9922101488124D2E4666709198AC
                                      SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                      SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                      SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                                      C:\Users\user\AppData\Local\Temp\{0965AC9E-80C6-4844-AC0F-181435BD3D0D}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):86187
                                      Entropy (8bit):7.951356272886186
                                      Encrypted:false
                                      SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                      MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                      SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                      SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                      SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                                      C:\Users\user\AppData\Local\Temp\{11CC57A4-93B3-4F7B-8322-5423792C4526}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                      Category:dropped
                                      Size (bytes):140755
                                      Entropy (8bit):7.9013245181576695
                                      Encrypted:false
                                      SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                      MD5:CC087700C07D674D69AFDFDA0FA9825C
                                      SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                      SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                      SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                                      C:\Users\user\AppData\Local\Temp\{11F18445-B14E-428A-A3A9-5ACC2968EBC6}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                      Category:dropped
                                      Size (bytes):3428
                                      Entropy (8bit):7.766473352510893
                                      Encrypted:false
                                      SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                      MD5:EE9E2DF458733B61333E8A82F7A2613D
                                      SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                      SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                      SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                                      C:\Users\user\AppData\Local\Temp\{125D4DFF-9ED5-477D-B60A-DB7D00A8D77B}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):11197
                                      Entropy (8bit):7.975073010774664
                                      Encrypted:false
                                      SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                      MD5:DDC3CC30794277500EFE4BC6667EC123
                                      SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                      SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                      SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                      Malicious:false
                                      Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                                      C:\Users\user\AppData\Local\Temp\{12F9F3F1-B415-45C9-8747-F9AB424A70D5}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12824
                                      Entropy (8bit):7.974776104184905
                                      Encrypted:false
                                      SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                      MD5:2628353534C5AD86CBFE57B6616D46DD
                                      SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                      SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                      SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                      Malicious:false
                                      Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                      C:\Users\user\AppData\Local\Temp\{139A4509-FED6-41C3-8C4A-150EB81740AF}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                      Category:dropped
                                      Size (bytes):27862
                                      Entropy (8bit):7.238903610770013
                                      Encrypted:false
                                      SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                      MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                      SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                      SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                      SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                      C:\Users\user\AppData\Local\Temp\{14C3DF5D-DA04-4E47-A433-30A8B3FA44A4}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):39010
                                      Entropy (8bit):7.362726513389497
                                      Encrypted:false
                                      SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                      MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                      SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                      SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                      SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                      C:\Users\user\AppData\Local\Temp\{1601D942-BF2D-4F30-BD3E-C8B704193622}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):4410
                                      Entropy (8bit):7.857636973514526
                                      Encrypted:false
                                      SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                      MD5:2494381A1ACDC83843B912CFCDE5643B
                                      SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                      SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                      SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                      Malicious:false
                                      Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                                      C:\Users\user\AppData\Local\Temp\{1EC16A6D-4CF9-4A94-86E1-1805117DE1D1}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                      Category:dropped
                                      Size (bytes):64118
                                      Entropy (8bit):7.742974333356952
                                      Encrypted:false
                                      SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                      MD5:864EEA0336F8628AE4A1ED46D4406807
                                      SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                      SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                      SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                                      C:\Users\user\AppData\Local\Temp\{261BEE9E-6F4A-47B6-82F6-1AB2E207A155}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                      Category:dropped
                                      Size (bytes):22203
                                      Entropy (8bit):6.977175130747846
                                      Encrypted:false
                                      SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                      MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                      SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                      SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                      SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                      C:\Users\user\AppData\Local\Temp\{26A0193C-FF87-4F8E-BD31-6FF6E758EC76}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):41893
                                      Entropy (8bit):7.52654558351485
                                      Encrypted:false
                                      SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                      MD5:F25427EFECFEE786D5A9F630726DD140
                                      SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                      SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                      SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                      C:\Users\user\AppData\Local\Temp\{29444B11-89C1-4FDC-93C1-63D776AB8F24}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                      Category:dropped
                                      Size (bytes):27862
                                      Entropy (8bit):7.238903610770013
                                      Encrypted:false
                                      SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                      MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                      SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                      SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                      SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                      C:\Users\user\AppData\Local\Temp\{30597421-BE63-4D82-AC4B-781526646CBF}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):25622
                                      Entropy (8bit):7.058784902089801
                                      Encrypted:false
                                      SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                      MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                      SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                      SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                      SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                      C:\Users\user\AppData\Local\Temp\{319BE8C7-06D2-4C00-AD38-F211C3568C25}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):41893
                                      Entropy (8bit):7.52654558351485
                                      Encrypted:false
                                      SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                      MD5:F25427EFECFEE786D5A9F630726DD140
                                      SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                      SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                      SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                      C:\Users\user\AppData\Local\Temp\{358A5CC6-2C9C-4213-AB5A-CF4455B961FE}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):2104
                                      Entropy (8bit):7.252780160030615
                                      Encrypted:false
                                      SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                      MD5:F6C596F505504044DF1E36BA5DA3F09B
                                      SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                      SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                      SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                      Malicious:false
                                      Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                                      C:\Users\user\AppData\Local\Temp\{3CAD488B-A289-47A1-A243-7EDD9B45C952}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):59707
                                      Entropy (8bit):7.858445368171059
                                      Encrypted:false
                                      SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                      MD5:47ADB0DF6FDA756920225A099B722322
                                      SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                      SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                      SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                                      C:\Users\user\AppData\Local\Temp\{3CB8BB6D-66AB-4259-B5D0-C4338036C3E7}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):2033
                                      Entropy (8bit):6.8741208714657
                                      Encrypted:false
                                      SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                      MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                      SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                      SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                      SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                      Malicious:false
                                      Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                                      C:\Users\user\AppData\Local\Temp\{3FB1C03B-10FD-4C14-98A2-153EFD79C79E}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):60924
                                      Entropy (8bit):7.758472758205366
                                      Encrypted:false
                                      SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                      MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                      SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                      SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                      SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                                      C:\Users\user\AppData\Local\Temp\{43BD160D-1ED5-420A-AC59-AAF7D4976A58}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                      Category:dropped
                                      Size (bytes):36740
                                      Entropy (8bit):7.48266872907324
                                      Encrypted:false
                                      SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                      MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                      SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                      SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                      SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                                      C:\Users\user\AppData\Local\Temp\{447FF51E-6CBA-4E76-A027-1C07C743CC37}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                      Category:dropped
                                      Size (bytes):84097
                                      Entropy (8bit):7.78862495530604
                                      Encrypted:false
                                      SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                      MD5:37EED97290E8ECB46A576C84F0810568
                                      SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                      SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                      SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                                      C:\Users\user\AppData\Local\Temp\{49913FC4-47D3-4B2F-9406-4D1693500746}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                      Category:dropped
                                      Size (bytes):1717
                                      Entropy (8bit):7.154087739587035
                                      Encrypted:false
                                      SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                      MD5:943371B39CA847674998535110462220
                                      SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                      SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                      SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                                      C:\Users\user\AppData\Local\Temp\{50D47DA1-A069-4384-89FD-0B13558C73F3}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                      Category:dropped
                                      Size (bytes):2268
                                      Entropy (8bit):7.384274251000273
                                      Encrypted:false
                                      SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                      MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                      SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                      SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                      SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                                      C:\Users\user\AppData\Local\Temp\{522049D6-E3CA-47C8-936A-B906DC28EFD8}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):40035
                                      Entropy (8bit):7.360144465307449
                                      Encrypted:false
                                      SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                      MD5:B1DDD365D87605F96D72042CB56572F6
                                      SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                      SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                      SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                                      C:\Users\user\AppData\Local\Temp\{52BE37A3-E841-4010-AF02-113275214F8E}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):10056
                                      Entropy (8bit):7.956064700093514
                                      Encrypted:false
                                      SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                      MD5:E1B57A8851177DD25DC05B50B904656A
                                      SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                      SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                      SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                      Malicious:false
                                      Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                                      C:\Users\user\AppData\Local\Temp\{53F6B28D-B065-43E9-8D82-89C414863E45}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                      Category:dropped
                                      Size (bytes):29187
                                      Entropy (8bit):7.971308326749753
                                      Encrypted:false
                                      SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                      MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                      SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                      SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                      SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                                      C:\Users\user\AppData\Local\Temp\{546EB501-A1AC-4087-B49A-6412BF52F49F}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                      Category:dropped
                                      Size (bytes):68633
                                      Entropy (8bit):7.709776384921022
                                      Encrypted:false
                                      SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                      MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                      SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                      SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                      SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                      C:\Users\user\AppData\Local\Temp\{5515B487-B82D-488E-B460-4A7746803E0F}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                      Category:dropped
                                      Size (bytes):70028
                                      Entropy (8bit):7.742089280742944
                                      Encrypted:false
                                      SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                      MD5:EC7811912ACA47F6AEB912469761D70D
                                      SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                      SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                      SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                                      C:\Users\user\AppData\Local\Temp\{557BE128-B91B-4D75-92E4-DDEEAD7783DC}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12180
                                      Entropy (8bit):5.318266117301791
                                      Encrypted:false
                                      SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                      MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                      SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                      SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                      SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                      Malicious:false
                                      Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                                      C:\Users\user\AppData\Local\Temp\{558CF1FC-A463-493C-AA5B-DC26BB9B937C}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):1547
                                      Entropy (8bit):6.4194805172468286
                                      Encrypted:false
                                      SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                      MD5:0BA36A74DFBF411FAB348404CCEC3348
                                      SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                      SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                      SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                      Malicious:false
                                      Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                                      C:\Users\user\AppData\Local\Temp\{591D026E-AD28-46A7-972D-18BE2499206C}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                      Category:dropped
                                      Size (bytes):3009
                                      Entropy (8bit):7.493528353751471
                                      Encrypted:false
                                      SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                      MD5:D9BD80D40B458EDB2A318F639561579A
                                      SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                      SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                      SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                                      C:\Users\user\AppData\Local\Temp\{5A118FAB-F0AA-4D84-8395-05B7788799E4}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                      Category:dropped
                                      Size (bytes):22203
                                      Entropy (8bit):6.977175130747846
                                      Encrypted:false
                                      SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                      MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                      SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                      SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                      SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                      C:\Users\user\AppData\Local\Temp\{5BAA7162-21E9-48DB-B154-01BC9B20EB9F}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):515
                                      Entropy (8bit):6.740133870626016
                                      Encrypted:false
                                      SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                      MD5:E96BE30D892A5412CF262FEE652921CA
                                      SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                      SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                      SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                      Malicious:false
                                      Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                                      C:\Users\user\AppData\Local\Temp\{5C11C417-2263-456C-8417-69357EA1BDB9}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):67991
                                      Entropy (8bit):7.870481231782746
                                      Encrypted:false
                                      SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                      MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                      SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                      SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                      SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                                      C:\Users\user\AppData\Local\Temp\{5DF98BE3-A68F-4203-9F23-B8A08B0C6253}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):5136
                                      Entropy (8bit):7.622045262603241
                                      Encrypted:false
                                      SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                      MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                      SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                      SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                      SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                      Malicious:false
                                      Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Temp\{62DBE83A-CFA1-48D6-BAB3-5FC98D0C6D17}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):1569
                                      Entropy (8bit):7.583832946136897
                                      Encrypted:false
                                      SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                      MD5:07DB3F43DE7C1392C67802E74707DAA6
                                      SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                      SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                      SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                      Malicious:false
                                      Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                                      C:\Users\user\AppData\Local\Temp\{63D5559B-513D-4328-8C0A-6D1CD1F031FC}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):33032
                                      Entropy (8bit):2.941351060644542
                                      Encrypted:false
                                      SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                      MD5:ACF4A9F470281F475EA45E113E9FB009
                                      SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                      SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                      SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                      Malicious:false
                                      Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                                      C:\Users\user\AppData\Local\Temp\{6464360C-57ED-4B0A-A8FD-F549E68A23C3}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):53259
                                      Entropy (8bit):7.651662052139301
                                      Encrypted:false
                                      SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                      MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                      SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                      SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                      SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                      C:\Users\user\AppData\Local\Temp\{65CE1464-264D-4450-BC2C-BC2574D87FD5}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):53259
                                      Entropy (8bit):7.651662052139301
                                      Encrypted:false
                                      SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                      MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                      SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                      SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                      SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                      C:\Users\user\AppData\Local\Temp\{6B1D8DCF-A67C-4688-9AF7-1A1D4610D10F}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):15740
                                      Entropy (8bit):6.0674556182683945
                                      Encrypted:false
                                      SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                      MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                      SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                      SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                      SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                      C:\Users\user\AppData\Local\Temp\{6C47E73B-8F72-4F15-8BCE-BF0E417F9FB6}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):136726
                                      Entropy (8bit):7.973487854173386
                                      Encrypted:false
                                      SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                      MD5:4A2472AC2A9434E35701362D1C56EDDF
                                      SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                      SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                      SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                                      C:\Users\user\AppData\Local\Temp\{6C8B46F9-7C27-4D13-9278-90EB9A0DD1AF}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12824
                                      Entropy (8bit):7.974776104184905
                                      Encrypted:false
                                      SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                      MD5:2628353534C5AD86CBFE57B6616D46DD
                                      SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                      SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                      SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                      Malicious:false
                                      Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                      C:\Users\user\AppData\Local\Temp\{73FFA211-8B52-4C18-9930-0EA40FB88C8C}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                      Category:dropped
                                      Size (bytes):1873
                                      Entropy (8bit):7.534961703340853
                                      Encrypted:false
                                      SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                      MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                      SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                      SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                      SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                                      C:\Users\user\AppData\Local\Temp\{75C85CEB-FF50-493A-A29B-09F3444A2556}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                      Category:dropped
                                      Size (bytes):5465
                                      Entropy (8bit):7.79401348966645
                                      Encrypted:false
                                      SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                      MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                      SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                      SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                      SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                                      C:\Users\user\AppData\Local\Temp\{767AC28D-F78F-4E01-ABE1-DD9BBE710513}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):977
                                      Entropy (8bit):7.231269197132181
                                      Encrypted:false
                                      SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                      MD5:B7F74C18002A81A578A4EE60C407A8D3
                                      SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                      SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                      SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                      Malicious:false
                                      Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                                      C:\Users\user\AppData\Local\Temp\{778EB693-D28F-42D2-BF30-ED67920F5136}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):55804
                                      Entropy (8bit):7.433623355028275
                                      Encrypted:false
                                      SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                      MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                      SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                      SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                      SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                      C:\Users\user\AppData\Local\Temp\{78D5F6D3-DFF4-42F7-95C2-933A5EF7C5BF}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                      Category:dropped
                                      Size (bytes):3361
                                      Entropy (8bit):7.619405839796034
                                      Encrypted:false
                                      SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                      MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                      SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                      SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                      SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                                      C:\Users\user\AppData\Local\Temp\{78ECF284-CDB1-4267-AF89-332932CE6FEA}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):19920
                                      Entropy (8bit):7.987696084459766
                                      Encrypted:false
                                      SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                      MD5:1BDAD9B3B6DE549162F9567697389E1C
                                      SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                      SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                      SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                      Malicious:false
                                      Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                                      C:\Users\user\AppData\Local\Temp\{7CD0292C-D307-43E6-8DD7-9DD89917E146}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):32656
                                      Entropy (8bit):3.9517299510231485
                                      Encrypted:false
                                      SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                      MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                      SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                      SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                      SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                      Malicious:false
                                      Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                      C:\Users\user\AppData\Local\Temp\{88CF2D4B-9ACD-445D-A3B6-4E609D98DA33}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):95763
                                      Entropy (8bit):7.931689087616878
                                      Encrypted:false
                                      SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                      MD5:177DD42CA99CAA2CCBF2974221680334
                                      SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                      SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                      SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                                      C:\Users\user\AppData\Local\Temp\{8A0A99D5-63B3-45ED-9F62-CBB983F79CE3}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):647
                                      Entropy (8bit):6.854433034679255
                                      Encrypted:false
                                      SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                      MD5:DD876AA103BEC3AC83C769D768AD39FB
                                      SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                      SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                      SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                      Malicious:false
                                      Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                                      C:\Users\user\AppData\Local\Temp\{8A9CF755-A568-4D9E-9C9C-15A8F6870DDC}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):12824
                                      Entropy (8bit):7.974776104184905
                                      Encrypted:false
                                      SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                      MD5:2628353534C5AD86CBFE57B6616D46DD
                                      SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                      SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                      SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                      Malicious:false
                                      Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                      C:\Users\user\AppData\Local\Temp\{8E2A3AB3-20B1-446A-A90D-3FEC384B34AE}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                      Category:dropped
                                      Size (bytes):4819
                                      Entropy (8bit):7.874649683222419
                                      Encrypted:false
                                      SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                      MD5:5D6C1F361BC04403555BE945E28E53FC
                                      SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                      SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                      SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                                      C:\Users\user\AppData\Local\Temp\{8F9EDCC2-D32C-4783-938D-4E12C7B47697}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):32656
                                      Entropy (8bit):3.9517299510231485
                                      Encrypted:false
                                      SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                      MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                      SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                      SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                      SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                      Malicious:false
                                      Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                      C:\Users\user\AppData\Local\Temp\{90D0573A-8F74-45C9-9A96-C938B6307125}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):34299
                                      Entropy (8bit):7.247541176493898
                                      Encrypted:false
                                      SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                      MD5:E9C52A7381075E4EBC59296F96C79399
                                      SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                      SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                      SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                                      C:\Users\user\AppData\Local\Temp\{9608C010-DD18-4A5C-A74F-87F096CD3258}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):109698
                                      Entropy (8bit):7.954100577911302
                                      Encrypted:false
                                      SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                      MD5:8D804A60E86627383BED6280ED62F1CF
                                      SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                      SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                      SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                                      C:\Users\user\AppData\Local\Temp\{9BAF6540-9BD2-474A-805C-E2B15F2B904E}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                      Category:dropped
                                      Size (bytes):2695
                                      Entropy (8bit):7.434963358385164
                                      Encrypted:false
                                      SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                      MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                      SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                      SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                      SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                                      C:\Users\user\AppData\Local\Temp\{9F4EF5E3-1F64-4451-80F3-469860B07389}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                      Category:dropped
                                      Size (bytes):59832
                                      Entropy (8bit):7.308211468398169
                                      Encrypted:false
                                      SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                      MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                      SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                      SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                      SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                      C:\Users\user\AppData\Local\Temp\{9FE2404A-2D30-4422-AB46-CF0CD014FE5F}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):52945
                                      Entropy (8bit):7.6490972666456765
                                      Encrypted:false
                                      SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                      MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                      SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                      SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                      SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                      C:\Users\user\AppData\Local\Temp\{A242F3A8-9D30-4A31-9BC4-FA219CC814AB}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                      Category:dropped
                                      Size (bytes):3555
                                      Entropy (8bit):7.686253071499049
                                      Encrypted:false
                                      SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                      MD5:8A5444524F467A45A5A10245F89C855A
                                      SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                      SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                      SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                                      C:\Users\user\AppData\Local\Temp\{AE3AF0F6-64D7-4187-BF3C-9AC4B475CBCC}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                      Category:dropped
                                      Size (bytes):24268
                                      Entropy (8bit):6.946124661664625
                                      Encrypted:false
                                      SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                      MD5:3CD906D179F59DDFA112510C7E996351
                                      SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                      SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                      SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                      C:\Users\user\AppData\Local\Temp\{AF9C2D33-2E11-42A8-BFE6-1503F9F3C8D0}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):99293
                                      Entropy (8bit):7.9690121496708555
                                      Encrypted:false
                                      SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                      MD5:EA45266A770EEA27A24A5BB3BE688B14
                                      SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                      SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                      SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                      Malicious:false
                                      Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                                      C:\Users\user\AppData\Local\Temp\{B0B2C1F7-8409-4B20-BA55-3ACF5257421B}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):84941
                                      Entropy (8bit):7.966881945560921
                                      Encrypted:false
                                      SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                      MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                      SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                      SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                      SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                                      C:\Users\user\AppData\Local\Temp\{B2D4BF54-60C9-4ABD-8E51-4C439F886548}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):15740
                                      Entropy (8bit):6.0674556182683945
                                      Encrypted:false
                                      SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                      MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                      SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                      SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                      SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                      C:\Users\user\AppData\Local\Temp\{B2FF6AFF-8A57-4748-81DF-61A9FB088243}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):347
                                      Entropy (8bit):6.85024426015615
                                      Encrypted:false
                                      SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                      MD5:78762C169F8B104CB57DFF5A1669D2DF
                                      SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                      SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                      SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                      Malicious:false
                                      Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                                      C:\Users\user\AppData\Local\Temp\{B67379F9-A58A-4B1A-B7F0-4925A06D22C4}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                      Category:dropped
                                      Size (bytes):68633
                                      Entropy (8bit):7.709776384921022
                                      Encrypted:false
                                      SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                      MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                      SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                      SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                      SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                      C:\Users\user\AppData\Local\Temp\{B697AAA0-D460-411C-8A77-3AD46E5B6442}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):65589
                                      Entropy (8bit):7.960181939300061
                                      Encrypted:false
                                      SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                      MD5:8B48DA9F89264D14B83FF9969F869577
                                      SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                      SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                      SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                      Malicious:false
                                      Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                                      C:\Users\user\AppData\Local\Temp\{B9630E33-9DF5-4EF2-883E-A9948AB6E31D}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):55804
                                      Entropy (8bit):7.433623355028275
                                      Encrypted:false
                                      SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                      MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                      SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                      SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                      SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                      C:\Users\user\AppData\Local\Temp\{BF2923FB-AD8C-4E1F-B3DC-80364C359315}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):14177
                                      Entropy (8bit):5.705782002886174
                                      Encrypted:false
                                      SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                      MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                      SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                      SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                      SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                      C:\Users\user\AppData\Local\Temp\{C588A113-7130-43F5-947F-C4C9EDACB766}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                      Category:dropped
                                      Size (bytes):52912
                                      Entropy (8bit):7.679147474806877
                                      Encrypted:false
                                      SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                      MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                      SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                      SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                      SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                                      C:\Users\user\AppData\Local\Temp\{C620615C-91F0-4946-8173-1586C89F57FB}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):40884
                                      Entropy (8bit):7.545929039957292
                                      Encrypted:false
                                      SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                      MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                      SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                      SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                      SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                      C:\Users\user\AppData\Local\Temp\{C9207B6C-5060-4665-A99A-20191C0E07B1}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                      Category:dropped
                                      Size (bytes):59832
                                      Entropy (8bit):7.308211468398169
                                      Encrypted:false
                                      SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                      MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                      SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                      SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                      SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                      C:\Users\user\AppData\Local\Temp\{CB7A4844-3E61-4962-A781-6896E1FCAAF4}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):14177
                                      Entropy (8bit):5.705782002886174
                                      Encrypted:false
                                      SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                      MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                      SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                      SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                      SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                      C:\Users\user\AppData\Local\Temp\{CC51C94B-054B-442F-BA11-FAE812C73D6B}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                      Category:dropped
                                      Size (bytes):11040
                                      Entropy (8bit):7.929583162638891
                                      Encrypted:false
                                      SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                      MD5:02775A1E41CF53AC771D820003903913
                                      SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                      SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                      SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                                      C:\Users\user\AppData\Local\Temp\{CC88DAE4-8250-436D-AF90-10A7646C21FE}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                      Category:dropped
                                      Size (bytes):24268
                                      Entropy (8bit):6.946124661664625
                                      Encrypted:false
                                      SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                      MD5:3CD906D179F59DDFA112510C7E996351
                                      SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                      SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                      SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                      C:\Users\user\AppData\Local\Temp\{D24F68F5-5C57-4A51-862C-541CA30D00CC}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):827
                                      Entropy (8bit):7.23139555596658
                                      Encrypted:false
                                      SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                      MD5:3E675D61F588462FB452342B14BCF9C0
                                      SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                      SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                      SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                      Malicious:false
                                      Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                                      C:\Users\user\AppData\Local\Temp\{D2E93EB0-D230-4B6B-BEB1-A007CCC1FBED}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                      Category:dropped
                                      Size (bytes):12654
                                      Entropy (8bit):7.745439197485533
                                      Encrypted:false
                                      SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                      MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                      SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                      SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                      SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                                      C:\Users\user\AppData\Local\Temp\{D836BE26-D062-4C92-931B-81FFD67C9B94}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):25622
                                      Entropy (8bit):7.058784902089801
                                      Encrypted:false
                                      SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                      MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                      SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                      SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                      SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                      C:\Users\user\AppData\Local\Temp\{DEEDEE97-3825-43A3-9C2B-A06CF69E0967}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                      Category:dropped
                                      Size (bytes):2266
                                      Entropy (8bit):5.563021222358941
                                      Encrypted:false
                                      SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                      MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                      SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                      SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                      SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                                      C:\Users\user\AppData\Local\Temp\{E2DD5BC8-B43C-4715-B6A0-9D831F2176EF}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):47294
                                      Entropy (8bit):7.497888607667405
                                      Encrypted:false
                                      SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                      MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                      SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                      SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                      SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                                      C:\Users\user\AppData\Local\Temp\{E395B74C-6671-4A03-8544-9C99B5809D05}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):79656
                                      Entropy (8bit):7.966459570826366
                                      Encrypted:false
                                      SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                      MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                      SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                      SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                      SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                                      C:\Users\user\AppData\Local\Temp\{E434DEC7-580F-4012-A13A-8244EDAE0E1A}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                      Category:dropped
                                      Size (bytes):32656
                                      Entropy (8bit):3.9517299510231485
                                      Encrypted:false
                                      SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                      MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                      SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                      SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                      SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                      Malicious:false
                                      Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                      C:\Users\user\AppData\Local\Temp\{E756C0CF-7C69-4D26-BA34-277450D5DE74}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                      Category:dropped
                                      Size (bytes):242903
                                      Entropy (8bit):7.944495275553473
                                      Encrypted:false
                                      SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                      MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                      SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                      SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                      SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                                      C:\Users\user\AppData\Local\Temp\{EB4461A7-1ABF-4EEC-B6F1-B32DCB635874}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                      Category:dropped
                                      Size (bytes):129887
                                      Entropy (8bit):7.8877849553452695
                                      Encrypted:false
                                      SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                      MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                      SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                      SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                      SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                      Malicious:false
                                      Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                                      C:\Users\user\AppData\Local\Temp\{F01E1D0B-73E8-45B8-ADA8-9E967556BE9B}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                      Category:dropped
                                      Size (bytes):65998
                                      Entropy (8bit):7.671031449942883
                                      Encrypted:false
                                      SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                      MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                      SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                      SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                      SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                      Malicious:false
                                      Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                                      C:\Users\user\AppData\Local\Temp\{F6216C5B-FA3B-4CF3-BBBB-D1751CC3FBC4}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                      Category:dropped
                                      Size (bytes):11043
                                      Entropy (8bit):7.96811228801767
                                      Encrypted:false
                                      SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                      MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                      SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                      SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                      SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                      Malicious:false
                                      Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                                      C:\Users\user\AppData\Local\Temp\{F88CE933-A307-4C66-B2CF-79618F499F07}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                      Category:dropped
                                      Size (bytes):784
                                      Entropy (8bit):6.962539208465222
                                      Encrypted:false
                                      SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                      MD5:14105A831FE32590E52C2E2E41879624
                                      SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                      SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                      SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                      Malicious:false
                                      Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                                      C:\Users\user\AppData\Local\Temp\{FCA9B63D-72A2-4043-94CE-F2F27438D9CE}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):39010
                                      Entropy (8bit):7.362726513389497
                                      Encrypted:false
                                      SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                      MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                      SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                      SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                      SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                      C:\Users\user\AppData\Local\Temp\{FDDE9B2A-0596-4922-B498-A4F7C54776AA}

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                      Category:dropped
                                      Size (bytes):179460
                                      Entropy (8bit):7.979020171518325
                                      Encrypted:false
                                      SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                      MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                      SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                      SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                      SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                      Malicious:false
                                      Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\EeusBfS.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):296
                                      Entropy (8bit):7.310965179765614
                                      Encrypted:false
                                      SSDEEP:6:tQ1qlyvO5PEsMFNIzwgbr7UAY9mxU0ud6687d4046HIhKcQNJ/7pk:tQ1acWPFMFNIsBmG0Z6A546H/c2J/u
                                      MD5:D050661037E65E15012F814CDB77285C
                                      SHA1:D4274D776EDE56F6C377F88E1B4187C8C80A0CF9
                                      SHA-256:4D9260CAAAEDC9DB85352E7A29F5B5022C9ACD7CB6659A563B2785789D859DDA
                                      SHA-512:63B0468773388023B78975F35F3CAA28D4EA7CF34BCB9292E18B072B1DB36B3CF896E30FC3A08947414BC7DD934A3B28DB3B39E4700AA54C04FF17569E59BF25
                                      Malicious:false
                                      Preview:.'p,.=cOp&..Y....esK.....f...N._.s..Z.#'.8+94V..f*.=.J+>.-y.F....!.p..P.......k......S5..H...M..\..AA}....ac..-..s..5.qz|K..p..@V.D...."m.}.[c..~X......si?l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\DsAqJCE.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):256
                                      Entropy (8bit):7.083817994213572
                                      Encrypted:false
                                      SSDEEP:6:2rzLmBeeD0RMAY9mxU0ud6687d4046HIhKcQNJ/7pk:2r3oeeD0R2mG0Z6A546H/c2J/u
                                      MD5:363E8FB4C8D156C20E5FA4444E70D8D9
                                      SHA1:CEFAA3F0D2DC68E954311F93028136BA30D0360A
                                      SHA-256:E2B176EDBC7ADBD71F8BD51D50E4F189AF0E35252EF020C675B4C260D05532C9
                                      SHA-512:5291E52EF7BF4B568E994B0898497DF3E80B996088BCF7F8B79B33B9757E96D2D4CEDF149FE8174839E635640D2DA2DB2B934011CB5B984F06730C4FD94662A8
                                      Malicious:false
                                      Preview:.....p...o.,..O.r..w.J.>.-i.r....&...l..&.......9......FlmE...]6..=.-........=.u...;......G..w..(.'......+.|....Z..d.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\jMGuu1b.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):266
                                      Entropy (8bit):7.21089324359295
                                      Encrypted:false
                                      SSDEEP:6:RNPsAyupITomOyRyVleF7wwo3AY9mxU0ud6687d4046HIhKcQNJ/7pk:RtsATITomvRyeFGTmG0Z6A546H/c2J/u
                                      MD5:601B39182347C41504BD0DD724EE12D3
                                      SHA1:0BBCE57C82BC6CD570D60058FE2AAD9E2DD68E34
                                      SHA-256:6B93F0D29F0D02AE9ADC50B5FA4B82C482AC833C4530BEB081644BCD99C3E86D
                                      SHA-512:89DCF3B6BC81C11BA301A28FA7310A57DD7366928E3660A929E2351C24D5FC73086DDE2A77154428733E60921FEF8DD3B9E2201658388AC661417614494A51BD
                                      Malicious:false
                                      Preview:.o[..8......Y...;..4.v6.J.>.-i.e...j*...p..U.......k......S5..H..l.+...v`..NN..Ea...r...C\k....;.;.>B..?.)....^.t.6.L....l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\LguFA6y.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):67083
                                      Entropy (8bit):7.997242221816694
                                      Encrypted:true
                                      SSDEEP:1536:qJcDTIbWPNQhNBM54M979qoJtmZWGgjwG1SSOLAheSdEvQ6Gb3RlOBJ:qCD0b+KNFM9xWWGgfASOM4yiGzRle
                                      MD5:0BA90267CC530551C53D52A879D05717
                                      SHA1:4B6A8CA5A3256914A21B4C72AB886C38BACF6B14
                                      SHA-256:443AEC3B5CB18B593B8417645DEE4E0671F0B71EE50C3EDDDBDB09CE16844757
                                      SHA-512:9B2FB04E7E731E4609EAAA1751106279CA0632F6081EFF71CBA3C562C88AFFE2E05B6A6ADEDA5FAD5BA8CB99A393BA3D5D69B56B34ACE8435B7B6BE3E34BE4FC
                                      Malicious:true
                                      Preview:.l.u\..to>jQ..62.&....6...W...P.RU.G.n..e.-N.e.[.e..9.....Du.\.|jr.P....T....KV.l..b=.....(F.....K).........04.].......T4J|............K..0F....VWz>...w...a..r.:l.W........G..Y8.......;..$%.5X.^![.7-.L....*8..Z.......EX.q.m...>....i.f.Rd..?0..N..*..r.I..^.n.j.t..O.c...#.P.....em..>.U.$,.e.&~.oF..W .p.-...<5>..N-.:^....=.@....H)....6..zRe.8.T......MQ.Gyg[..t..Jn..........y...j.W+.....v....5..\Q..!Y......7:!)qQ)E...*w..y.Tu.I<.<......n...7F\.9*...8T...%.......70y*..g..4.....p6.L?.=..F.S...{......*}..J.y.V.+...?B[..d..."..~#.=.'Rg..S...b...~s.C.Y..4u.z.k.).".O{R.9h.4iP.2....j.^..B.b.....559.PS.wN..9....C.%_u.x.h.H-..:D.S;...1^GW...g..?GF$.......EFu.U...h.......q..s...U..^..G4.4C.0.+X.G.|...)z..?..2.!L\..!...p.\O...n....O.|74..\..<...Q....-m...4..x....%..%...@?6_0.W...Q.4GL...<5.4..^R.4k...D.Z/Crj..*.3I..JkR.....g{....@e.0..>.WD....M..N..:.....(...6..o+`.;.z...W......D.4....`ie..R.-.A....!.gsZ...g...U.L>....[R..2ce._.d..D.!$J........4k..i...~

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\Parqz5Y.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1017
                                      Entropy (8bit):7.812300661412818
                                      Encrypted:false
                                      SSDEEP:24:1OUDghCDdHQIYVvsoPM6Mc1mp6Cs1DXIq/Kfnz8kAAiG006H9G:1OUDmORVYVkt8sY1DYq/K8AS5G
                                      MD5:81B0DBDDF1F3097D0A5E0F37F534C4D3
                                      SHA1:B653B01FA8DCF2A87A1049616B12A997F60E0A71
                                      SHA-256:A3C19385F50C90595DB4A06AD82D81968136F2D655298651B996718177BDFD9D
                                      SHA-512:3667E5E50D28ED055223A50374DCFA920DFA773EE1A102C7373AC85790BE96C9446A05CD8AB6ACCA78356BA4EF67C64B7A7BFBEF8A2728D1C8E3DB86D99F54AB
                                      Malicious:false
                                      Preview:`)Ll..[..N..;...0d.}._....D...\..F.........|Cwip....9....v. .4.;..1...9.2SP.f.......8.....%..N@L..<._N....K.P..`....&.5..X./9..Yj....#"<...?Q.z.t.Df....X.~..$|.n..h...HkYfkI. .~5m...l.g......FN..cd.O..)..v.....>.v#..1M..,E.....p........l:....p{....D9Cb.(.&..|....2..9.M..j...q*.$X?*.^.qbl8R.".cg...d....S.6.(........#..JJ...|.<...^...8.q..`d.....#p..\...F.*..)oX.....f.e...p..(..X._........=y,|..\..-Y......D:&.x3.Bu.....K+H63..>..cY#....8@....1.(.F.6NO..... ....W...g.}.....+.@..1.~..)I...3.*.e.n.j@2....._.....c..<.Es<..@s...T1kO%t ..L2yO...O.o.ydj.v.e^.r.....mNx.....q...a..R......S<r4!.....Tj.Z....6....Jn,^....5R.....Id..p.9..&.oT...&q...+........m.+!.C.Jo..}....9...B|~..B.r.,..l~,B,Z.J >....'..1c.;...J.3.?"ZBZ........e.tP&.\5....,.y.sh....o..PV..]..s...I..........P7.0).Mr{.l.{.S.6.T!.}....."Y..B...c.Z.9....^s".5Y.._.5..vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Iw42v2J.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):14703
                                      Entropy (8bit):7.988278618726142
                                      Encrypted:false
                                      SSDEEP:384:GWb+XPLiXwaj5bqNQDFkJT8nOXT+ItG4vNm36h5:G/+Xwaj5DSJT8nQiItVVmKh5
                                      MD5:E41F0D3835FD8450D90C43A944E83F23
                                      SHA1:0C8EA66965C5AD9DFDEDD9490797E271F8BED4E9
                                      SHA-256:49CCD1E63639AAD567F5EAEFD32A55ED61A1EDC5F3EBB92CEE0EF0A8F174A4C7
                                      SHA-512:A909FBBD1C6711FCF483D96B4A48120C7C0E583D1DB69CC5BB3A15B5CB4A9BC2FF1B4F668DEBB55A9076F01C5C791FA97AC1444E0904AFBA0C00D2164C8D58AE
                                      Malicious:false
                                      Preview:~iv.P.z.n..P...C_....w....S.7..4.}.g`).......d....i3o.-....8.^..%.... ui".px..1!:....H..Qo...Rv{.8.9!V..R......\.....&..._...[..I.2.a.$.T%...Q;,#..........BW.P..S....lT.............g. r.~8...L.-V......T*.......%..#.lc..k7..z..F.e...M..x........[0............o.%...cDK.7CP......`..../4.....h..O......BY.Y....1.!....,@.oq.w.u ..........5.;.{ .O...t.UX.JI...*..0..3J57..v.....K........J.)....r.....U.....-4.V.M..<...,9q.......j.......4.eC...U............7....j;..S..$on=.1.m.^G.SC...V.O.6crE.....oil...G.s..H.9....Q........Q.>.u>.bg.I.8.3.d.......P Oj...r...R.....x9...:%...'...L.?..2u1....I...{E0c"r....6....n.2qq.].....F...GZ:G|....UU.s.$..E..zG%..AF..a.@..L.1..[......j.....tz.........W.bt`..Yv.8%-..k../.8...{.*y.v..S.."p..!..5?.xV}..'....0c..b.s.!..........{......q.IO.D.(.xQ.JR..xy..&...W..DSJ..w#.b.d.......[kB.bQ....q..qg.*..!.pR..#........b....@..!...@..K5.g. K..........mH.u.....p..h&.K.D....Q..w.@..Ng.[.OL....T....TW...AZ.+F.s......Ma.5.F.,y*W..h3.

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\nMTmLaK.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):10483
                                      Entropy (8bit):7.981732483364612
                                      Encrypted:false
                                      SSDEEP:192:xc4g9hFX1qs/qMuMVEMd4+6C8I58OtQ8+F3KuhBHASM4DKwYsH:u4g9t/qu6qd8FfB3/2VsH
                                      MD5:00976382FB180BC137F3539F0ADF3AC5
                                      SHA1:B3FC47B6F711BF6C8416733F6D3E5235F39AD761
                                      SHA-256:AEDB95704F6F90F38880846A42D239F308E90B00067B8310A6274FF3EA4F29D7
                                      SHA-512:54AB8213C7ECBF29B63952710F94F173E1D1F6918A3443F9A68AE68E9F701449258D2261EACBCC567FBCDE20277AD46998C4BF21DC86CBA5701F684AC027D6EC
                                      Malicious:false
                                      Preview:gZ..0+...cO........?.u.4..H.c:D.Bs.....3.3. t)l.........P2..u...\.vSU..`.f...-..y/...{G.+...6...m[....'>..d..p.5..$9..].e..!.Z:.s..n x$.S..<5<k..-._K...?.b...E>..s.h...x...(....../Ri.X..F..@(..C8.3.a....._m........h..8..L..n...b.!.<....Z.m......2G.....6...6r..f.@..xE../"........vSv...=Hf+..J..}1|)[..{...))/.F.Jr.l.D[r?.C..<.z......x.O.p.5....%..*1.#....jx.[..*.V-..3...'8.?.G ..e... mn..4m8.h.x%.`.O."....>...m.....-..V..8..O.p..U...?({P.8"...0.PfB..W.{T.......4...C[....S.r..?@H..-G.,.,...C.....\.O.E).$!._....`...n....-,p#+...x~.z._.B.^P....`H..H..kN(...J..=.}..:3.=.E.......*%.'.MX..i...\...B....,....'..*>.F.....y^.....L...W....''.M.3e./.W5.....g...S.&...J......=..).&......d2p ..'MeUe..T......dt.-.ln.MK.cb3..Lh.F...Q...^m*..L..z.h.&...2..3.....[$?<8.B.9....}$QQ6?.......It-......j..DKM..}K..a.QbXb..$..F..(.......V&...r/g....u...=...9.K6..^.Z.l:...h4_.......kCF[Q...t.).ItVc .r.o+..g....4@nc...1(..........<.t...nJ9.s......w..<7.0..D.c.5..W.

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\qDzjXWu.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):24396
                                      Entropy (8bit):7.99181899470434
                                      Encrypted:true
                                      SSDEEP:384:RcIWmWx+QxeewsvUhMAfSXdGzqeLgjKKTpIYIfW4eZMWpJ+MI/wt0LLS0/8pRXLN:VWxJxersvUhMsqeLgWmue+XM+wt0LLS3
                                      MD5:57D2B6E05C21BE164B33FD299C3771D4
                                      SHA1:B35B553E180918BBE002BFAD0F2B1FCADE84B6C4
                                      SHA-256:1BC8841136DEDE4CF8607753081E7DAD3F5A67A29A7FF50DD4BB14DECFFB6501
                                      SHA-512:C1D3C592E54C972F811FBBB7DA1335FAAD3202DD76D08B7D96DCD3F849D96F314A4697BFAB6461726846A111ED66D8266AD9005AFA53579061751C0C3FC7EE1C
                                      Malicious:true
                                      Preview:.R&s.TUe...@...I......+{..v....{...b..d.d\$....\uVD....wD.Z).k..tf.Xq.J......e...Q......%D.At./.\.....:.).....!\b....<.NW|..M.*.......u..(,l...-.....+....s.d4X)K:..$.+..8..9B.}m...=......+._.c_eS......5...!.........5.......5.~%o.w.#H{.t....S..{b....ilH.2.....k..b.z.J..J".%>....]S ....q.~.$.[Q.(d...S..K7.m@..+..y....b2.hJ...5...E.s.G.\.e;B..X..[..C@1.H..P..O.r...3r......E..S....[b..oX}(..a...TX.P{..z........5~.~......Z....)w..6y.H..N....{X{../m..0.mx..$-]/....P.o...dLZ...[. ..\L......CU.J."Y...q.3.[1..$.UD.iXv.?.b..1......XZF.XN<.fTu2...o..m!jj....A........x...Jn..L.>..D+ :..*.).p.?.I%..f[..J.x$.4;.dq.&.......F.4.<...)....,-..i$m% /oK|n..u....z.ivA..S.|.5...L?..Bm....U..1..........%D..^....^@..p.:.(!.ifJhg...'......h.:?.k..5.9..AV.....a.J7...w...n)..{D..[.|..N .$L.../...Y..2N.......n...|.d.Y./.c).L..e.+2.-...e5.a.....G~no.x....kp.......[..9.._.4.bKx.!r....:..Nqi.V.A...p0#..-. ....L...I6.U.....xm..cV.g.t..R6E4.#.#6&.........q .s~.

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\zhVIYHV.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):509
                                      Entropy (8bit):7.595724463009402
                                      Encrypted:false
                                      SSDEEP:12:48sQS2t/9HOa8YkSaM0SrgFQ63cFuZcmG0Z6A546H/c2J/u:48Bvt9DNZghFQ6MFuRG006H9G
                                      MD5:7D770C40B506FBEBAE391B5A056DFEA3
                                      SHA1:35CA44D8E722DB647762FB463156003430AC6EF9
                                      SHA-256:16214D777807D1F9561582D16A8E40EA884CC4A19F8164B51575B72D4CC64542
                                      SHA-512:6BABC985EE6D4345523D169AAAA196D060E58BA62BF77C7CE8A39097651A9D23D21B7D3D58AD52E74366F425BC77A4B0051A4986CD7736066E82EEF6010DFD39
                                      Malicious:false
                                      Preview:...R.=.p...|...&y..u.fpE....x.UE7.,..\!.i-.?..0....b.jBt.6..........<.Ke./.%4..D.AF....S...R.>Ia..E....tjl/..e.{.Y^>,;..,.x.T..q.K.s........%._.TM...Y..hW....E...R).....x.4..R.C..Xc.-E\A.f.C2.T_G&...gn.LD.....J.......kN..@ ...{.&9......$.|"......kU..J5>.-x.S..w.e@...n..3..y..).9......S5..H.....(..a.LE.....@l...<..~............b~4....\..K..-e.Z.Vc......v.o.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Wp0Wft3.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):274
                                      Entropy (8bit):7.2337720246108175
                                      Encrypted:false
                                      SSDEEP:6:YV+d+tXTMPDFQaI5mYmDy3AY9mxU0ud6687d4046HIhKcQNJ/7pk:YUgFMPDF05e6mG0Z6A546H/c2J/u
                                      MD5:2CB2530FBF241D8595FC279101148587
                                      SHA1:9C7FA556DC5C66C9C5E9A0ED74B6BAE7D0AC25D7
                                      SHA-256:5908E89F896070AA3C1DA5CFAE57BCB6E6CB41C0FB80165F16D1357614136A27
                                      SHA-512:EF5F9AD2383EEE607540D62B00A8140A2EC7904FDC1830A5BDCA411C5135B4B524A7778DD6290507839BF887ACCA209C93C92B1A99C4F45ECA671D4BFDA6D4ED
                                      Malicious:false
                                      Preview:]0U#."`f.t(.=........V.1rb..Ga%....J+>.-d.U...j&...e..&....T..9......S5../C.B......V.....C8......`3.^&Eo]~q#.f...&$=^'.$.....Y....'..h.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\CRLogs\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Flash Player\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Headlights\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Linguistics\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\LogTransport2\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\RTTransfer\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Sonar\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat

                                      Download File
                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4456
                                      Entropy (8bit):0.43966131866883024
                                      Encrypted:false
                                      SSDEEP:6:zJ/VfVYyfhcD1RRXUn/cXb33oI//Bm/eq+J+/KRujslll:zJddYyfmJ/U/cXbH5RWeFw/6/l
                                      MD5:E4CEA39A4D42BCC37CF66873298E38FB
                                      SHA1:BF03D75B22BF68589FF55C80673956B044035C90
                                      SHA-256:026AF7DEB31198148B5AEF6DD90D706384CD21B75C0A40D89846922DA3A33A11
                                      SHA-512:3352679FD80203633107F99DAE700AC795B2B8831A26D32885A11DDDD6D03208EAE67ED84126011BAD7C6666D0CC011207E8D964233ED6AD0F47E1526498CD33
                                      Malicious:false
                                      Preview:.%c....L..=../\u>..].9F.#&..4.1................?.....I.......*...*...*...*...........................................................................................h...........................h................O ....F..@.F)..........Jb..+.%O.K{................................. :.. :.. :.. :................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Roaming\Mozilla\Extensions\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\lsVWqps.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):267
                                      Entropy (8bit):7.18494010398541
                                      Encrypted:false
                                      SSDEEP:6:/4JKOcyTCVVuchN/vHxI9e0YoZAY9mxU0ud6687d4046HIhKcQNJ/7pk:/xOUVrzRIxYolmG0Z6A546H/c2J/u
                                      MD5:367D46F990FD9F09D6E2D22848FFB2CB
                                      SHA1:1B579F6A5DB80B785E122CCA21104AA1FF123670
                                      SHA-256:E7C48E6D68E7B09086FD04425F9D8BEF8A3ADC3B5047A8391440A738AF3F3787
                                      SHA-512:516198FA7ACD6FDE1991EEEE050CDA7AD3B67B73ECC6F1AE1A860BE03681F5E4BE2BD4DAC78A98FA12F55840E49A7652710F2E84AA51CA91A35B1937FA80EF4A
                                      Malicious:false
                                      Preview:J3T.K.B...J.>.-..W....!...p...........=....k...a.......x.}....w....6.`!.x....!g.....}5...8.>...fB.R(..w./."..o>..g@'......Q.{.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\9JGPaqf.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):285
                                      Entropy (8bit):7.15986321961359
                                      Encrypted:false
                                      SSDEEP:6:ICPBcxgeGPUFiMPDFQuu8aeNkPoy3AY9mxU0ud6687d4046HIhKcQNJ/7pk:ICPBcxgvPMPDFCe4pmG0Z6A546H/c2JG
                                      MD5:BA3542C9A34B101286B45D40478DAB55
                                      SHA1:DFABDC2E3CDFC4FCD7EDA84957CD72C51C8CED48
                                      SHA-256:D3DD7198710DFFDDD56B01E7A8E9D3D2FDCE8CCEBA7247E7F7BF2BAB26AE4D0A
                                      SHA-512:3F5DF818ECA79D05F94119EAAB523780657239182439EC46872CB2AB59CD23F74089C02055F8DACAD65D52FA30E0143FB5BAB39A1F7338273432D2A1E5B35AB1
                                      Malicious:true
                                      Preview:....._b.....>f.-......Q..".Y..H....l8.{..tL...J.>.-n.E...j"...e..&....T..9......S5...|nb..v...t....*U..0P......r.._..h..w.j..P..z....r ....t..h.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\8czvcgD.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):288
                                      Entropy (8bit):7.256391147125404
                                      Encrypted:false
                                      SSDEEP:6:y2ILkxxzaGOssvtaovvKuaETJXAY9mxU0ud6687d4046HIhKcQNJ/7pk:tissvtZnKuaEFzmG0Z6A546H/c2J/u
                                      MD5:6DB643E9AEDA4E454BA543B0E8245DD8
                                      SHA1:096942F5D041A9887EECB91748AEDCCA55CBA23A
                                      SHA-256:1133A7600C06C2C82FE2F4F3B8DB506C624E9308A70C57588C5DBD9C810D290F
                                      SHA-512:AACBC0658989C55A4D59C9ABBEB5BC7CBB0E95FF6EFDB1F3CB56A24FDF82564823109D3B937BB6C5F72F415A898DF8773AC522C37D6CE873FB56FEB3C480A707
                                      Malicious:true
                                      Preview:[(..R...LE=k...H...n&.q......<..:.7yP...ul.F.J..f..J.>....8.....@..9...3.......9......S56..p..>.!x.....v..<Df.O"...{....8.9..s../..-p.e...K.$g.%M..+/g.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\KkkuZjJ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3889
                                      Entropy (8bit):7.953759707371593
                                      Encrypted:false
                                      SSDEEP:96:0cofohylDMIUjGmnM69Ai1QQTmwjrqpSLH9xiQZY:3Z8xmnM6Ai1QQTjaSL9x5Y
                                      MD5:59909A26B00B6F2B3AB9B389EE57D8DE
                                      SHA1:9082F7583211F8FC07CFEB1572CF93411DBEE12C
                                      SHA-256:E39750F55CBBD4AA7660F2E9DE24E4C4018D52A711B002A3DD93FE9486A8DD91
                                      SHA-512:48EBAD4E0CBA1EDAFB4A84ACBFDA338B46D3AA5DC6D27D244EC27187DA374E3619225FC6841034855D129569921D64130FC30BCDE59A12203B5C66358ABA217B
                                      Malicious:true
                                      Preview:...o<...~.#\....V.R{.7MB.4.LG.Y1.x..`)..*.c.=.`.r.d.*M..W.....#..r.....LO.p.....\|<u..j...i.......3.....|s.]..%.u...b...OT.n).v..E.d..x..A..^./.........(.E...X...r...:.;..$3e\8^m....(.JB........M.1.E..3.(.....*wz..FT..5q.:..)..T..^..NZ.....k..3......m.S%.jjJ.."T...G.....b..Q..b...W}].>....Q....:\o.s.gv\E.)...Qnx.`..L..iBf..F..vT..u|RJ9H...0.G.}oJZD.=z.T...4..0.......U(.G.`..p...8.C.{-x}W...EB.x.z....!.......Ck.\......a....$..>]#<:.....B...$..'...F..T......0Cy"v.._.d..r.*p....gh;M.+.KP%.i. .4...;...>.."...Aj..z.........d..s]....d...h.....{..q$....U.G.a.s.h....#y...G.q...o%.TI...3....nM.[...=.6.......0L-.....d......q...E.3:S+.2.q..z..g..T....P.)..2..]..4...P....~..7.6..4...*.w.$.5...#..!.IA.....SNgG.\".1.I-....#..0F.3.F...}...o.Z^..N.....R....y..k.....~.t%U.<._f=.o..4M.J.;|{.Q.X.Z|......X..x.%M<.SZ......+]..d..iobjG.7.0w.j.#...~~.R...T.. ..O..DJ.a.B..>...G...#J=.......m._+...G....Ag.IMa..]h}...Wcx...T...H..74'Y|Z...V. .P........d_..m....l/..y...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\Ld8u5RW.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4651
                                      Entropy (8bit):7.959200738578874
                                      Encrypted:false
                                      SSDEEP:96:0/WSsaEt0QtqXlNEYNjZbBLZVxNGMx/0BMA0na0bmn+/oW8CPzYwH098l:j5tttknTNVJZd10BMA0ahn+/PlU98l
                                      MD5:3BFC5793DDB76EEB94E7243F9D47C4BD
                                      SHA1:24A26CB0A48C067C95EFF99B951F15CA8B29AE68
                                      SHA-256:16936E8D9FBAA7B8D4FD7B68A0D10F6FE29DD3CB90727E66E7777CABFA0EDF5B
                                      SHA-512:0125D23C4709B8987AD2A1E3987B07DCB0B8D74AB034461C5AD000A2CC74CC50C3B05DB5B7E928516660105A04EAB764BC3C7C1FFD812BB74E05F55F7AD631C8
                                      Malicious:true
                                      Preview:...2.......g][..\8.k.q.u.A......0.z=.X. ..L>...S..(. ..C.......\~.]XC1t..Z..../h....$..Q...KZ..g...............=..........s>.......3..,..F.v.9d^S-...........$..&1'l?"O...-:~..y.mb.Qd.A...9*..+.4E......g.J(..z!...F......\.=..'.*..RJ|..w.L6....\...0.h+.#:.L....u.......p............ oG. W>.n....7.......U^..r.9...........C......M.d&.{|.......5.A..(..B....{..r...j7..\+.k7h.5Q..i..:;.u.....5|y.p.^.N.3..a.b..%pU...v\E.0%....V.o.8.....iD6..Q....W...cU.Ml'"..4^........E.*G(.d=.F*..../....)Xw..4...%..#.E.*......6...UF...y..Q.L.!....0y..O......SA+9,~R..d.....4.....D..bJ...*Q...@..nB.......%..D%.a..y.a.H*\....j.`.../....."c.......t..Y..a9<y..s.;P......7....w...O.!. .Z.Z.....*pP.sD\B...t....B.r....7[T.............W.#=0.3.K...zrw:.S).VM...B.^l#.......E....."-..Z..W...@Q....f.]l...0.g.O.BA.f..[.]......x.....&.....0..8...~....D..'.....{..e....tw...~.X.=..B`eK..kn.............?...J.^`...... c\.jM...6...O.p.(...r.c....z.v.-.$8....q.<......9....c..A.x.

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\Lz2qrQQ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):13904
                                      Entropy (8bit):7.98770142955157
                                      Encrypted:false
                                      SSDEEP:384:oKoXVz0JfjFoxp+RhxvWjdzIpFhlxi4d4wabroCAQOaokCJk:v0zMfAAvsIrjdd9av6L9k2k
                                      MD5:40C3A4BF6752DD417DC12C0C4611D7A0
                                      SHA1:D06442F9D4EABEB9E2EFBEFAC507F7F14278B009
                                      SHA-256:54B0BAD662AFE583A6956A18A597BFBB6AC8685673F7CD7FDF7B8203AE291272
                                      SHA-512:60B27910D2A13D32240CCB1343B869C63B5B79DFA315361C4C10FED127582C2968B20B54D28B9F00157900B738335FDBAECAC288AA1E420C1E30FA9CF5E34062
                                      Malicious:true
                                      Preview: 7c.Fq{&b...).)Se.1...... Y..h,.t.`...T!..}....... p[.Y..m..j.3..C...........O/.R..KoY*.A... ?>.s.........pF<...J.._i.X.D=.}T..r....m.......FJ!.L..)...v.8..].|X>Vl......!......X5M.t_......QY#.......nz.Wx...*.`.`{..V..h.e.>..7...+.G %.@..!w.<.e|.a.x..j!..Y.~1.:.n.........a.....$...X..%.!..p>k M}.+.:....V.C...L.....RoH.....N.......f/.S...0....6._.....{ &..^..#.O.M......1#.....;...~....u3GA..Q.j(....=g...2....%...,8.@.}...& 9.:.T.S.z...*.i.o.p.y..P....f..X...\'...HE......>..B|.H....lH,2.^.T....".;O;....W.F[.=i...J...**)f...a....>.p1..+....{.......A.7..GS...m..M".7.)+..:i..g...y...PO.m[ .v......,1.....MgJ.....C.$..L[O.hQ..voR.1.bq4,.#%..w*Gx.xRG3P.E.....i_...J...Hy..Hnf..&q...}...IU}.%...Cs`S.e'..C......6..N......}3..)..P....~:.iq.F9...(.W...'R...}...A.z5.?..K ......1~.3..'.&.9s.}...\.z.....[..?n..rq.......S.4`;.WY.......M.H......F.I..T.?.7n._}..G7.B..e..u..(h...E.....'2.a...,.-~...M....PJ.s.^<....&[.....3.....<l.d..9n..>...gGI.O|....8

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\aRnHayn.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3821
                                      Entropy (8bit):7.95567506734055
                                      Encrypted:false
                                      SSDEEP:96:zVmef81nXxxWdsfEA8kf5nX5BSBf53+zFqt7:IeE1nBYdR0f5Xax53wsJ
                                      MD5:FF930E69FA7CA98A5D54B7D9330AB462
                                      SHA1:E4A5FF13A69F4A210D2C5980DF230F7CC838D327
                                      SHA-256:3CDE14114B2F1BE364DCFC158246653BD09CEFA305E56CEAE89E33532014102A
                                      SHA-512:35E161B605D89A4ADDC4E96E579CE6605A1826B19D7D06E410AB91E3751619A53DF9F04095B9929AF0D65096767BED1181711326AAC0EA0573A30BC4FE803AA1
                                      Malicious:true
                                      Preview:.,.u.A.:f....*.R...|ofj.0.G>......c.r.}......g..X.|..>.K.0.....7.ck."o'...(>o..{......QT..3...M.AY.P...5(....3HX..1..6.+~e+.....M....G.........P...D......Fs=..'b]....Tv!.../h..>....28`1..67.....b.mf',a.+.8FDm:ux..:..y...bp...b.he ......Q.....V...Y..t..w..........hsH...n..7...T^....._:m_W..FNy...=^.v.A....>...fw.9...S..a.2>..as3m...m....Bb..w.K?..4...='}..P.!?....},.m.S..%=...k....L.....R.>.....&VRc.[H...UF....".....a..9M....0.h..F)......30.G ..]L.r....X4.........=..k.Z.s..W..,..$._.....W....s.N0....'/.>S,......m`...]%..r1....#_.3....xJ$ky....GT!.-5-.4...{.a=....L...q....F...1..n.....].5.?..Z#..P.v.X./..+3. ...wk,N....9h..fv>._.*..0.nH...GIU...R.w.....JP!F..(.1.c.....V..|6m............!...u...:....F.p.?(.....u...f....[x"f7q[...9.7..I.{).....}......h.<.........<.......f....}..P.=.-..g\n.../...r.H.[O$$s.....w.?.....K.D..}....y.T..j....GD;.g.C...R...zHd7.=H.....k0.8.....n./.....T/f...[...B......5....5.......Q)O.Z`.:..4..j.zS....,@8.'..s.%GV..B

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\c96bazW.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):15402
                                      Entropy (8bit):7.989240772561882
                                      Encrypted:false
                                      SSDEEP:384:57INknkwkcGz8cM8lmnEdpdaD27trXK1OzbPu6tHYaX:2NknkNgR8bpwWxXcOzbGU4aX
                                      MD5:96A62BC96A3FCBB64BD555804EC335F1
                                      SHA1:F895D593FE97E59EC5B86F66BED9D66A6A38007B
                                      SHA-256:3EF9D0EB177793DD77DAB4AC89622197901CCFA5C241570B6AB94196D50C4206
                                      SHA-512:1F49BCC52F0184505DE6FD4C04D29320AA043F59224A07206B811071A8BBF462E5A6B12A560230E42F38DC4D2A41A1D51F11A0DF91AC91E8F9E039FE0697B66C
                                      Malicious:true
                                      Preview:..9...}.........L.B.1.4CA.#..!.Q....>;..|...0.|Y.mx.w...pk..h.t./....L.M..PDj.JR$.@:..5.....}Mmd..a...o}..V;..Z..jy!.{.m..&.]...z:..)..`..f.(.P..% 3W..l.......$.G....f.4..&.m.\}:.hz.N.f..g...Y......(.........q.E....*.m^D.GJMKI.(..9/;..i....^.{...d..|.#.l&...y..G....(.%I..q. .>Y..fl*TBS..Y.U..9.N...JHHN........8..]..1.DBL?.%.=......2y....z.c7.c......j.Y.`...-fxzSS~..e<......t....,.qL.-rq.V..O.......8.,go.....K..x.b..3%.Mr.#RQ`...u..:o.a....b.-S'K..;.n..L..V|;...y....Hx......4.Yd?vY...|.]...A.]x.P.!N.$........#..y...........?u..x..~.5._.m...3..%.1z...|1...>.7.s.A.~..b.@...p,.LdN.4.T...sJr..4c..$..(...gf..{.!......).1.HC.d;.Tgr.W..8.....Hf..q.n.._..Z^w?Y..g.#`..ob......D.Q.......*..Y.l....(#VV[..?. ..W..z..#^.`..pr..p..j..........U..}e!.aso.3..=...|...U..-..=._..(.......?o..Z.Q...}`.:0a.C.+..V........h.._..I....b.?....A...I.r...3...T.#..>.:.....L;.......>B.~.....7GH...M.\X@tXi.5t`s.....V..*?.P..3.....v..+ .........y.Z.U.O.,2..X..S?..=..d.

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\hSbNHKN.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):746
                                      Entropy (8bit):7.714778744687572
                                      Encrypted:false
                                      SSDEEP:12:Eic8ZJJg7dKzgXYUhgtfYuZGtAzsMEZvgutk4mHAAqt8STa9kYytrpcmG0Z6A54d:EkJJgJSgXUyfk4mHAAqSV98FbG006H9G
                                      MD5:F2404F73EEAFEB8156D8DDAAF975A951
                                      SHA1:450D8A8FCAF42F8DBF1452BE94920B74F88E3DD4
                                      SHA-256:C8899849CD831C81DC945B289C71282F1DDA243E5FDE72B4BED5EF2FE5E12D73
                                      SHA-512:32F73DBD2E905FB2BE628E98EDB6A2B0C58EEB3E2E221BFFFFA66A6943C3C5348B2763B15849C9ED190EF6807163447B123C77E5170415FC9FCE7A962F880EFA
                                      Malicious:true
                                      Preview:,[..........[,.M.M....?...,.....N...y..M{........K`..L.8..:+(]47..K|....'.+..IMR.i._!..L.....n.\........<O.....C%&J.[..Z}^=.C.F...............9]t...(.8...f.t.,=......`..W.3.[....E.<o....|...^.T.#..R..)......*.2.y.[xq.....<.Zp..!#.....ew#!..p'.".x.:...*.je....o...Y......`*.?di...).P..M..-.^P;..V.&...N..Bh...#..k../*.Y.....N]V0..P.:oI.Dt.B.....s.$.._..]..._....E.).....G95.....E....I..H.[g...KC.l5.W.{S...+;Y...%O*gc...G.JP>....;...C...w.<.._......... .Q......|T....:..M.?y'..}B..)...v..&..,0.z.0.k.....8(....p...r.4..U.9.<. w.....iex.....^....U1L......Q[..d6.Amk..&.c...(.......vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\nZXNn6b.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):13912
                                      Entropy (8bit):7.9877899388434725
                                      Encrypted:false
                                      SSDEEP:384:hkEsGVPPjrOPu8UzDWQePPvtj8rTn9/mxbEVewR5V0d1:hkBG97rOPu8UDY1K9/m6xR5V0d1
                                      MD5:E7313C686269316CD80D9F0A228E366A
                                      SHA1:C94CB26127AD29D9D1DE68B5C038F11EDAD33D26
                                      SHA-256:A68E4235A7088296BC1120727013AA86242767E67E4306B5895EB6C45A23D52D
                                      SHA-512:82DE3D60F58C97AAFC9F3B2F97AE0D0DAC8F5EC71D0687652A7088B8F8FC7746DFD08BB9A6FC9EA598B40041D19EEFCA30EC2D16696252BAC09B5937846B7931
                                      Malicious:true
                                      Preview:..x.A.'.(C..w....e.}...^].x..C..*.I|.....M..|_..3....Q< Z!fh.;.=..i.A!fN.....<.v..{..-.|..<....../m.n.i.CR>.|.....a.....A....d.B...X.C.QN..........A..........T.l.,K..f.....&,./..)......`..h......4u.=y.z.l.1<2f...i..B...;.\.mXI5H...!....&.@@h'.^U.../.g.bE.<6..WX....x..z=.......b..k+%....&....A`....fJ6..d.T......|b..x...-.5p..T,h{.....-f.mtVi>...+.@^..3y....1.Qz.K..N...P+).....G...B&..O..O.>.O..TH..\..x.f..8....6n......3p.....[.M._......A..3E..-^...~=.....*...F..G.......7.2'...B.....MI.;`|..../.,..N6.n..-...N....;..5.|>..t.........9.!...H?...uM..Xr..M...3...o..F g-.0G.*....r'240...Dq...mT.y7.C..z.P..... m-....9d.....1.gnN"=.&.z.<.......F......;1O'X[..%.>.bm?r..e.....q......bpd.H._.'...&...1.3h%.dL&..>...K.(V4..[2Fdh.g...(*^.k.....w..&.E.".........?j.o.W.|..f..}...%Yw...R.hB.F...5DKub./.a..k.?i.~.8.....-...F\e+.C.w1.77..'...ZE.....}.D2.......Y.'..j....y3Q..2.=..u...._F.Vj..n_m.>BzUf.|.2.......p.....k.}T..75.o2g.G.Q..}!....ib>.x!$..d..B.../

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\vJ8tVKk.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):748
                                      Entropy (8bit):7.725343109543226
                                      Encrypted:false
                                      SSDEEP:12:xTK3svVr4NmP34ZNTrS2pqKyfndhVFGuqRiFH9u1hyabjw/NqKBJmG0Z6A546H/A:xTx5qmP38dpq1fn2uAid9u1hRw/NXuGH
                                      MD5:13EA71D15C9ED59CF2307EC0F5E78922
                                      SHA1:E6B44A814AE9804F7BE114EC2195B91C484F936B
                                      SHA-256:D1DCE35812B5D782B8BB7DFFE6396FE154AC803B65ADE986391ADB4EF086051D
                                      SHA-512:D13136A313ADA72134876D994354FBDF7821DD3227E54F1073E2D2501453B86730E5705492D0C61A0FC8A020967C54C422DB4E358FD90B414108051CC42959BE
                                      Malicious:true
                                      Preview:..X.E...O...................n..zDI.y..E.-.eI.....a..T.6.0..:8EsW...16..@:..&.og.C.&.p...E..M<P.L..C0.v..i[j...{C..h[...6M&......I.K.z.4......V$_._..z...]...m3.+df..O..6...3:..h....K|..1..]....y...T:....I2Y]~...q..)#.~z.......8....8i.......I...1..j]O .......(...p..3=.*....... 1../_U..=n.o.f.m...H..^Z...b8....-.o.;.`.|.l......H...Z.2..E....S'.0^J...n.?.....8?.o*..m..f...\.d_.j5TC.I3.O.dyK[`&.y...K..(..4.b......}?.i.xn..#.JP>....;.......b....."X>.......1.g|isq...."..0<..s.}...H.I.9..F..K...:........2.<.....8(....p...rXd...;..]dX.@7|M..L..!..K.y.D..l.??j%..A?dY....UL.Lp.3.......QS..vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\1rF6mO8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1652
                                      Entropy (8bit):7.87698705591528
                                      Encrypted:false
                                      SSDEEP:24:lvTfRVIJ3iqTl7Ya5z8y1k+42QrD7L4i6chrt7o+iSOukvogLfAgtzLG006H9G:lLfvIRiiz/hHqLbxhRtLOM+fAgtzt5G
                                      MD5:766CC58807F5F3E39EBF54D00E873368
                                      SHA1:A8523FB2DE3E9A1E1B03E75F4E684F7B21458910
                                      SHA-256:64BA1D6E737C76B432656F857E206BF683BA53BB277D9DC38219E39079426FD3
                                      SHA-512:6DEBE33E0399CD18C72DE69838A1B02C7382A78D0134BB9E30C6BC24EAEA208CAE1150EDCF4D2EF7F053E66A31B49FD9BF08001EB1A96446CC3FC3982BC2F5D1
                                      Malicious:true
                                      Preview:.A.,>.....(S.k...t_.I..2B...-.......@.PD....8..V.Q"....e........9W...>.^......N}xF.,W......J.d._y..0./.M-q....d..1.>.|.<..D..w....AEU...Y.-....&3.|.y.QU...O.......".xB]F.<~Y..q.!. .<N.9..&../.B.g!.."C.(@.......1..)F.-i.{...R.>....`.6..D.............u........y.*.z)..?.CY...K.6........f....Wn...(bA/"..f...g..gr/....T~.....M..O.=.pIx...1...!T..7..7.}.".m.b......f.!....r*..t......hx.N?.(..t%0......)..Y...;.G).J|}.4Hk.j.c\.GVXY.R....0OG.o..AM..RP......i:.G5w..u1Y_}.n..x0.q.h.M....7n/Z..&M..D..K.ya.....h.......,9..Y...:k.5x.....\Q.....J.).;r..=#@...Ey...To.3..h...[......?...P ..~........N..^..*..@......a......+.%..0A...Sx.;...L...+../....%.{,Y.t..~i4...t.......oj.L.I.....j..e....Y.o.P...>P..\V.!..zIN."~..f... .qA..w....!.Y.F....;..Jf8[V..k.-GGZ.. .....U..em.j..)K8?.6.X.w....n.|.}6.4.(r.'..r...N......%.....1.N*{.].VA....l....-....H[........Q0c...z..>e..........B:.ew...s.....k..us.~<B]R.C.`Q{..&]hCY}C_..5...R.".]....|...E.JTB..a....

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\xr6C18v.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1597
                                      Entropy (8bit):7.876488222110593
                                      Encrypted:false
                                      SSDEEP:48:hzPLADD0fAwvLpvqHBIatGkGoqDJcrsVHe15G:lDAH6HThqHBIackj6HH
                                      MD5:2736CBC4A23383459D78DB313CBC7F68
                                      SHA1:2728DB08AA45E8EAAF310DCF8A4177392AE8DD52
                                      SHA-256:04FBA7AD084045448AC3890A3672FB30A9C1554A71910460C32290902C44B79C
                                      SHA-512:4E65C65DE2C568C2CA3374A6CD5DD839F81E8B947FEF6FC8D568F18DA17EA996BB4DA4F1C05BC5D589CBCCB0EEEDD4D27F254942FED4FAD8C68F1D7BA8B7B346
                                      Malicious:true
                                      Preview:T.^...a.=.k....]....q0+.%.V..HHj.X..a..f.......b...}=^z.0..:..~ZS.P4..wf.@=.Y=.7..t..S=N...$.Y.1%.~.h. x..>.[K.....c.<Z.....S..,u.KO.......q...T`zs}.[gF..f19.0]..~..utV... 8 .r.:K3.,srQ....;.5.P..<....tR....N.'...7z.C'".i!........p..)]k.e.v..;_..}..?...j[p1...8.=.....m.?.h#;..XO_..Hs.....c....-f+...@.i[F.(O...p..3..Q..L...Vb....&Y........;.q} .7.d.e....3l.O..%..Lh.:K$.e...^.....@..X.U....z..Hm=/...~3.."A`#).......8/..b.........t....)K.:.....[.t...%......i5...p..I.....W`...X.........w.5.?NIoG^.B...ad....F...z.AF..a@..9...}zxW.MH{%.{Q.)..t.},..........!....28..n.....An!..[.....xU.[.....R...e.5...Y.R.{..>n..h.h|M[..,...K IYx.............bz.....hc....F1.r...C.......T.L.?.K. oi..Q....).6|.$.f_.Yr....`..c....f.nJ...k}h...d'...e.G.P.m.M....\...__.w^..._nr..).....'....E.....o#_.C....5...w.g0.#...r..9pj....Ws%........q...z..nc..t.".d....5..\..Y.$[s...{K.F.W...2w.T-..........(.....a..}z.L.y........~j@.{.?..Y...ci.8/B.d._......R]Y..J......^!..+..Nw

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\GveHEKL.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1726
                                      Entropy (8bit):7.8831756909230535
                                      Encrypted:false
                                      SSDEEP:24:K6xqe6pva0rYcJTvZixiMakd4IS1zEoqIQsK+cGq4Ci1lcigmamC/Zx/cG006H9G:jipvaYpZiPae471zuVNGtJamC//Y5G
                                      MD5:66917684D475F7C4EE87A973E69D46D2
                                      SHA1:BF8C893AAC3EC2C1C6F7B9DBD3F96D8128FE74DE
                                      SHA-256:62B3D69EB4548FDBCB671BD8CAF276143F6CC330458CA40D5E4C901056702430
                                      SHA-512:6F1BDF69C044E096632673EF70334B169861B1657292BC3619481764758540A6C5596B3C2EC9F4F5D85F0D1984402642F8650AFB430CC890FC3C9AB6322079A2
                                      Malicious:true
                                      Preview:w}).9w.<.&.q1g.v#.}OR...j.......l.o...2....._l.......D........L:.G.9....2|SR@........3l.';.c.a....#...g.... .Kr#"........YX.i.q71>..jpg.v.=~.=.H....a.."{">DS"....y...t...k/..........Py.nf..:k....9..N..F.d..x?....(.O...@`A..=.8e.~u.u...".:...0..9...;.E3#sl......]..b.XxC.t......#..e...C......l.|.....Job.............A...8.?.5.t.Z.?.h....$."..q..3ao...$....P....%<.x.D.....UB.oK.RLb@.....1yAQ...&.j....O.9....a.9....s..LpD'..^.....q.P.-.......5...w.r3. ......^tV.1.DO.&".....O.....Z;.#X.fqP...V-.gMx...'|........k.&..v.f.....C.7U..Pd.-s1#.S~....Mv.n{e...j...4...]h.+..[..KQi.=.m...O.3.;....E3n....B.t......Oa....w.G.....C.F............X._O.9..O...Z..u..v..l.Mt'.O*.l.S..ln@.*G......$S.'lt<..........d@^{I.....K..Z..:.4o...........{ ....'..6..../..M.a...Y./.6I...o.....R.n...v..9.H6..y..s....p)..j...f.......y......Tm{...c..4..b_\....N.....9....\+.f......n.-.@..F.K...$..Pf....3.vS.%*...S.R..}...>..+....c...A.4....2.B...=.Z$It...h=.0..w6.q<.A2r......+..n.5

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\UQVedfQ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1391
                                      Entropy (8bit):7.853924055058955
                                      Encrypted:false
                                      SSDEEP:24:8l1ZNKU9tNGf1STvliMPHUTwDSTxN7VeF7jnurhDnlKrAeY7Os5Fs9XG006H9G:8ljNKU9bsEisR2TX7Vexjnu9l7Na955G
                                      MD5:80EA1CA035246EB802406589DA777D18
                                      SHA1:82DE1B357EE14E5F90CF87C77082CE314774E06E
                                      SHA-256:5513DC15AD92FBCE1B81FCF5131A74769BED498BDA13CC201AAD2CD99CBEEDD9
                                      SHA-512:F7B7E2CE5B398B1249FF9F52813A10A6219C556B1CA30B0391554CBDBEFC7F00EC716082E1C4CAF1ACCE4057D88F58B14D00D70BDA5334A5D83080747F254117
                                      Malicious:true
                                      Preview:.C+.%.t.0.F8(f....|.b........4N;...*.9aN>...!}.+cTF.h......'..XPV..q..^].y.9.....=^H.Fu....:.;..7...A.;}...>..C.e..V9.....G|.h...k..g....r.h...dx..r...^.~.6...mw57..L.:....W._.$:...Z..2.lvkw...9x.B.Zu}2.......UDp....8v.C..(|[6r.LSyoy.`em.q$.v.]..#3.p`e.}....4.........+k.T.K..4.........C.S._3H..:...<..J.F...[.>.X.."....._..U.v...~`{....t.........&.&......._........o...)s...k..}.~4Cs7..^Y..s. s.......K....L.....l .z.'....=.J....#ty._.\..6h.0t?bts..e.CB.G..m[.#.....H]...@.........]..d[..\...~....l..l^.ne....<k..m...}./ ...E.Z.)zc.5..k5....K...K..;...{..s%....G.Z....."...c....]...T..r...h....Dm|.mK....*..|.3..-u...3k.....@.L.*....%.z.9._...D...G$K.*.r2....GE.....J]o.E@.{_....0b...g.~..wR..<..Q.`.k...[.....4t...........[.]Yu.3....Z.K.....+.6C... ...o..l..[ ./..:.c...M........}..P.`..i^.;F!{.Q....!.xD.F.d.......T..|..@n.LB.....v......{..?].z.....g.sy....R.A.+];..&.....ge.At...Z..K..CAW.5!Ovw.....M4a...6k.X..o.&......X..!...p(...e

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\eQIOIGi.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):3977
                                      Entropy (8bit):7.954698107194568
                                      Encrypted:false
                                      SSDEEP:96:WcjHExoRieQmzl/vTw6DvmIx7UysoQlC/gTRIukDvVsXj:pLExazl3TwM1xAysovgTqjVsz
                                      MD5:200987F78C74588E44415DDA91D5FCB8
                                      SHA1:7DB2AA3F24457C1626FA75571ED0D2C9C9C1CB2D
                                      SHA-256:5619CA5AB397B82A5475870719FEC91597BD2E74F8D6D56A2F25D01278C47690
                                      SHA-512:E004DCE035BD4B5FF0870D93F2F221DDFEDC942942878CD7E9DCE0092E5E7D9EAD80116564ED56D254DBA3AAE056BA0267A9FF7CA459E61537AA8AEBAF5D32B9
                                      Malicious:true
                                      Preview:.'{....;;..........?r>..CW.I.]x..|.Z.C~..*..I.V$.T... ..V..-:...T.5.;...e+**.....v...:3q?.8..$..........+~....../n.o@..u..K.D.d.C.g.b<cG.E.X..Sz....p.......=x.&S..e]),.%.....*p.s(z...).<.c<...=j..Ii.ll8.k..r.d.[ =s$0.... #.>l'7....D|.PR........<.g}C..h.R M..%.~...roX\M...... ...-@....y.......82vN.....^...8.....^..N...d.......ETo.U.y/...j.[..R=.[Y../. ....w..Jm..q...$.V.o../y...a.N.....7~Z..&........c.f..|...(.Kf.w....t...x.t..@...p~2.l..}.I......x...u.*2V.R.{...I..I.OK.~...2.....2...C.t.X...y!..k....i_.5..d".RiH......&.:.3.c...&.<.f....O..j.i....J..t.wLKG..........%...<.d^5......d...~..F....X.p.x.w.C~8k.OJ...h..U.........L.Fnx.i..Kb{.R......H.......#4...`.....p.....NHf...-.Ug.L.n..N.`v......^jY.g.jW..%.......q...QL ..)..).F...z7......s..D...u....:`R[y...."6V.c..^... .z..2.L?....}.......{..6hR"...8...EC.!+t&Q.8.F1.Giu..z.....P..-.V....i.I![...../0C..2S.?.B.IS......ZZ.t.....CF....Oq..o,-,....mP....kx..3....u..A..$....+y%...@o.[.Z.g...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\fXLp9ua.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1725
                                      Entropy (8bit):7.906479075963255
                                      Encrypted:false
                                      SSDEEP:48:2tSfij4MrmQ910xqgG9o3kcaVVbubZu15G:2Z4MyQXb1TbEd
                                      MD5:5A2D5DFE5804812FB69BBD27821EB877
                                      SHA1:DACFDCC421BBC709715A79096CF77D98F755753B
                                      SHA-256:D00A7E9E95FDB5CCDFAC0C42A078B7FAED00FAE80691CBCCBC8D365CA2188699
                                      SHA-512:A4A4602835F70D153EEC24154E557CEDD76CBC9F99F3ECDD50CDE971B8BEC0543ADB25D4E01F95B0D5811A51151255292167B08D9FE4E2377A2E526177990822
                                      Malicious:true
                                      Preview:....#..a%_...O...j^v..>...%'y...#.......p.-.E.*..K.b.Om.t.x..g\.9#....l.z...`..?5ib..2..........X.......`U.......sbu".5D...uhc....."..U....>...k.$.$.h.+.y.y.I&.(..Y^|..o...kBV.;=)..Q.&0^y3..5..oz..$.P..y&D.z.*a...#.......j.....n.hY....wvi....x.p.v.8m:Z.O.E..6...P..../[&.....*........I...+#.../. ...=.ji.Z.H.............IY..:Kk.Z..../F:...Mw).....#1....=zD"..K....t..t....i....Y}..............e.*.....ny?...,.t..Y:H..b...c.I....t.......!.....0+Hs^!.r.\.][[.`..6.T...2...p.w.{..I|......)9..1..}..../O6|...&..r...nU.;WM.^.../.|..0.~...6%8.,..m....o..,.Mv->u.Z...fV......!..,.b.v..h.6_? N...'...}...jg.....;|....b.&`..7R-@3.d.}GPb.?..s..d#..O].R..X..'.7.X..6..-.,T.gu.18...v..A.q....R.......8.L"x8..!..:..\.&.t1..Iek.5.....^....I.o(D^..C.T.#..#.....$.3....y.ab.3n=.........._E...M...8."G@..eJ.p_..:.o.&.;..... f...!.......<r.u$.......WT.S..~...oNW..dg.....2...g...dO.rd.1.M4.3.A.B.c?.....P.e..~.r........].h..&..v.T.dy...>..Ed.......gx.'W.."...K....zRD..&K..g.

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\q8i0wrk.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):2094
                                      Entropy (8bit):7.915714370636899
                                      Encrypted:false
                                      SSDEEP:48:jOswbRtpGg80ejtJOlfVVRuqJGBh+303gi0rxmmAan5DH6U3MN5G:4D8x/t6fVVRuSEh+36zmAan5L6Uc6
                                      MD5:E2846A57C114419A3788C8B77F113E1F
                                      SHA1:AEE2F4B9A9159BF5F5687DA0B3F57EFA06B98235
                                      SHA-256:D1E4C83FAA906DC0FEC9174E288DD77E73009CCBCF6F5199369BE77421908DE6
                                      SHA-512:FEA1AD87449EBECABE74D4FBA438F146D976AFE4EDD959E7E8D1A69B15FD153068A0D530C51B75B113AE1457734FA3FE895AB52B836FDD66C022921C9588394F
                                      Malicious:true
                                      Preview:....w...T......x).>....k.wx.HN...J.g_,j..}0..S....1Ji..z..@..Zr.A.^......2..%.........:jx.....1[...>..5... ...KX...d\T.M....+\...S...q.9I..@NY.m{._)lT>{..[.....S./l...$e... ..m.F.~........|...~....e....o..W.,....dL.".*...Wy....l....Ki.i..[((...Z...G..M.....Q.._....G..0b..Q...u.@NB.g.....#{(.g..."E].@1?p 'pX...d."..FI..[pX.....|..QC...(...AA..D.m..e...E......I..6.U:vU..t^.U]U^...)........%.x.;.3.~..B..0^..?(2....~..(.C.xC.<..H_.....!....u..;.S.K...@ ........Y.'.....g..E/;+.3syl..,.J.....<........2;.....M...RZ.=QT.?4F......{..u.?..{Q..y.......P.....'W.Q.... .3b.[.?d....,u..\..F.9...^o&....2s.~\.......7..3...{Lv....S....{...Yl...$.....:..j#..k.......Xd.....-.:$.V-O......ePzZ.4.u.Z.l..e....'...a..Y.......A...96%...9.......W9..\.}..Q....}...N....8....E.7...k..z......i1.@.T...P#....].V.... ..7...\.vV...;...%.W....[.h.....g`.2mrD/...0t...%w......d.7.gO.....Z...f.1)..~.._x...9. ....|.g..k...Z..R...I..8.&zFh.@..a.F..0:v.L...-?.nHA.g"..

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\vvKFAuA.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1724
                                      Entropy (8bit):7.900396330208097
                                      Encrypted:false
                                      SSDEEP:24:sfcoffYLOx6rHsK6i8j5c4OlRt1QfQAlnegv0iSIUJbJuo34TBWeG006H9G:QZXr6rCi8jROvt16tDvpS5Jluo34Tj5G
                                      MD5:B65B4E5FC38A877271877F5B5D90E845
                                      SHA1:50232744753E93BFCA007DADB5CFF5A5FD2A649E
                                      SHA-256:35AEEAFF8BA409A774F88FAD72DA40202F994FCE884B652C7520C7F318D6B546
                                      SHA-512:DB8409627AE63CBBC070B6115EA1ED3ADCEAED3853BF8B267B40313264A1AC6381EDEB2324128E954242CA016F8C5694CA79B7A9EA1AB40E6026B1E6755C6C12
                                      Malicious:true
                                      Preview:a...E_....e.n..p....@E..Z....9..W+..6T...7.ZP....s...."b.$....v.W..+.Ja.>zC[.!.b].KE.a.9...DY.. #.?.&..|..s...~.u...Ld..c.eI...,....]....A............}.Y...D_l.p......+.....f1.e...h@.o........V.a#..?.@.........|...|.....&..R...l...S.w.?cD+.u.%6..Yh(..3.OP72d.?;.?k.l..$.Y8WK,.P.o...S...#C.b.#.......IF.X....z_$....1.Gn..K..".....x2v...S.C0..db.sC..X....w..^.. .....3..w~H..z......8.&...:v.G........X...4...5.s'J:..K.E(.8....:.^d0...lrv..I......h...i.8-^WC.p............r.e....T.................S.Xu3"\.%9.T.V...4...H...s6.N:E.i...H.'....$....K...Wn.&B...D........i..[.^.K.z..C.W..5...'...y..`...."..m..x..2.6..7....)..1.$......Wki.y...&.<.W..;.B....z.s..k...X..l.~_....A..yA...N".#G4...Z......2..^............ ....V.}..!"(.d......Q.J.uO..y..*.....rb.j.S8'...E..w.:........C..uC..Y.T./.F...w....lpk..fu'KVPh48.....q...\.a49.k.-v`..v.>z.J.k.......(...Q..XtcE~.}....P 5).L.HI.....'......d.a._.......N.Z.E./.k..f..A...i..).o.M}...c.....?.z..a...Y....kP..W

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\iWtdOen.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):407
                                      Entropy (8bit):7.497136904528093
                                      Encrypted:false
                                      SSDEEP:12:jJQRkmRACapbcEc4r/hP7yTmG0Z6A546H/c2J/u:aOmKZFc7OhjyiG006H9G
                                      MD5:21F74B410920A63606F474342DFB7F02
                                      SHA1:D347A24DDCFEE285401CFD8B5C57D133CC3986A5
                                      SHA-256:749F0A66C7DF52362645EBA101FEC4C6B4D1AE06F9E0B4A989116653A927F513
                                      SHA-512:A251789D46CAD8B0E4CCF5FF40776477D30F75E89D321C0B410B938C03FA50FA375990F30A7DFC9DEEFDF51DBA6AB353BB85BFDCDF73265E4D43287760E06BE1
                                      Malicious:true
                                      Preview:...d.B.@....vF..........s...':..N8.?.B].-.N..P,..4&...%:B..!.&...l....61u.7].3.....'w..w.....K.^..y.d.........i.N0'......;.h.C.@.1..o..Sd.b..v<..<.T/....J.?.....G....:.........K...'......S5..H........6:W....H_?........_..g.E....Xb4z.f....7...cA4..(..j.M2I.0p.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\3ODH4vT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):758
                                      Entropy (8bit):7.7400319699838915
                                      Encrypted:false
                                      SSDEEP:12:P/tIr6rtgZnwBcsvuiSfVmhDnfGu562cumFqDK4PoW1Hux4PZ3pI9hzFKr3xmG0s:PGBwBcsvK9m9nfGc6aC14QMOOh3pI9he
                                      MD5:6D23A7FB14B7EDFF3E02B765D21B9959
                                      SHA1:2BC8094AEE0E9261D7790A17EA96215675D3BB13
                                      SHA-256:13079C9D73EFAF0D2454E97DC5FA9032A4B2B11BBE72BB78CFDE42A86F27FA93
                                      SHA-512:0DA6B3C2B5B264E48739EF452EB5C1F088175D15E1928E0BE81DCB49F018B400733A3DD79C7B82FB60918FD0ACFF11D9342BC84F4BA150944259BB4CB1B61A25
                                      Malicious:true
                                      Preview:.1U.g.....Vp&..f..ek...4f...4oZ.+....sx..?.?.<.....x.....3...G..MY....9....B...##....."..4...G3...a.b.GE.|....5..A......K'....4q.@...0E.JQ|f.r...T1\..2..@f:.@.H..q.I....{^..t.w..~..Kx...#.....3./.YJ.~tE...s..H..o) .l...O..[p.i..z..%.:a..9.Nm.)..4.U.........u..W=k.XWI.9......4.....o.C..).....@^.....r..:.u....u....1.../F.4.......|.U..L..C...>....N....dw.A..tt..[.A&.X_..<..>.8.i@'+U....G.......L....m.[..J.....4.'../%..`4.......ds...y.....i..Q.!.LP.g.9..i...l$V....d.M.JS>.-=Q;..C..#........5...4...[[.6<5.].......x.}.Y..^)m.SV...k.'c..5mm{B.....k...W..U*.7..v1.].....;..zL......w*@Q\...vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\5HwZ1in.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):761
                                      Entropy (8bit):7.745548381590759
                                      Encrypted:false
                                      SSDEEP:12:oIk0whviHQbJp3yQd66/0AN3v34Y6JrgQLCQJwsGeMS6iXS0fLOQsUZHmG0Z6A5Y:oWwgozC3A3t6JrgQLEzeMSH3yXdG006I
                                      MD5:524C5555BD28598AD28D3121DE167E9E
                                      SHA1:9B7180786CAB3512B8EBD792E92BF48E0BFE1524
                                      SHA-256:8CF40D329B29DB0558F7CF1D6EEBCABE9FA89407EF5E4DB714A00DA10C3FD108
                                      SHA-512:E3A3E41A78CBE0BCB1ACAD164B675AD6A11D065B179DD5E8834CC797BB7DFFB34AB2A62F6E038AFB413AF40C476DBF7482E2BE1885C99E036EEEE665FE9DDEB8
                                      Malicious:true
                                      Preview:..e...,..|..P\,.....4uK..W<..k;....u...B.fu.Cb51%.B..-.`.=......{...Oap..l.Y....\......o......h..'. ....@..C..'..YK.1w.s/$qB..T.......q...R..t<...Q........^.X..i...T..!O\......-l..N...D?w45Q..'.".T....#..9....I...s.N.U...u-~.|....P..1....@] ......Y....a!....Y.+'cI.`.JN\..k&..@.\M.]@.N..r%n.z^4...\v..S..{....[K4...86.....E\H.ixJ#.Z.,.p.@6c.......I.-.r{.e........J^......]...._.?.iV..?nt^....L.<..=...1Y.....>.$$e.T!.3......T.6.Js.q\Ac.]uq.....w.....O.}F.&...A..p..{.JQ?..8......'.A..g.V.+.`.....[..?QE5+....y..9.}.....^*m.PV..].4~.MxT.DbnW..T..F.SC.[.u.>O..5.....F4q.w....#.....*EZ`.\."{.6..=..vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\A85vXOE.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37044
                                      Entropy (8bit):7.994731189520272
                                      Encrypted:true
                                      SSDEEP:768:HFoAUfmaTHTzkxZwBBz8xWhmKWelQjAAH5by7DpzaFYu0MoPETUi6:HFaJzgCHz8x2mKWXEUFy/puKuRUx
                                      MD5:C84391CC1088398E43B37E34589E068D
                                      SHA1:51D0D1E69322BABB32E8559F90EBDB23532B1328
                                      SHA-256:D3FE5D0B104BCD8246C850FFE8994E8157CBAD55A5C9ACC6B5EC61CF5F0A92B0
                                      SHA-512:AD8D1904076907133E776D70BF19DA3516CB3570D554E8665667FE9EB10525696D6CEA9E33F5BE6F6C688B58D9F08C7B939488F634D7FDC9FDB2EDA6FD0E5EC2
                                      Malicious:true
                                      Preview:..l".v...z..... <.....\..b.0A4+'A....-....?.pG.P.r+.}....3......j0l-...f ..d..8....I..^/Bz..u.\.#.pk.o.......6...l..[Y..4p.......#h..x....T.vbp8.$_q.....y..jhm.wh..>7<..........d1.H..Tve.o..H3.=.o.7W..\.....a^WzG............2F......GY.=.hN...&.......'^C._|.U.N.,T ..F../T...E6.E.-MW~jH..@D..G[D...q....T:.....i...V]....ql..Z.$|.H.Z...g..7.",......{iJ....2.0.)3...,sz(.W...=...B........*...~!.S.......*Z.}?...:)..$.g.&.e.6.E. .!..PUY..K.A.L.[....is....V.*...5....9L..~V.w.o.}y..j&....Z.3Ov..X.L~p.1.....nfg.O#..7...4..&,........Q..??;d.qkvi*.C.z.m~A....}nShB.#,....r.../..v....&.7.b.b.C..y...9._R....|..F...4W.0..&......^I(RUJ.q@..<...O..J3..].o5`G~,h.c....:@..2.#n....S.g...Zx..r...s..l.."Zp..#....l ....O,.~I.>..2.m.Y-.2..[..V.j.^.!.9<.F..NsE.P3.3?V.K......_...z.....Vi..^Y.,./.yp...bE.g.i.. ..|....+........N......n'9{Q..-.TGA7....;`.=}....4....B..?..L.@.v.../.).._R.B.Q..2.......v...qbW..{...s..M..s._;.k.=._..].d"Q...<...w...|..%..c.1...@C...hZ..

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\D09rMD1.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):37051
                                      Entropy (8bit):7.9944832981646785
                                      Encrypted:true
                                      SSDEEP:768:nL6ZgVr1gB+RfT21AOvB/rYY7+DOxVDpeuQaB:nL6Z81xAZ0Y7+6xVFpVB
                                      MD5:3F2F862D5379D462F9618D095BF1C5C5
                                      SHA1:40F4CEEF4920323C694D93AFC3067E25A1E71790
                                      SHA-256:436D386B3581D257B92009B3123D433491885188C3822CD24E616C0ED2260FF4
                                      SHA-512:07FBA445D72083B9F6A00F2BD9C760435D0C14DDDAAA3F14802DE54A992E9EA1C28DAF14A92ED36FDE5348ABFE941DD089CB5A5C8C4DBD71EE4B88E33482309F
                                      Malicious:true
                                      Preview:n..=..J.)..'.Q...K..}...=....9H..+.p\.....5E....^|.9?1|;.w.V.....v.4.(@.).&....`^8.i...*.].t..r[.'...UC.X/.8e..P.."..@..Jo.....%.....tiF.i~.^j........}mi.C_g........q.rm.T....++.C.......0I.C...V.+..'PYM%f.p.....Y..RI...P..\t.J..S..e).b.....\.......Y:...'T...Q...$B.2."..BM....j.......@..a......6..S......c.I6!fx.]..R^7.....P&..A2E\u.e.M .......P..F.h..L..V^..0...-.".1.A&...K;....(.&.\.......M...$rH~.".@n.n...f.A@+.Tq$.so.?..|1.;J1...K.....z.W.<fQ.i3..{"....{h..X...J.....$_..a....|G...\..=.....H..{9..-....t....%}.i..4.x ..,A.6..07r._;qQ..#.m.6C.n...k.....{...dL...D.].ueLv....eCg]..q.B...`..A{...[....E"6.6.~6..p.S.....t...#.t..BI...?.h..^...qg....S..A.....<...uUa.d.!...ec.O......+P.*.h...+...p.61K,'.8.....Z...=z...........eH..+.R.....x.;D...=..Q..j.,p.f....W&.)..8....7..P..{90+...b..!...Z=....8.s....F...0......F...[k.v...8.......X...}` FG..N..../K|...g..;...Z...?.".....#D).K!s.6{@.g?E=|.sE..T.D........5....d.!.......H...q.0..

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\FDPlrx8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6953
                                      Entropy (8bit):7.974155893892419
                                      Encrypted:false
                                      SSDEEP:192:AydN7mv8h72ujcsa/B3qNLZxp+ZyWt35W/c:AydNmxw1ap6rKZyAoc
                                      MD5:F7FA24098D44599D0D3D3EADDD6FBC90
                                      SHA1:94B798E1210A762E66A986FF95E6709147D7760B
                                      SHA-256:C34C09296B3553982A13774DBFACE4538B95986461EA03F2B01082EFEE9F6086
                                      SHA-512:F2E22E1C050FB904237DB6B52456832F850D03C1CD2EA258F0545DFE3F31AB354215D2FA0B88CA8504596C34B4CED9FE337975558C7E7703E96E43ED08D9FC23
                                      Malicious:true
                                      Preview:..<.<.;.......WD....I....OY`.....NVg..y..W.g.+5..&.x.... I{b......5.....S......i.......i.y..a.8.$.Bm.....Y.d.x..|.+......D....$3..%.HF.v"!.p.8Q/7w.....%.=...6...3..{d..*[...R.$.......K.\(...[.QLv8#O...B.T..Y.c(.4.....O...1.L..T.3.'.9C.....4..R.IDe7..B..(..|....fJ8.&d..xW*...&Gt.zP|.Y.E/..q./....F ..6..."..g...ay.$|R..#TAX)0.5..`....T....6...:.Hj|...EJ...Tw.:....B.....|..y..g.E.S.^....p.)W.h.AMz..7y|.0.5b..\...\?"w.J..Q...6C...%&[...>X....O}..V........s.....@.....N..y.\..z*...p......s.t...q"A...r=.Q...)...$...t...D..d6.45S..&^[.7..atr..b0*&..Qt....a....~....7.... _f;H...:..i..L_....U.#..!h..I..[@..wAy N.w.8.|4.s.S......."...*..4#...........W...\.S.S7O.g..........:"S.. '<n.y1q......\...+..5w.Nr...AS...s..O&.f.8w..."..T..!...;,O.g<U.a`a...".D.......~).....%+80...u....h6H...?@o.6...@.@.{ur>9\.#0@T.v.Kb..........o..kz....+N-N .f......[u.x..:.....fb.ug0v...#....dZ.bHp..H.i.K..8."B.*.9...4....]qMj.L.{<.}y;........j.O..,.YNm..5|.8:q...........K

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\SWSCRek.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):41228
                                      Entropy (8bit):7.995832312200823
                                      Encrypted:true
                                      SSDEEP:768:sPymk4j5sz2VK5BRHQFLD4+wUMfK1zrGW2zYfOzJRl0wgaAGwViDyNYuf/LyI:8yKVK7Rwhx1o9o0Pmuuf/Ln
                                      MD5:6FCF1F65CAEF7AF2A587D9B98E6ADD18
                                      SHA1:ECB4E4C1BC84BD605EF19A60F4A1C6CD64B25A40
                                      SHA-256:B6D49FD9EA984AA90320C8E22D0EB82F5FBD558E9CFCA545A1CA27CD28C5BBEF
                                      SHA-512:11590AA821CCF60A7648E9198FFEB2B87434AE99E1125D27233DE8C7140C84BD26AA04D2B9B4662529957EF00763D0DD13B4DF602F565B07CB8579DE8DC27988
                                      Malicious:true
                                      Preview:o...G.J".I.N.....G...!..?.=...L.^.A..U^..o.~6..@._....e.v..:`A..OYx.Q...>4..7&.J..\.r(.M.X.5<...O|cvY.^.....x.B.C.v.m.jH..Oz...p=.D....5N..)..JN.!.b...U@<..rR.P......NL....4F...4.A##.....l....n.dl....G.....2..~.E]..#..rK.oBs....}..$......e....,1'.+....3Hg.c~!.<....BM...a.Z.W..r.21..".......d..*D...(Y....v..B.2......Et}...Y'..f.5.|1.m~rV........I49..v%...d.rb...Nd.5qm.uc.M.D..zG\Y=+.Sr.P.E..aC.dT.08....T..(...nZ.UR.[6......q......B..L}..+1.....".=f...H.L...9X.M...m..5.3...A.@u.=.ud..@.]B{.n.......Pi.&.H....;.....]..e.......VG.:."x~.g..'_.K....U...z...Y!.qo....K.CH...ss.....4...........IhF.................V.].....`..s...a..r.k<._K..b...u.(.#5.3..wN.-....m...P..0f.Z....X.%.g.2...S......k?....j'.......~......[..........~.Tl..gTP...s+5...!.".I..4..t..%.L2.R..T7......;.U.D..J.y.iK?C..Y.V.{..\..|0.#...~l.&..1<.+..,.#....9....&.n=O..$w......).>._.6...B...Xi.y.....J........$..4....i...}58....(P.r.....N}..4i.x.:....%...N.j.$>.$*T....F.R&....

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\lI20xa0.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6957
                                      Entropy (8bit):7.974033494088549
                                      Encrypted:false
                                      SSDEEP:192:9VrkES87rm9RtrG5QthMNUdVMwY4s1+at:9VrG9RtqGthVriYat
                                      MD5:F62AEB1A68EF7BF80BCA205FA06E8215
                                      SHA1:1F34D6312D16DA00553CF2536B1F4A5F3E141C01
                                      SHA-256:CD922FEA8FF0CFA7394DAB3B7C54D518A1D3430B7EE506D14144BE6C4C1A43B4
                                      SHA-512:2352E76229C89728E1B58D18ED4DD403B6E35799D7B9EAF2CB532817F6ED56FE55961D9445108B28E2EB06AFD6F6C834CA0476AC1441AB023738A4DF2F3585D2
                                      Malicious:true
                                      Preview:#....+...Q..n6.....F........n.u...].S..y...6@..k{.V@".6.r.f+....z...A.T.M...'..=........+..l.H.Tj..2.f...rp.~A...A$..@..Z.mK.&..'.{...I.6....lF....%.z.EI.L...j........L..d..}.......B.....J"<x...B.....R.*.....$.Z|0Oo.O.CM.a.?..P.(' .=...+(=2lm..K.'..#...ai...ZYb..,7.:.mf>x.$........N....V.K........m...eiU/....<....!%.`.0..I.....(-.m.+b .uU....b.d..$..iF..w.)..2z.S..yn...-!.......An......i..Te........>.jQ...R......t......S..`,J.x7a-.1..j-...U.F..".[ycl..E...PY2....Vw08)......$.....`...y.......f\.F...cAm.Cz..o..j6:_.......r...dt0../.Q.....4.<:'E.b.((..Ck..B.'w.4...H.}....*I...Kd.0:a+....._...q..b%.\...pZ}.Rp...|...'.$.j....w..M...s..u.Q.d'n.l..i=.....u...[.<u.67.|.....H.$...h4O...ag~n...I..I..ob....U..Y$.&.B.l.g....|~@.~.x$.Is.(S..q..a...:.. .u-.%'.;.7..!...........g.'.X...4.|.....R/.[......A....V.t<..... ....^e....h.~.b..`....5.3p..P..(Tw...u`...A..cJ{*...\....7kN...(.8....E..W4o&9.j...W[i^....*........a...H.4d.$..E.k+fCX.

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\wXFvPT6.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8971
                                      Entropy (8bit):7.981233123008894
                                      Encrypted:false
                                      SSDEEP:192:ilwAsoinHLIwaZyZd0wOBL5TUqD9MGr4s5zF00mHIa:WUoirIw0yn0r7UE9MGrpzF7mn
                                      MD5:723A50B05EAC5CD7590DF18380942599
                                      SHA1:AAED49F84635583788554573CC68CFEF5F0B96A0
                                      SHA-256:D14FD9D47A914943F24C4DC42AC5DA09CE97E101E19A672A77473E2B3BBFDB3E
                                      SHA-512:95DE05EB058A14D2FF2BB83271C70B3293D0F17F6C371F934312A678ECFF1E08788617414C9600CB7272D6291037DBB82FE4E53FF4698F27944D368B41B92C1C
                                      Malicious:true
                                      Preview:.+..Z.]0f;....%..z$..^7y.....v.0..o..3._d...U....|..h...f.-lYH{%e.HIH.d8w...........{F..f..!.C.H..Li6.+$#L....e..:e3'u...](C..W..Xk....>..O..U.tHt1b.f.q.!...n...B`..X#...G...H&....:.(.c _vs...}.|.(GM....x.;..b.?....fkVH.$Y.%.....a..tE.....Lg...c..D..xB.....F..!....o.Cm.4.!.}.D.......cL..O.M.}.HL.....n...zp.M.....B.-.4....vk.%.C0..C..Ey.6.B.&.t.aF.D....{Nt..X.\A..).!#..y.w .W....H......VC...r1gu.....8...e..~={...K..B.Q...C/..B.RPE..q.Kl....UF}...l...jJ..]r..4x........3&..n...^..h...O..-.h...."..[.)....E.2K.......r.3._2.>.7.......a.V...p...g.C.>/s..G.<.z....C..0.../+|.. .f....6i.U.i.N.?.O.^@..*....^.8b?..+.c!...8(....~B)..A.&V.'R...?;...R6^.bWE.R.}.7.2,joi....$...).....G.r8.uC..M>..Iv.\|....A..H....)W.z..#i..4.u1e...~bsY..O.pKx}|..3.,..m.$....-....!.....S...n.t....6.H.p.eD`...9.v$.k....s...9Z....|..hF.U.?...TA..........z.B..........r;.+@.d...C."..PQ.#.....`.....A.v...1.......y..j...U@...1.o:p;.~A.P..aj.K....aJ\[-.%.......'.q......(.PY?..

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\wA65Aca.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1553
                                      Entropy (8bit):7.883047498334004
                                      Encrypted:false
                                      SSDEEP:24:eVO04tA/1I0+an3lmwA3VVzsqN1l6frvjQ5pYWRr3HA76XgnG006H9G:eV56I+0+xxnsU1l6fg59lQ7Gg5G
                                      MD5:C32F8EFEA6D371F17D36350051AC9E49
                                      SHA1:3682A375FA6296CFC2796FFAE0F41C960C6D7F0C
                                      SHA-256:057BC8A0E426D48CA8CC2EB25B9182EDE1590E57DDFE6808B7C5BE7E97B9C119
                                      SHA-512:E9DF6056DEFF6554D7348F900FF8720ED021A8EFBB4042263BDC5D2F7CF99E4B998D5207B110F5A225A1B900E0D3E0AFDF1BBFBA2C88CD9E29661324A6074C1D
                                      Malicious:true
                                      Preview:.................$....?g].E3.x=.*pK.,nAX?;k.`.....7....1w.../.9./..H......Qg.._...P.+C..>D.DTf..../^..P..G.AR..]V.....2.-....;D.j.+..W..>..4TU..b.1....Sv..h..^./.1..Xo>uW&C.....F....... ...V`e.:.v7Y.%.....D..8...k.H.I..aqu..p.x7...pZ.......?.U.N..E.A.F....:....^... .....5.*x..D9..l..Y!.O..(..5lH....S.d...W..lB!~.S:<....q.=+a.4{..,q.K......q...#....8K.L..w&.......2f.i...M.E....$......W.....\,.m.}...k......O~O.0... ......(rl..^~Y....I. ...q...B.]|0..yuA.%.M.......U..c1d..<.l..rb'8.,.j./....B[ .!Q.~y..1..M.O...;w':kDl...*.]..).[....~.M.....U..v.u...[&)...5...."+er......P.f.`.......... ..$E..;uNAd..8...nj..N...d.I/..B..:......DE.....Z..3.x"..th.lY=k&.".>~...2~.7...!.o.k.5...Q....}=\.nF.m.i...b.(l...5.WCl.V.....Cv....G4y..J...N.Z...y...>.&....^D..1U......*b...E=@w....&,...I.v..k8PWz).E..l...U..x...y...a......Y............RlQ$...^zEc.l..u..S<3.Jh.%|..%Z.d9P...m.>=>t.E..J.tS<. ....U+.f...G..lx....n.qAF......d..b.....X....,.A.8.^.I.

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\ysvHg4N.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1573
                                      Entropy (8bit):7.861256518519259
                                      Encrypted:false
                                      SSDEEP:24:YVtszE0Tjd5zvf2xcqxmIKC7QJhJOONO1uBnRuSYMBCX+lX2eG006H9G:oizEivfkcU/KC7QJhJOOMufuSJ72+5G
                                      MD5:6F5703DBD07A3DCD328ECF602E71FD96
                                      SHA1:007A61B1F7EE42FAEA9EF50F11C2EB682CB46ED6
                                      SHA-256:AEEC429A2E7CF1AF87275C0E306BA6AA5D25331B4CAF34CB36AD53E7F5F8051B
                                      SHA-512:23FB47817DDDE7AE4BB4B80BD6DDF7EBF5DAC92C80A3B96A926FBDE1259019EAB018E63F65372B209E611C45582342DED84054E9D1B252F665526F0E682ACDDF
                                      Malicious:true
                                      Preview:.b..........G..5....y.L.z..../.`..W..S\D.p....\.B......f.....i...n...O.E....8..]5NX.(..Q....{.03a;.4.x..N..lI...V.u^.6.....S..Z.... .b.I.}.^...h|x*.<`.n...O..9+1...+......Y.....<..d"..fyl=...f..$O.<..c....a.)."E......F5..J.c.......(!z.v!C.j.K.X(.......'..E.=.yPYwL\9}.{.}....A..b8.........o\.a...1.KR-K..fa...].h..C..\..~.2......XL..'T&.K0}..:.@..9_7.Q.....1.KE...TZD...I....S.....F(......q..y.........."u....X...kS.7.#.0...._.9...q..D./..,W2..q........D.4&#-..&..Vu.,.4....z%.Y....U....:.w.%*9.#..Y.J3jl..Y...y&..'tX...?../)... ..'....^.*...^.(8.. .&1g..Z|en.....2.?#P#.i..}.1.a.r..-..?......"%364m..D..?UH../.}..^~.........{{..7vS......p....R...j......Q1.;.d...O...0..H.G.5...a.K....d.......=...`@Q.=.....+..v.7..(.s..i..V..Y5nu...+.].@..K.b......N..H#A.f7.......d#.j..9.*...3.....2E..L."._."yR..?..:..F.iW.'V?.v.g.G...R[.\.....-.[....R..B.na....kW..D..8n..D..^.1..&..Q......@m."....%.y2/...si.N...W..{.F9....2U...k..a.....F..d.6.%..?......l.I.....E

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:true
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\EdFJPef.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):33042
                                      Entropy (8bit):7.9941319266718365
                                      Encrypted:true
                                      SSDEEP:768:saeaX7DKPWegszCqRG3zGAieraNFsL5XdvTOa:sQrozgseqRGzi+aFsL5XAa
                                      MD5:005FFF614879E342BFEA10240BA11227
                                      SHA1:B37B9CFFF58701E7F2BAB273290F5BD57FCF8345
                                      SHA-256:CA815DD475665F647FBE37191F677E53B5F7748FCD34A44505D177EBDE419154
                                      SHA-512:938FD9690EA6F646AA4AEE91A7911ED62794D795D60FF4F8CBC013D2EA505D2C6AC1181E6237ED9BD58DDE1F909F72A00D79E508AB47CC51A52FCE6E0C753140
                                      Malicious:true
                                      Preview:.*...?.M.O..?.l...x....+:|\W.m.-..._\...amoQ..{.pq...v.M:..+c.`..h.l..g..s.Ah..5.w.m../....c.R7...Ksq.....:{`..A..W\.;jt..e.....'...T.*..K..".1.a..r..3I.#.=^..C.w.1Hz)#p.....6.....|~.*..gU.ZN..{Y....+G.n..L.%a..a...X,..9=....}c.D.............sZ.I.5;../z.....9...W...+^D.Pc.....x...<^........4.u..4.Q.f..%c*F...|.u.%.Y.y.33#....TD...^X.i....Y$..Pk#.....^..QJU.Q(.Q........:.H....H.g...........>.a.J.po.c.$...{D"..{~.$........pI.Rs...v....3.-.-.YVN.B.E..zA..U.F...x.W......! _>/.l0..Cp..B..%..#=a1_0..t.9..h......2G.e..<Xj..K.P.1b.]S.`20..7sS..-K3..Nh..Ce.8.]p5...#..T.g.E5..[..(.W0....5..uu......B.n\'.....wr..e...t.9.........E.....B...9ND....@....R.........].....)5...8....'.K.Q>d.-qU....N.......j...'...1Yp..-..m..#...... ..`n...b.:.^......-W4.`z.....w....w.w.....c.S9.j...`}.....?..O.d..U{..I.QOX.-[."...id.x._5S.bH..............Cx. ..e...E..{...@..1...O.P.x/n..K\.e.......5..Qw.j..2:....82a....R.3...!o..D3...6Iv......u.BM.wQ..S...h.yj..F.:. 4..g.'I

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\J92ULzt.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):540941
                                      Entropy (8bit):7.96623582364397
                                      Encrypted:false
                                      SSDEEP:12288:dDhiJDJWZk0lKLvSjjTQVLxgLv2SXhZQ5m0ws+2pz:dQijjTJXw5Bhpz
                                      MD5:8673F31D18AD1E3B9628FB81EB357839
                                      SHA1:2843A472D7988DFEA4B25414C43F6BF04B12AA8C
                                      SHA-256:EF1F27780FFD116DDB9C95AA94EB4F01571D52BB3307110E6ECC71AF644215C3
                                      SHA-512:F6F40350963DF54D1D2A9E778549131B1EB8B28D1C1B3E96B09E8C0D4434ECB6D33FCA540D83866A05FA769F7E7C45BBB76D055752989FA1DF6B0F8DBBC95E9C
                                      Malicious:true
                                      Preview:.y....<.B.........`.....&.....R...."^........g.K...BO...nY...^..[!..I..I_$g...9t.Tg$..._b..2.X...[.YM..MR...o.&.]...\....5..V.>eJ[.].hl./.lD...L-....l.ZS..Ne.|.k.*....rz|.p....c.."0.....)..Q......I.w.ah.>1.40s.,...W........V.h...O...J....*.h...".......F9..7.6..n....tt.?p.a...E.ys.tf..o.6.k...F.....$..*.....>.% `...[wVUW`..M...1..(...adH.1............@....p.\...l..z.E!......GF.=.q..*s.K..K..J...J...].._.V....P1....q..xT:.N..p....\.C........i._..X.z.7...@...).V.3?..Zp#$.y.uR.l...s.q.h......a....^.cO.R..^..}...m.........<.~.Y.y.]y.... jy7.......\\j..*..mQ.cU4.rvfY.?...v........1........f]^f+.....E.;.pc$.H-.[..d}.x..J...........J.p.?.......J...'.!....*2O..5`fJ.......&.u.....V. ........l.".M.OX.D...hI..q.E....&z..TO..ZI28.....=..NB.Hk.=."h.....+a..|.W..r.d}...].#yA..8...]\..#&C.j(h.'.@....}....).s..q.i....z.Rg..?..%........6.h.F...........V...V.\.c.....*..$%..'..5<.....z.S....... ..V.j..Q.>...gf$.T...dQD7...K.Ey.>....O.V3.D.....{....n>.W .

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\TGdEds8.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):33033
                                      Entropy (8bit):7.994597758431892
                                      Encrypted:true
                                      SSDEEP:768:M5niE2+0YJWKYwsErWverc+pAqDEoglj2+e2ISFrm2Nh+npAB8YjI:MJjPrZW2rrZZWzdFS2Nh+nyrjI
                                      MD5:E4D233B39C71E23F7A257B8ABF5303F3
                                      SHA1:9834DFD5C0C62135F70E4263E795C7E8714B4518
                                      SHA-256:D0C51295E3E3ABE8EED986730225E023CCB8811544BB1BDC9EEC60FEE88C7186
                                      SHA-512:6DEE4C7986F3E9E47A5737CCD0A720AA4DACC0FD5982832F3A24E6329FEC25FE01F67CB17D3953D6DB96D1CDB9664602FC31E23F7CA0E723FEE230CB08BA161C
                                      Malicious:true
                                      Preview:.d..s:..\....j7.....]..u..).....N..Bt<.*.....&..'...<k`.u..D.}A..V.5h.}?A...;...P.....aC..Gz......v.5...m...8.^....C...5..@....7C..@.\U.l[ .s...cT.g!..,.qg..bwr..........$<g.]..4vu..V...BG<.D).D7yj...n(3(....H.<sjY..`.T...../<.C.Z.^Kz..0V.-...._U:s`<..g7.<..].......j._.A|.<..(_-..F.....;h..;......M.....68.".h#.7/y.8D{8!....i0.kGK?....*.m..r.....947.@..).w.'`.h ..QG.7....#..*.z%.p......r....\.......K...#".h?i..!..\e..8U...._x........t/..7...G....nr'.Q......r.....t.C'..Kt$cv..~...;...n.Y".c..X.>.."eE"|......m.I. bB@.A....}I.!..'[xE...9..g.......^..r......o'-..QBI.Z.Y._.l+...sW.JvR......_*T.f.....d.W<;_u...*..W.S...W.`..(..8..h..!.~.....^\w........#...`w....R.........'...=..Z....8.n..*.....M%S....zk....B...+.c.)bc.-...".|SIZ.M.K...:`G+]y...j... .m^h.j.u.-*!...]......v...S%..>...a..JE.t....i....{wi........\K..!.....A....f.o..n+.......*......T.~......q.C....x.......VzoU`.~...Vl.....(]+$..j...w..u.tat..[z.8tk..._L.....M...:..Y..".......T..

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\aAedI9k.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):33046
                                      Entropy (8bit):7.994292784113818
                                      Encrypted:true
                                      SSDEEP:768:Oj7UBxFXfkyPBxie2K6eirv+xmmjBbd27MqXUZtxcL5Fz8/GbYz5Ndi:OiTPkgH92leuMme27WkzoubWk
                                      MD5:DAFF8304106C416F0C76361155567273
                                      SHA1:04D2B03F66839EE27EB80FC38B5836E79E747E4E
                                      SHA-256:E044DA183FFE419C6D7D2E1187117A7BAC7AA90E3DF52F8CE6584B4A0F596977
                                      SHA-512:6017E1F5BC7FE497D84DED8CD0A679031E68E7B8D1C76F8643149D5C13A28BE15E7CCC7EF7092D450AD4CD8B5AACEDE71B86C5C89A80C30E608A1AA45A479112
                                      Malicious:true
                                      Preview:.{..@iI5.n.0..h....f..<.m..'....@h...c~.E..`..R.G.|=..A.YVn.;.cTzj/.m....y..(.X(..O{....kB^...../.\.h..\.bQ0.......=.?.x2....'.)...\.n....N...a#T.'..w.U......9.X.H<.8cP7...e.L...=......?.v... ..>.....]....3.U..|..Hz,.+QK.Nm........y..g....v.y<....Yd.......Z"?..ZH...'<.J.m*...49.."......S.....S...*."?..z%...4....yD...=.......y..X..|D..uW......v.....7.~..U8.4 <...s.V .,4..xk.|r...Cn.)...-.L.675...l..'.gk....t..o.....F......yw.m..;y..3P;r_Q..<.0z..@...#M,....;s..|.0..Q=D.A.U...w$.{..f....<.....B4O..x..c.:......2..D+..4....8..(....h..=7.....s.....]...{..|....}f.Qq...2.a.e..#../M.2.z.A5.w..6+....G...8.8......T.....f.h.e=..8b.i..T.;b?.......Bn.Q"u%l...0.V.l....X..3.=..mNL.hv=...I.a.vP..9...h...B.M^.' .X:M..M.Dh..b.....\.t........0.......#...U......e..mkD.Rd....FjA..j{.I.3.%....9R.O.-.W..D?{..A.z..G\.<..c..;V...%....P....X....7<.....C.'...R.A.]{.......m...S6..wf]X;t:A .......~.....=[&..~p.G.b..azs../..s..g4tpS..*,.....PF.Q-ao%w$-.y....-..G..}..

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\deIuDfB.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):33029
                                      Entropy (8bit):7.994389691102626
                                      Encrypted:true
                                      SSDEEP:384:XBCufmf2nya41RixeSY2pC/d347/dMUKG884Ape73it0UX86VBH66WsdEJy8AWft:wuNsiSdkdMzeXBVc4vwEO5s8iRgz
                                      MD5:8785CF60BF41D49C862DCFB9D3940A42
                                      SHA1:E35D546993A68DC58A2C25327ABD21F1EABD2BE0
                                      SHA-256:05C0D0A09147E48BD2EE6F5B1DBCA48FE6DBD3BADEAE8883E423CDE867BD5122
                                      SHA-512:65D26638B1C46EA09E288682FF3481942D88FE99305DDED449FFF34D74D59EEF26D9716B329E19234FF9C93BC4D7F40241A0BB0B97B65C71C49438CBF7AFF727
                                      Malicious:true
                                      Preview:.........mX..=d...s..g...Ei...(f.....n6....u\........Y0z.2`.i[|u..i&.\...5......&.!.M3._.L......u....=}AK..>.:"..I...%tf0.*..r..l..C.....fy......H......Zv.._\.9mQ.~..rb....-...n....~..&d..!e.a4u:6..pR35.c..Tp....j.CFA+.s+.}....p.Qt.....tfE....).S..8.I0,!3.N...;..O.1. ....V...T.l......2.+.v}.....JI........r..l...Ex...v~............~J}.?2....... z.._?.tbCk?....F..'...<...WZ.-.....4.PP...M~........ii.....1......U].%P[)..D..eJ..(...2W.\.A.}_}]b..5...M..!.-..).z|_\.~oT.f....u..5..v..q.rZ.M.n.'..S.....=..&I...~.W3#....L...c'.h1.R.A.-...y....D.{ ;k.54.g........../;........~R6?....p..o..:o^..Q...b....X..zrR..\l..M.R.N.E.:...^ ?... =...?.IU...A.0..)...........f.....t4.......#O.O.Q.......w(.u..*Qq.t.q..1."........m.+..I....Q....Y.a.IU..`...ewK...-...L]...n.....YI..@...m.y..i.....8..}.....g.W%..j.\.W...lrNbEcDz..z-G-.y..i..C..a.{...+...y$.2>..|W..dJ..o1@.s..]./sh..x..Ma..3'..'N.........s.4O....|..9.+T....MY.3..P..U....0eU.JvB....M3'.y..].V.r.

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\q4CFJnx.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):49412
                                      Entropy (8bit):7.996441840869188
                                      Encrypted:true
                                      SSDEEP:768:ORfGRA+jQo8M0pjxgmmLmSGZRu5dmPd35/hPycK3jA6+KZ5aPcbzktaPtnj2:b7jQI0UmDjWAPNxhPyc0jtVTakbzktac
                                      MD5:AB085A2D40BC297DEA256C6CB4243027
                                      SHA1:78ED321F3E2898A2BFE4DB6C529E33E4A87473AC
                                      SHA-256:A8ABE92FC016C07F7B189262015497F974C166120223934E186C849DE1107D9F
                                      SHA-512:DCF7716837B013EB885CB9248E5FA0CEF724BAFDB0EBFCD6BB262B6E19C830DB34A0F19E14FEF0B8A28F05F64FC4D5719505858C124C9EE3067932B4019BBFA9
                                      Malicious:true
                                      Preview:U.^s...B6v.3J..n%..9.....l.....M..q.f..c...p.FB...m.1|.t.../&.k..dXm2#.oE7.T..e.O.;.....F..5.....P.._....{..4G...n...cV..+..t...>..]..n...e..dJ..7.....SB...z..hN."...B.{..4...,....d...)1...T..J.^B..=$A....(...,.R\p>......-...........c.....H&.!P.T..<...m._.X.......K...K.....X]W.....}Wh).,*.m..f.[<V.c.v}....9b..Q..GDC.s`.%.$...gAo2!..O...>.$.2..go`...G..&..s......"..$..N..b\.X.U.D...v..](^.Z.T..B.=.w..P.7.fT.r.P..._o.5...K.....w...x.'.....7?L1.u'...bw-..H3k.u.......*~......j.M.0'~..W..'...Gd.9<.......A.~....4{s#%.....7.B^..z.#....-.L..y%d(f..C!.6.[.. ..~...d..P....z.s....8..k0....U.*w.B.>.....a..r...u. .....{....P7$...iD...HA.L.tG..*........@.L.<.V..f..j..~."f.p.)A.....}B.,j....]. .O...p.y7.5..O0......".zp....?Ms.m.....Z^K..0..w.Q.R3...:..A..#E..!.....Dq.}..}....kGh.....d.{%....a.G.......f......I......a.....>N{..6pS..[l.DYxn7j.BP.e......R..u.~...g..6.c..j..JIy.(....Z.a.5J..r.ZMAc...Q.}....:-"...a<<...51...."..Z.a..cj.......O.v.f.o....

                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\vi4XvhV.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):49408
                                      Entropy (8bit):7.996116783449197
                                      Encrypted:true
                                      SSDEEP:768:xZcbKK4m/0GEPk3Iah9TMDAV1HDIrAmvPJqTPenaoWICfg+qDxCACvtWdxjdtA:zDXm/0l14TMWET6enaFIRCvSVs
                                      MD5:AD7FFC879E0A1CB26F69EBC9D5E384BA
                                      SHA1:575087297CC9F0226A6F8E3F39DC90345DF4FD43
                                      SHA-256:19C4E40312D1D28EE9BC647FDE04B110176AA19E2D4407216D822A25200F1060
                                      SHA-512:69E286A4519BAFF38ECC760C79BFE8F32295900FAB1B0528322DFA83C985A854FE0F99C643936B4E9AA110245A1FD0E74626A180478CA10AABAFB892EE2C0FA2
                                      Malicious:true
                                      Preview:T"..*i...j.a[0%...I..u...7.H~..A.sq...s.m.T.kp.......'.....p.....E{5.+Z.k3;I..?.w...^....M}.......(.....N.s.~,.i..2.&.:q2hf.....a...V.........vk.S....K...V...b{=~(Re.5..9.mF...dD`*(..a+0...i.......)t.`.w..NN.....S../...A.r0...GSc.F[.J=.i..<...d..u?U.`U.x.P.!u}.a..V.p!....cY.(.......`..].j.p.^U...Y..2$.W...X......;..K.Q.s...}...a2...J.rI...U..q.*..M....b.ZX.o,.3..n.}.T.X..[.A.$.0.....)..X-O..9n..OvD.:...\.A.i..W"...9.CAS:(+.Q.....k....vL!..a.#s.;N.....4..N...P...&p..[....H...O..!...f...>..Y........c..{-.T..(1.~.w.@q.........yQ3.m.Ta...j...&~]^.F._.={....6Zyc.F!..8.l^....-I.!....?....rB..R..+.._@>...*Nn....wi1r[D.w{Y.*<.*.._ui......t.......w-.r....S.Nb`"`...../[.D.s.....P.qcR.?/..sr.k..o#..Cd.x.im.......A!{...E.n.}..../....G'..7l..[.):r.c.U...d.-..O.7.#...p.UCqhR%j.h.fe.... .q2~Xc.@.Oz.](.e.)..$.r...]..vD.....D.G..(..["...Bx{.k{Q..3....X.5.:..,.1.,u...p..<..^u......q.s.1....+m(q..^..o.t^..Si27J=........2....:."..f.N..j..v...j.{3V...._.8....g.@...

                                      C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\com.adobe.dunamis\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Desktop\AAAAAAAAAAAAAA (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\BBBBBBBBBBBBBB (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\CCCCCCCCCCCCCC (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\DDDDDDDDDDDDDD (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\EEEEEEEEEEEEEE (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\FFFFFFFFFFFFFF (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\GGGGGGGGGGGGGG (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\HHHHHHHHHHHHHH (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\IIIIIIIIIIIIII (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\JJJJJJJJJJJJJJ (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\KKKKKKKKKKKKKK (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\LLLLLLLLLLLLLL (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\MMMMMMMMMMMMMM (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\NNNNNNNNNNNNNN (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\OOOOOOOOOOOOOO (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\PPPPPPPPPPPPPP (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\QQQQQQQQQQQQQQ (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\RRRRRRRRRRRRRR (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\SSSSSSSSSSSSSS (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\TTTTTTTTTTTTTT (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\UUUUUUUUUUUUUU (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\VVVVVVVVVVVVVV (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\WWWWWWWWWWWWWW (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\XXXXXXXXXXXXXX (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\YYYYYYYYYYYYYY (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\ZZZZZZZZZZZZZZ (copy)

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Desktop\zhbEGHo55P.exe

                                      Download File
                                      Process:C:\ProgramData\3B5A.tmp
                                      File Type:data
                                      Category:modified
                                      Size (bytes):92160
                                      Entropy (8bit):7.997031829474708
                                      Encrypted:true
                                      SSDEEP:1536:YI0du21ERlGc1OF1ws0L5szBVuxMOjEZueZyVyRxyARI0du21ERlGc1OFg:hh2AlGc12ws0FszBVurwZ9ZyVqxzWh26
                                      MD5:C9B277394B7A7951292A57531E791165
                                      SHA1:AA24EF23D7A56E80B82513870F310728AB3B42B0
                                      SHA-256:7147A7D432335C768ADB2E3A40D4FFA467D1A1C1C2A376D647CDFAE722C8D125
                                      SHA-512:8BB9B87F5EB0CC28C7B1EAF880B24871C4039DCCA5E6EFD9DFA4FD4BCC33C578BBFB407CA85CD890767E5C63D94E8AD1C7E61DBEBC9C0135562BD5FB495BBE44
                                      Malicious:true
                                      Preview:.%t..n..(g.g(..M....f...?L..Y...C.Z......v....YBmvOy/._...~....gY.5.E(..CnE....9B"...O.wg-...v...~...f...!F.[..O.@$6..R..O..CN.......e....sH.e....u}...+[.{.v8.W.FH......H..x....$.Y.m.@/..F.x...)[d...........f.Dj.K..%..o....].....5..m.%...6......7..5.]l.......sVj-...w...u.]3..N.x.KQ..$|R..F...G.i.6H./.AJM......s.2.R..h......W}..m..q.4A.(.....0..[QZ......f].....6KB2..X...S..B.{/..3..N@.....k.~.~.z....H...0...p...A..`.L%KX...r..x.......9...fj.....WG........g3.I.).t.Y.P.Vt..=.3H.U.J...<.>..v.n.(......>.}....\...G.Nt...S..Y.U...6.....k.W......h=...Q.?...$-..&.>l//....>.rO.k'...m[...=EJ..A...T...._......[i.~8o...&...YD.RI...ymR..&..B....<:....8[...n.N)....|....}.m6...1..D^.....,z.y\.K..H.[F.......d=.cbUv..[....>.....G.7.QK..h.U........2#.jd.........;2.+.x...xR}.....y'7"..........Y.#.l`aXD..J.X.. w6. ....f.b........A.[....i.....>.*.N.j.5d...tR..6.}....OM..g.....95.G.u.*~.&.]....!.9.).....X..F...7L.J.....)/.@.....@=.#.(G.$.-....M..,..;1<.

                                      C:\Users\user\Documents\7RCHyCA.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1271
                                      Entropy (8bit):7.8414734492332885
                                      Encrypted:false
                                      SSDEEP:24:hyoeYp3lXzC1ihS/ZVcxEHaNfnhXTiYH5jrxJO0RsgQ6FMj32G006H9G:hyiBzC+CbcyHUfZuYZjrx8uCj325G
                                      MD5:1B00428DFB21CBE41E78BC0BA3EE8F81
                                      SHA1:1876AEFD1BF76CA8A7AE47A65572996D40CDA31D
                                      SHA-256:D6C40FD4E5D9DF125580BE57252D54982D938FCED2860F4C9AA7F46604ABA6AA
                                      SHA-512:ACBAFB47945995CF030256449B5258860567F4D4B204BB56CFBB809AD46CEF7126A50B293C10B3C3B2C2B7FB76AA202548905005A418562FD31C9AE0584C5BAC
                                      Malicious:false
                                      Preview:.k.IRS O..#..Y_..Z..Z.*..q9..3T..$...K.V.o.}<.7..CRWxi..;..<9.......eB..vA....B..wil.....y..~h..f#/.V.l.s,w+;.......G.r..h.|/..q.n.....\s.......6_...Q`..x...g.....}s.Au..?6.G.!.....}..b.A.........XR.......:UD...I.eS....H"...S..i.....).....0......X.:.K%l$.e..*....B.NE..P.[..4...........r.kL..-.o.:....d.....e...E_...w#....5...?nH...u.}c=.@...Qz.-..V.<0.^..N~.=^^........2^................d.&.d..............m......#.n.\..|.uoW............R.\u.....W.D.s2...........C.Ql...s.W.....a...RI.F8.Ks.^gUC.J..9..{...w..C........q._o......d1..y.g........L\.K.j.k(.Os..H8`r.._ln..@bZb$...-58[.Z..&.......Rgn]?C.H.L.h.K.,...Q.gJ`.Z.n;<Yr...7tO..e..<.....m7..9..q.QG&...y.<.5z .0..]L.j6..!."P.HF>...~HC;H..w.S...?T...&w..Q6....7.1.9=.f...............6UX..H..<.}u.X..........$..SU.U...'s.P.....I9..4}a.....r...{W.....q...Ffr}.r$.P.....o.K.3...I.U..a.}Ww-w.*N......qa..<...,]....F.{r.J.k........D...R#.4..m....K.@@O.k..9h...d...9.. ......@&.. ....S....1....

                                      C:\Users\user\Documents\7jdAATx.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1269
                                      Entropy (8bit):7.870561156783786
                                      Encrypted:false
                                      SSDEEP:24:6yR+FZcpRRGbPOnsSubvRipKMGNgigl6D4ezyPiFAHr+QJqcX9KENEf0xG006H9G:TKZ7bPOnsSoiI9NfkNPihUqcXxX5G
                                      MD5:42E23BADF0F7644C6F60C83DEC68A3E1
                                      SHA1:E9C4D765CC5FD95004C3C253D92D8D90245CFEE0
                                      SHA-256:7B143160AF52FFC48757EDF68B1AC999EEE54787F95649E06BE211EF41B17643
                                      SHA-512:4A7463F29E08D366FE23EF9DF558B2D523CF77A7EFD8D917CB6D4FB6B765706ED4DB83ACB41AB8AF76BEDF0F6C5D6FC0D4CBE0412A3934E4216F833DBFC691B9
                                      Malicious:false
                                      Preview:..T.Z`#..nH.hBXE.X..T.:Q...T&p#.."..y....ni.N...?Pce.....%~9.|..E.r^.T..R<B.a...t.N...Lz......1d.4v...f.@.".......A.(..Z.Az..3j......%5..QG......H........yNR.X{u..[...6..^............|.....#F.{I..n..!p.(...K...d......k...q5P.(..&.'xL..p.jDg.)....4<..3.......a...-....b...`E.....m...z..V=u.=OYb.f.n..s4.`..,..td.!3././...0....9...e..qr..-5.U.5d.c..b..X.....Y2.3....5...d.b.&..~.G..c..l..>G...".....L.h.1N.T;...-3I..,....:......K...W...w..nVV.4.cP..Vq...p*.d......*.St..y..o.=...{.O..;0...g......I../.g>).R....,Jm._..D8..^......r8.*..1....d.B..J.8...?..5.Gd.}W.-...{...<c;...xE.\...=w.1 .mUo.TM5.Mf."^i..gtq........!?.}._>..2..C~.......z%.1u...S..........@.$....p....nN.(...>.6'....C{......w......*..._ .LZ..G.,..f:3.N.8....+'`V{..2.......p........&....!}....>....R..O.9.h.a......o...v]6.K.Z^G..!......K.lq.;(2N2...F.@A.....L).Hx#.N.H.......D..Z:.%s...M..t.9...X1U...km..[.....j.#.}...e...Yu..... .h.z.w.;... ..i../G&.x\.F..U/..^F.q.M..;...N...b5...

                                      C:\Users\user\Documents\CHwX3mU.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1271
                                      Entropy (8bit):7.865102197109808
                                      Encrypted:false
                                      SSDEEP:24:d/GHwWWn9vwaPd/Y/SzOUwcOBnV+Y0HTQ4eNP+p7AL1XQ6ztVdG006H9G:d/jZvV/3INBnQY0HkNGp721h/b5G
                                      MD5:6142B0A3991E2036EB14394618D1C357
                                      SHA1:85F4F8177E054D9176999D184A8178E35716E61A
                                      SHA-256:4AF639C7C48B0BCA52D05ED4F5FE80346CE33D141FFBF3248C56C2EE6559C59F
                                      SHA-512:4842F1C2BE22B41F078399CBA6B6626C79D940CE48A8682AD27B0379309F3BD57E23B63328184650E55D516A75F36CCE331FA09B2D2847300F9C141E3A895F15
                                      Malicious:false
                                      Preview:.`....,.uR.A.[....=.s..YW...5...]...>...E.. f<a"qK...=..G....R..2..p....a4..y...R]J..#xS..>.l.}..j....G........T............b0f98u2..De........:Lni......-O.J...W~D.$..:_..9G...9..9.a.eX84...Bt(...B.....t8....0....`..rZ.x...%.+xs.11V.'..k..|m~Y.yp..Ll.M...j\k.....~.s:*b..kc.l......@..R......2(r.7._...........J.. n o.NS.&..<.|).=........T..:P.q..)....r.j2/..N8G....:T..w...4..]..1..Q..N..V....l...0n\.f.....h..w.... 0..;;.?.Ez.~v/.~.8V.g\...z".o]...R....jx._..v5.[SUAa.../,Y....n+^.1..V;,.$...5v........@`..m.^.6...@.X..E...m.*o.K.Q...t@.aX..1....I..U."<.. ...Bm>cV.JR...!......K%..r......!iVe>.4..hl..#....../. o.....:.8..E.h...zjaN.....IV.v'...}6.v..bw.<K....>.QM.P...q.....B......kmg.B.d._..D.9.k...E..La.Xa...a.o...S[Q..H.?@Es.-Ts..)v..`6...."..H.[C.[~.....!....[ZT.LBj'6[.r....#5.......Z....{4.9c|......A..;..\.x.v..C..L..M..e...dAa..H.ue.B...E.x...L..3...Uk.d.`E...X)..VP...(D......@.,...%....J.b..I......z.;.X....cp};^.`._..`o..t9...,J"..JF{.

                                      C:\Users\user\Documents\DriSJAl.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1272
                                      Entropy (8bit):7.838179375691211
                                      Encrypted:false
                                      SSDEEP:24:qoX3svXfEaUE1HQ6y1n2zO78lf+fOHd1PUY8lEw3ouDILdQUd8G006H9G:q03svPd9ty12KfMd1PUY8lEwyWE45G
                                      MD5:BB4E3C57F8E78B6BA185B2924A3F221E
                                      SHA1:C4B3AD04EC8E3F53818B85A8ED0422AE76EC3E4F
                                      SHA-256:198A9DD97B41D5668A605CB20EEBC0B181DE1BC00BCD7EBCC73A70B5CA72E085
                                      SHA-512:74A8469354BC5FC441C984847D66A5AC303910E10DBFD574AFF8E65153873982E9C65D9D20F36B32873719364EB24A17126D90D9C5322C3638AB90F080EB1C0D
                                      Malicious:false
                                      Preview:..q2......b.Z...4o(yV|E.....Y.d..A..gX..Q...2)..=w..GU........Xm.h....!.]X.}.(........;..Y.....^.T..xh"e.S.6a{o.+.B..)*.v.K...q.4..#.N$...~....%.....I.E...1....W...v..]Q..(._.....X..V.u.!..6q....w..l..$...r-.F........U`%'..Hy.r.|.........<..A.7jhL...~`....P.n...:}...4X%..d....;...z.#....x...hp.OY.ls...[8.:...Z....l...Q..9.........:#.....<...\(%C;.h....G...f.:......c:C....Vp@..;;C....pjk.9.)....]*"...1....&....<I....IG..@......P...$f.^.K.1..LY9)..Q..y......CK>_.wp:G\(.s..:..8O..r)Q..'T..ap........ .-;OO\U_.[....j....~l.u;.... Y@c.@x....R..[w...P........w8.yJ.[ycZ..HQi....&..?.v.ib2.`^...u.=.1...*.......Z}.A....2..-...."....K.._.2.0...3;A.u6....C.._......[]u.M.SC.t......0[..._..s...n..Z....$........o@.?.XS.H...A2.+4.{...S..7h..p$S...k.W.&....d.a...C_.s"...;..1EL...%..t(Y..a.Q.c9x..3...m.N..Ms,.4.....d......p..4.4b.....7@...P.u...s....t...} ...(:0{<[.......xU...S....WY..=..X<F.MM.......?0....,...%.Jrf..:d.6..Q.f.....5..=.D..#....5=.P...L9i;

                                      C:\Users\user\Documents\EFOYFBOLXA\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Documents\EOWRVPQCCS\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Documents\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Documents\FkQNkrF.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1270
                                      Entropy (8bit):7.866414196075578
                                      Encrypted:false
                                      SSDEEP:24:fbVMO1gluJV3z4fO/rAIgyRAcWcRBlk258njoa+X7UKWEYf3q4XvG006H9G:+luJ54fODAITWcVcnjoa+rUtEOq4B5G
                                      MD5:DC203D2C7CF255935AE5F65552283D1B
                                      SHA1:6553A38F08C5BC05D2B5DB610EEE972373EF47EE
                                      SHA-256:48D1B029BEB7B434B97EE62155CB86D2C56A4071C686A0E88223B80F0634436D
                                      SHA-512:F8C7044F4EEE3A8DAEA29363BF4989D1189BF7EBEB2F622A26804FA91704B7101283B7BE39C60877C0AA741C2DACEAFF3298648F20A0470C7527A9BDBEE75899
                                      Malicious:false
                                      Preview:...yW>..7...U....l.Uz.JR......(...GLj....D..RG...)Y.....xz.[....s*..[A...H`...,...8.o..2.`(}[F.._.?.o..;...'.|a...c.@..;].&..o.;....b....V.a.T*...!..B,.s...L.....]S.].m+..c......{`....7C..C*s..j.?....8./..:.d.h.\.e."..\V.X........5..iB.M...1...N.5R._?..=2w..)9....%.zw1.1s.a9JB......x.Is.......C.....T....Ds.W>....!o........a.2. 6......`.Ox..D..5p2..N.tj[.v.u..^...C.O.......h-.tT..l...-.S'..s[/.0.0..w...cqtf....r...X.1.$...V<.....oU4........L.1.].....X2..c...c..L..$*..7."M.@l.A...!..u.....5{....o.q.o"......-.xC^....^.....us.ba...eD.O...y..`....K.`..[.....".....u.....O.b...YG8.=....V...NFk/.t..q.Y......K....!o0TE+g.e<-.=..h.z.:tNAW$..L.......c......|,+ n]..|.$..T$~.......3...x.(s{.s.2..`.H..nXq*..p.+.N....p...m.M..rR....../p.....=..A.....{...._...q..E..k=......:.eM.j.5.-H..xC.....\.....q.K.t..-.....{..CYg2.Ft.f.W.%.^q .I..iFY.......`..[..E...8......x+.J..".(]i...a.........!...q..B>.I...........l..`..S.:.Q.D.G.....y.{> q.E).../...o.~.(.@ae#...

                                      C:\Users\user\Documents\GLTYDMDUST\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Documents\KnZ6TJR.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1270
                                      Entropy (8bit):7.84090575279717
                                      Encrypted:false
                                      SSDEEP:24:5nLnUtQ4DNY3LlUyDpU7K4fU7e/B2eYnHx/q8jeAS+p0kCtc5RYVG006H9G:FLnnaKUUep9YnHxq8jk+pRg5G
                                      MD5:3D53E342AE6B4E0FF814EC3502F0BCDE
                                      SHA1:17C3CE5917086A9A3CD641C2FD71E95D063F56A0
                                      SHA-256:F4F894D0BAF86D7EE72FD211414733F4161456220EF08B6E17569B4298EC2EE6
                                      SHA-512:6837B20B94C25655909B80EDCF6D604975483E19460F8998B889F5048FADA5289BAF9E9D06BA01A954FFAE2A7C1C0FB6938093DBFB450B8558B060D88E9C8B4F
                                      Malicious:false
                                      Preview:.....<..]..q..JL..+h.8KV.)AO.*.<..%t..._....S..CP`..&./....AX).?..0.'....[x.acE\.^.Qb&M..a]...5.5..DY.%nM.B....9.GP....N$3....:.?u...+...*...t...0..3.jj&zc...a..!.......A....\.f...-..uc9n....K...Ij .H.&.)j..~........\.>....R........:.}......j.y....X.....Jp.E...k<.hL`LH.4...%.D....".I..g]:...<.:eB....h20.Zg...T.w......g.]..W.j%.%..F9...Z.U........Y.CTU.9;\N..2..Hp=K*f....aJMw.....&&.We...q..N.5.7.{.2. j.v.1.A.0,..Y~.7.?....2.....!.._l.M.-....T,..H.....}dj....R].....,..Y^G(.oT.....a......s..&...<+...tD.L%.0k.....,L.l.L........7)f....~. ...&.F=...O..].."..+.*.8.Da..ex..b3Yj.d...v.........Q]v?p.d..aM$.:..R.w3~n..Wj...`|..K.`....&rB..1..]...e...sv9..R{..U...%.c..\%.R7 ..AoUp+...M.o...\x.75Iz.Id...]"...i..X....<BG.`.-. Rv...N..m.A.Fa.6.......!.1......}?=.#k\..y.:...\.Xr.U....-. 6.....(ZDp...=.nI.......7.H.....L9..\.>....-.s.d.h..M.0.z.....O.,%.....7719^..R.&.P...m8P.v.......[......9k..K......P.;..w..Z.(..(..O.`.M.>`.vs....w..> .E..(r...

                                      C:\Users\user\Documents\LIJDSFKJZG\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Documents\NOUDzHw.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1273
                                      Entropy (8bit):7.84778354902221
                                      Encrypted:false
                                      SSDEEP:24:ovF/x9zs7rAidx/l9ALXvNDZ9g8yVGjX36hhkBjNgG006H9G:859zax/jADJ3gojXU2w5G
                                      MD5:FBF1F46CC48AB5F32FEFAB9D75A2CF27
                                      SHA1:6E6E4F7760DC870E99CA26CA92B50AA4CDF40B8D
                                      SHA-256:2BA7DFFE8502E9ECACEA6CA8144B6767DF68D7665E6F8AEA967F17E1FAD96C26
                                      SHA-512:CBFB4DEE21745FE387F79EF4C3530FD9C1B63455B8A48E7BC1DCB6AA7C02C163683840C3A75B1971B0E1E7F5CEF970C6CCA74D0F1891DF0AB31525610D2B7DE1
                                      Malicious:false
                                      Preview:.....@:#.n.9x=...;.,........nwo..d....CZ+..@......u...K.gy\.G.x..f.A 4..9.Q<zkV.."...H.....f.Jh-k@....z.. .n.3....w^.n*?.A?......S$[0\.'.@yRT.M"U$+..P]=!..y.5.h....9J...."4.....d,9.~G..h.5.?.l..3........M*[\....o.M..Z.vP........i...{M.......6....I!a..9....0..I...{.6.#h..;.R(..........{S...T...Z5../.@....P.N...D....y.......@k.*"9.Y(..3.......m.X.o.....rU/R.A%.n...Z..`.\$h.]....@...,.......f#....../.&+....,.&(..!EP.!..{.....@....lX#^;l).\0lx.P...W`.....2.....].b.q/.*...R... .l.4.$mr..K....i|.._W..y...8l..}M..*.Jg+boy.v.hj..3.&.m...s'.#..(a.h].{.f;.....3hzkm_hK$.3S.,.v..0%..........NAK.9....[..6z.....Ub.?.......B....h..e1..S.k..a.)VkVy...*.]).....\..Rb.. ..6sa1NPz.0..v..k`........wVk.%.f.....B,W4Df..^..6....X.s.X.0J....].._.`.0.^.....r;J..`{..rw.....W...z.QH..V.E...)$..3..I.4..&w#.mQ.\...?1.4.-.....4.g..F.s.-1...0h..+..=h.=.c.hu._+4..&.. ..Z.1....u.&^..7..*..8..K.._..#..R.?.._k.g.?U...|D*..8{....x.8 .7....b`.......k.0..uu....e@..h.%..jF\.{.B....*...:..h

                                      C:\Users\user\Documents\NVWZAPQSQL\AAGETPC.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Public Key
                                      Category:dropped
                                      Size (bytes):1273
                                      Entropy (8bit):7.862608463463077
                                      Encrypted:false
                                      SSDEEP:24:NMxXiXDWyMZelg3yzknoS4GSMOQl5/2P2BlQiMUWRhkB87G006H9G:NGYWyMZB3DnoS4GSMFO+BlQiM7R2qd5G
                                      MD5:FC1856F4D2B60C4D6FE3E46173C8CAAF
                                      SHA1:9BE30321CE37C15FB7967754710E4586D13A836A
                                      SHA-256:C42AF4BDF5A0E4A7E73106E940375138A05FD24F011A194635515818FFB2532E
                                      SHA-512:4E4D3895500720B0C2EFD5B454BAE345598E3E5EEBC422AE010E2276928AF45E80941D9E9C9FD71C1DF698384923C02EBDEA08D1739AD48ECAFCC6D229BE91AA
                                      Malicious:false
                                      Preview:..y..9.C?.:N...j.2,O]qx.x8y.-.....O..^...w.^.f.C.?S..........rU......bkE..ONR..s.c.g.....u.p..o.....1....H..a.z..a..K..z..>.......[.....c.u.x.q.M...\eM.5}...t..d.2....2..w.i........|%B.....-....W"x.>.b....4...Z...~.;.Y.....mbt.. r....9....R?]!.P.\!.~....!gQ.i.;.%.....S.Y..fC...ZQ..b!.....J.......5..O...=.c...]U/.L..E^.....(.).y....&.o.].R.......RYU...n..A.. F.."..Xt.6&]C_D<...`?..H4.m.g...9...>.%.W.t.E...$7f..{.W..\...i...kf..^R.G.7\.."....g.1sq.....}..n....@.^.;.....[..&...8...q..d.x..c.j..n4...|D!.......'..JW.".+1.T...b..:.L..X.#.....Qz..W..a.v.6C8..=~E.K.......P3b......h.G..F...h.&".aJ...].9..G|..8g..B...7..D....Z6jT..>Y[.._f.]....A.....d.w.p...%.v..^0.X......|...Qq...Oj~........z.0wMA.Z:*<..8......n6....d..vx}.UK.<.G@..>B.t,...3..{8.*...........Wy.5>r#....q..W.q"4..6."..)I.U....FW..~.!W`j.&..C....f...U(-E..i}?I.V.djJP!Uh"/.........dHt...?.BI$...........=W.T.}./.@...Z...I.;..j...D.<.[..i........\..+.....7....P<..g.$4y..w....%[:;iG

                                      C:\Users\user\Documents\NVWZAPQSQL\BFxh6Xc.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Secret Key
                                      Category:dropped
                                      Size (bytes):1267
                                      Entropy (8bit):7.832342103749971
                                      Encrypted:false
                                      SSDEEP:24:QsYKt5cPcGmCjNN5QIdADxvwkkJfPMI/KUfGGTZmG5nFVXGjJF79ouWG006H9G:lm/Ctvw/MAK7GTZx/ctFiuW5G
                                      MD5:CE5D6AA95E5FD817347964FBADE93810
                                      SHA1:B30D0D9D85CA3FBF9A989AEF8FEA4B41F64B2256
                                      SHA-256:FD8CFA473397A2F781DF7D0DA6CEE251768100CB49385FAD754063A3EBA71D38
                                      SHA-512:648501FF8A805C21032DAD52BB982D707F1B150EB4A28A515A596BBE43AF8E32FA7CC330E4A2EE14FEA831FD8DC811D31C88A52020B014F7B0653BD7E87BE2AA
                                      Malicious:false
                                      Preview:....s....8..2..)....a.C.........Y.[..vq^a]Q.R.).{..mP>j#..S...28f..f.;..l..Q.S..,1s.._.e.l.#+.....p}|.l.d.~R.}....~r^.V.+.l9.....&./...0]..Ct..|....2..VzZR.>w....1Bx*5]..n+Q.....z.,u.k.....D...Q\..!.C@.?....+J4..]..d..S.....s%.P...A...}.F..;..I..u...f.}h..9weL.O....rm..<<.v.<.C..<.&N}....|?y...D.+..#.....)..._.9...c'..H.tH].Z1|..i....^.h~.SY...&>.E.>ah......<.f1e.........}...n.c1.&..}&J.iW....E..~.4..J.k...R3.....Sy}i..ko.].K....<@.@.l].ol.Z.4'...id..+.7....^l..mUTi..........8..V.e..|m'.x....8..........v4...l...?J.9.............,......`../..kO......7.$.....yT...Z......4..4..p..^...-..4wd..sH.O...#.....AF..a..1"[.Q2........F2[Gu.T....P.-.I..W.A`/cI]..s.........=U..?&.*}.Z..$..0#J..|fu>...!d.C.$PA.?...n....Z...6.*....1.7.8.4...D.2/........U..h.....V.\Z...|tg...!...L.;..%.].B.yz.H.E...-....7......$..R..E%pC..n.VQ.HR.k...$..4..Q.aU..#....7..^L8..,.........*.!^.QD.,..*p....{(o ..'4..!..6P..s...c.6..5...=..T.!q.z..t..E.......G352.^0..

                                      C:\Users\user\Documents\NVWZAPQSQL\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Documents\NVWZAPQSQL\Hj9SZog.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1272
                                      Entropy (8bit):7.859091245351896
                                      Encrypted:false
                                      SSDEEP:24:0fNfZSU6xVzdn6cPIPbf0HB/HT8QC32wxlUEPCcArVG006H9G:kTBM91N1T8QOYEbUT5G
                                      MD5:4E53FE3C018A7A022EEFB3F3C0BDE77F
                                      SHA1:FE3A4CB7A567D10CF0F60F0094291645EDCDD7E1
                                      SHA-256:47D432294F4D6006DACD1448814264563DBAD7CC6E31254CB1B1223B8B6D29C8
                                      SHA-512:3B0E112EAB56CE05EBADAC523001AAB2C37E2C65D7C948C2EA5F2878E1D63B132DBDEBDC9C6A64F5019227134B77AF492EEF9F2B1170439688DE3FB3C1DD1A27
                                      Malicious:false
                                      Preview:..c|+-(U..?.....}...?..Rp./...\..@na.i...8n..!.7..M.@...9a..$h.u.......%.r4. P._.U9+......2W8.W..o.+b...%N$..i...#z..?O..c...w..`...X.%.U....9..q.....1......+1......yn.%.V....>\].).m..s:.2.n......3G......C..@...........:...L(</....5Q+...\.Q..!..H............Z/.>'I..9.L#.M..Q..._k..WO...........Y."...k.@..h..T...8..z...YD{........iV....uL..?..&.M.....v..Z.....0...L..Tk......w..V+.m...~..Q..O..}.3.v......s.=`6.o...s.l...I.+.g....b.....G.i7.^.u..yM..HnQB1.kU..nkM+v3.M\.}..).^V..m.r.....Z...V2.D.F..j....<...^'..)..t2.r.?.P.(.w....~o.........=x?...B.......A1.5.X..?.......]...u...<....UXy.8.f.C.....7s...N.......?.......v#.2.t.z[e....J...*...E.(....V..J..y.D..l......c..J..%a$.5c]K-..=+.......d.NQ...M...M..z.......N;..fG....&..Z...L.H...y.Yn....X0X...[.......J...A......&C..D:.l.;m...p.!.cux..nL.....ql..yZ..8..L.kz..}....oI]E5R..U..o[w&l...cW....\...?,.R/.c.2.[.i5.J...=.M:.=....,.%..Ulq.......~{6.Yl|2......!..cW.o...D../..X..]<..o.....q....].[.

                                      C:\Users\user\Documents\NVWZAPQSQL\QdgGCxu.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1271
                                      Entropy (8bit):7.8350711049505195
                                      Encrypted:false
                                      SSDEEP:24:DqUlspAzjS7VWgYKzAy4bgbUfKbHOojuoQNfs9LKCNQ6ExkG006H9G:GnpM+sgVmkg4pLIDCnExA5G
                                      MD5:238C4B45B62276D3439612A883BBF535
                                      SHA1:3D54FC8A0CCBBFC22D26D5C490E68779A43F5731
                                      SHA-256:056165161D3E605FB021084D160999E2C32ED138074CE73FC6BEDBEA00F7F49F
                                      SHA-512:496E557873481184BB4842DF8F1A6B6B7ABBA160E17992494AD3346E39C44C1E7D46A221BE56A6F27A1E443BB8DE5EB42C518E6CF3B489230C07EA8FF1CA0BFA
                                      Malicious:false
                                      Preview:|.-.n.z.l.u....J.H@q..F..%.].ktBR...Z'.n.z..UI<'.R.MX.P...<.x.....&.P.H...Q.Og[...i.R........q../J&\#...S...y...*<pV_dL.:....W.r..s'..<HB).."..V.........|..O.i.h+Q...-...V.0....E}.(.......J..N..j..^....,./.NH........P...}U.=..^.d..>....j.(.4.....]Auy..\..(F.s.gG..P.Q.:.q...+.R.O.A....Q.W..lC.zO.;q4..T..%"..E..iK...5.].....Q9.....G^YM.|.*k...TTp..)b......!.B....+..P.%2..%.u..y...........(..K'W`...E3.o..zW.R..:.............4z.f'U*..g6.J.!...;-~..m/c..Q&.....w...u.a.....Y.....F3........Ni....."..r..<.........{.J....R.WG........C..}`.7=o..9l..P3h....4V'....ts4.M.......=...;...SC.a0.=.".P.l..I..}Q..........^.S....~..X.o........0]..Y...b.....fp4%G......../..Y.........7l@+v~.h.N@d.....G...\..h.lj.nsE...{.L..Y]..f..R`^~6)..qX..3K..M.5..x.A..+.......9J.p..Uw......R.{|..j#Zr...z.....2....W..)T..A2.rn..h.>.>...e.n[!R.tg...]b...jf+A..KJ....T.Q.{..F6.......FL..E.?~G.....)...XT..;I5.l..*....A..1I.H.On{Q.:y.0..}i.v...].R>.u[8.-.o?...A..O#..WR.t..w?.;..u.eW.Z.O.......

                                      C:\Users\user\Documents\NVWZAPQSQL\ZxbkHoZ.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1274
                                      Entropy (8bit):7.85548195334604
                                      Encrypted:false
                                      SSDEEP:24:r+HsJY7vfZLBHlte5oYh+OFtvymjLe/X7+BRG006H9G:fY7ZLVe5b+ydxezQf5G
                                      MD5:EC25F90ACBB3AE8230C908CD339DCE2E
                                      SHA1:21CACF1FD0F41622F102B0BAE585E997850A9CB7
                                      SHA-256:FD02AD56DB7F9599666C1B5A294B4F19C79F96B7C0271420DC9C9AE12133CD07
                                      SHA-512:79F25E1A8B3DD1C33A62EE87E0D403799C159029F704F4809218F1B88DBD09CC278298D9A7CC5CE2A58D51D368AB6DC11CC07979C03B0CCC4F1EF21A5F1A0599
                                      Malicious:false
                                      Preview:Q..-....=..6..h.9....;.............+.{f.V.S.VU.=......;.{.&.j.!._..M.Q.t.y=...4<.9#.N....i.@SJ..a..Z.....Xa.9*...R.>...kE...y..@...IU...k...rT.."T...X.^..|C....$..r.......m......c..@.......Ci......p..)....Tl_.B$.. W..O%..j_...I../.:.5._b....>..'CD.s.......,.....Rf4..i....p...C.ZE+<.#E<s...,..z.E..=Q...\z....).....e[..9..9..9*..K0Vs..e.l.....Wh$..X.s....2h.;....*...t.m...7gU.;>V..x.AsJ.F.g.z.n...i...k..?....?..esw.- p..9..v..V}..j.i..{1.1(N..f......B#.....<X....-p.*.....3n(....}....{.......#:2...E..z5.4%.OH...O..xK..7.bM.!......'.7..7>.|.3+...iWu..x.So.>..i.JaX.Kb....x<O..S58b..U.......m`.z .l'.].p..]S..{.^h.O...M.?`=.6..x..|b.....e.........m.5kA...;{..xx.........s...b..*0..WV&...O.O....>.Mu..n.....9.8.D....R*.X...L..ZC.^.,..{f..?.. .O6.9..-..=....y.>'.Ha. .r....*.&..I.b...+Y[Z.`$....X.}.....G(.....e.Ua{..5p.%...+....4...on. ......s0Y.......;G.m..iU......`T.G....A....L..rF......F..`D.:..!...zwd.!\O....#..u.c.A.}..1..=+.er....AQ.dq.61;.H..Q.

                                      C:\Users\user\Documents\NVWZAPQSQL\u7HEz9i.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1271
                                      Entropy (8bit):7.8515727020125405
                                      Encrypted:false
                                      SSDEEP:24:h/ErT/vJrcLbgIUI1A66VVfhThSsNWcgnzcoGALjcB6agQ6MWG006H9G:NkRcLbgEa66jhLwbGyAkt5G
                                      MD5:247E782FC71482E237F54A54C068926A
                                      SHA1:8E4AF8DB743239C8F539B4F85FF5F4661331413E
                                      SHA-256:A142E7F46129FD77CCD2377D9F761194907E8DD349C54AF68A684FDF2509057F
                                      SHA-512:90304363E9B6459E37E293F6830B987987F47BA6723E08D60462AE0E472ADBBE947697C72BA5302D014DD730EA385EDC88B6381BE2CBEF2FA0E72955904ECF3B
                                      Malicious:false
                                      Preview:,R.>O{...q.znW^...HN..%.n.o6.Y...q.&^?HMd.VLj....I...>=./#Z"..+..h /..v..\L...<.. ..?.f..{z..:-..F.c.nk.z.@.....[.............$.#.:2..CdYv....#l...h...W.|q....S.L.7l2y?.T.r.E?7@..V....9...!Z.r...W.!...k.........m.pT.......q..=...al..^."jb....|ee2K.....<..F,.1l.......~=./..Y1a.H]..N.M.!..........L]a~..._..9.."Vk.j.`...y....c4IYe. .Z+iJ..LKn-Z1.0.A.F...y..\.kV.N.%3.|=.!..Ln...f..K9.16..a..&=.K.(.P.v.....EF....B... ..'..Z..X....}.T\U....8~J......?.K........;.]..>%.u..(m.@}.ea....*7.....@.h.yM..u..E..N.K....`..4....n.R....gW..r..jN}......<..9...'........(...@......h!.k..../...kH....iQ../O^...fCp...P......f'+.7....~mzj..._D....*.*.-..<....0O..!.....l5.....~......oLx..H.vo............(..........;.iR./b......>OB..l1)..........\..0...Q.7.>....l...F..l=D7.x.=...x..... |Og......(.kd......Q[..%X..ko$%!.E.\....Pq..x.......b.......P....!.].......Z....T.]|.&...F...w..t.*..._$;.f.#m.,J.C..;....>.4.?i.!.H.&.G_E..F;........' .r.L.s]H...... zZ...S

                                      C:\Users\user\Documents\PVDW6vx.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:PGP Secret Sub-key -
                                      Category:dropped
                                      Size (bytes):1270
                                      Entropy (8bit):7.837362493914065
                                      Encrypted:false
                                      SSDEEP:24:nXXZYd3CGo25wr9ouMxdmnbZat033mfH/QZN5MBPNYN7nLiqbdYtsvG006H9G:5Y1CGomaOuCdQbcf/iKVYNTLiqbdlx5G
                                      MD5:7EC699E0A7E7A0893CA8E376A46E30BC
                                      SHA1:94DDC9E457008D765D6D16B5440E3A92D5664D81
                                      SHA-256:03A5C2EA8F5A300237C46DA8A4552F4796D93AA85188AF9172C500099E7ACBAE
                                      SHA-512:98191F3517422CBF7731CE95FC4894BD941A7A86859A522F0C268C2E29305F881252E82B920A2954ADC8B69DB3C39DFD20EE0AF371A9725ECF15369EE350FB91
                                      Malicious:false
                                      Preview:.;.G..."._B.......t.,.r.0.?.i.. ..n..!.J..PJ....A......Z.EZ...P.l..".M...7....^:.o.M.~!6p....,..LT.F\..6...CR.e)R.Y.]P.+.-J..k!..Y.29_......B.Xl..=J..."...:.V...._T.Y..9.`....[..............,.w(..S&:....6\...T..6..et.%.I.c5.....oj...u@1Y=.I|p........P....".[..^....F..k).&.K..'[Hvb<...9B.!l..{..P..-Z.i_B7...?(M.5"..Z..c..b`....+..;....=.S..!s.w..........u.3~s0.)~..].j.%..H)....e[+.....BJN.?.a.y..A*n.$..%..B..I o.l......."N....3%6".4T.t.t.._.7.W,..(9....X..n8.bZ...}.........t...w>).S.&/....|..k... ..i8t....6.y._..g.am.mN|..p..s.+L...t.tzv0...}!.c.).TN!n..W.K.&*.....*.J..{..0.sc?....9..>%.~.j..H.ed...x....w<.....0....Uq..X.khS9.... +.l.t;...g~7.a.J.#...b...\2..).H(*..6-v&m?...r{.s......(..H.s$..\u....VM...od...U....t.H1.g\.2..Z...8[.6..in.;...E..8'...3..x.n;.V...........h......%=.P..+F.J....@/S..."|.;L.O.p(rcp...e...c]'..k.J.2@..=Y.......X.6.v.R.w..)...)..."me......z.7...2../ ~2._"Z>.Y?#Z...........Ms........y.j..C...e..~...y=.Y.DA....J....

                                      C:\Users\user\Documents\Q9RRwmd.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1274
                                      Entropy (8bit):7.853784075249923
                                      Encrypted:false
                                      SSDEEP:24:5adJxy8uywD8UST3Y4Z6xyRUo5NkEGsthJGpIG006H9G:6TyJnDzS84o6bGUl5G
                                      MD5:D1D252C968E9D7D1A1B33BBD813BFA57
                                      SHA1:AFE969AB61DDC2D23B2D40550841B8876F39421F
                                      SHA-256:FF4F1F3523D56CBE3BFB205BB40A08DB5B5981B93B6326CDEDEACC0039D21DDE
                                      SHA-512:5025A513153DBF8433C03E0B099A664D5DACB8843FF0D13F84EE885E5827F26DE2E1283F8B101ABD2983AE89DDBB960ACDAA84D7B990F19898569FA4F87642A8
                                      Malicious:false
                                      Preview:.b..k<..~....i..\|fv...T.?.....*.W..$.<.K...s..i..$.F..fJ .:ME.d..1)..~.C..m8.:.........).yxGt...`.N..c5q%v..,.......At..U...xKw.V....6......}}.....5[.W%.3......".<.$.?.|..Z..t.[.l.:...wqe...[2...U....7..:*.V.a..)Z/.=....*.e.7`.GksG(......:.M.{...Z...t......?).l.S,.8.~.m7...T......hP..z.....1...".:.S.4.O...a.l.."R..<...>l.TE.Y,.k...(..M.6I.h.....$.....p..F%../]$GE..R..T.3f.........4......mF.........0}.F...!K..L.M....?.?..........fl{...?......w<.&4........5..b.D.a.....M*..k..k.q.(......f6..eP....#"...w..gj;{#.W..ny.R<K.p.|.{q..=G.\D./[p 6..Cu.........L....~......y.~.:...cE._..A[D...k.[.....i..!....*......~@Ff........C>.#9.......[...M."@<.C9.,....1.!............J...J..g.q.....:.#g}..G..j.8.{.ATeBb...m\.M.6...Mr.C...r..R....yI..9*...07.RA.Cp'.u,.H.w*R...j.3...g.......J.wU].....)-....oc.. ..=.D.....i2*.I..u.3.*.......W[.@...x.~.@....;g..........4.M~....h..p.9y..."4.&P.m...RH.J...].a.l".c.w.U.7...7|g.&.[..T...B.}z..FzTw..9PM'.!?..P.

                                      C:\Users\user\Documents\QCOILOQIKC\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Documents\QfsTZZX.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1267
                                      Entropy (8bit):7.850712782888742
                                      Encrypted:false
                                      SSDEEP:24:s0lSqEAQ/hCYzmXgtl/rmXGZPmBbs2YIMMBRAUR/G006H9G:WlAhYzigtg0m5s2YG3AiB5G
                                      MD5:60453CAFAC8EBBF111055862C67F193B
                                      SHA1:28CDDE88C159D2803B715077C41049AF70C2AD37
                                      SHA-256:FF6C762D3B888B4642E402740C3F92FEA5378962E52A982000531CE0886A5FC5
                                      SHA-512:FCE1BDD381B6B2BADBB9B48D238BCF18D2AF9F481DFD635FBF5158808288C1799E73873A62E2C6AEBD1C4C31C9E65AC8F5671FAFD7D3135536648A70A606A510
                                      Malicious:false
                                      Preview:.|..>....%.-..Uv.8.A.....MN.:....g/.:.....Xac..... G...l..A{..v..V.eh#E.-....E.^..P'[.6.......{L.q..,..?.".Eu\.+).=^.op.o..8.F.e.(....0..`.J.ZS...t..j.|.rr..9)d..!v..!.Q......[...Zt..?....g...*...._.........'."....h..4.A8.=..=j.."?^)...j..o.e.cN..@.^n..<..(........]t..m....|..y.....ats...I..oX..c@m.o.aM.x.m..........Z.*[..E...............B...u.d.D....lk..)..k.I...W.....^.....di,.._.smT...\/..)...J+.z.l^..m0..Crs>.D.s.W..n781..T..(.N.....h.!.....>Q..tB..'rC....Z4*z...3..0.2.k.._7..4*Bj.wW.>;,.....j=....8....!/.yAS....I|..O.r!@B...v..fd.E.O......HU...k.....9..]I.f...*h.t.5*hY.:*Z.&.+.....O..S.... ...!..@....X..ig-Q..Q....8.."..$...y.....5.I.{.....T~.V.].9q....2..9C.Q..Y.i.{>.h..HFrm...(.f.J./..6.Z.4dU...@..j?|....*R!,("....dA...xR1%h.....ri.pHg8...:3.)..N..p.*.Ij&..ET....KK...xQ....cBela.@,.^C.M...^.$...!...NF|C.=W)...\....>.....a.,........R.A..I.....y.g.....FVA.{.U.h..W.^..X-(c..E...K...g...F..M`.{.....'.?..*Y..aUq..&.!...<.Q.z..s`g

                                      C:\Users\user\Documents\TQDFJHPUIU\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Documents\Uio22Da.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1270
                                      Entropy (8bit):7.8527140228871035
                                      Encrypted:false
                                      SSDEEP:24:olG9B6cGEak0li2U73UyEc7Jesg8eA2Yqa2kY3t5Zoc+HdAn5u3OVwyKRYdmcYGH:8nY0l7a3EuYDTm1KxB0dqVwhRSi5G
                                      MD5:C25E354833785CF22B438E3D5FF9B3C1
                                      SHA1:2E7F1E83B8B918E8F7DBBF01F11F001B0BE9BBC8
                                      SHA-256:A483A4579FA3D99D03710386CB9FAA1C45220C7925A5DD6B2B46590928281908
                                      SHA-512:B5CF601930274AC1A8EBCE424144D931A3B2DE72AB2B56DB49F7EB584C7C1B597EC7D0AEE7AA6EE9F359EFF499CA2257B91EBD18CBFB96BBE20E32B1005E19CD
                                      Malicious:false
                                      Preview:....e..............a.&..1...s..........I!.M..c."....&.r.2..$....Q..t{...F.!..q.._..qk..Y..z.9..w..7.`.G..$..ng.X....d.=i.c....4......V..J....._.......A.3..C..Y...7^x...+.?O..G.u#.IX.E....?.~...-....`.0..",...+......t..|X....d...4zR.Q.^.X..Y....l...?..(2../.....Gp`.pQ...h<;...J.D..3~...;.m.t....b.F.I..LP..jB.u_.7...1..<.~...Z.g..5....U.:..1q+.5A%..b.....f.<C....o...$?p.b.U.v{...E".l[.s...U}.._........'k".Z,-.X.....T....SP...Q..#.A|v....^+. .t..>.*...7...`S.|.Ve..uo.F.FZD..W.ee...JW....K....%....L./2\.X.[T.|.h..?..'.5.Ru.Sv.3..Q.I...Q..... .d}.VI...u/.$}..h$}..azy}a.SB$.@L...lN..."dV...$..dt..n.H.&{.Z$..!..k....N..)X...@...3......[xRY:...""..&V.......C.M.....p............6M.....|..hB|<.u.. ~...y....{.........T..f.K....g.h...N.....!..F.`.p.4...?..7...q.X..Hn.(A..D.{Yj5.~"f{R....v......ph......L8../..:.6..r`Dq.....*..WQF..\`.y..W..s.F$]u[:.`.5.'$.......o.X.(M...9....O?wo..../......8.V...e....=.e.F.P-...d.MU"......n.Z...<x-...DD.g....jN.v.=.o9.

                                      C:\Users\user\Documents\aSJzf8I.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1272
                                      Entropy (8bit):7.853949333343297
                                      Encrypted:false
                                      SSDEEP:24:el6w9Wg0wyUsTRDpkCexGwWFn/NXqIVhjDYc0NWoSrJBybkx/N7G006H9G:kF0W81gx9WFndhGsoSdJld5G
                                      MD5:3E7E3DF0A6ADF03E7966BA942A659416
                                      SHA1:9261720156B0FCFC5055E16DDE87355406E17CB1
                                      SHA-256:D6E19505680EFC568BE0A129BF8C6610BD679C5E0FC53D3B628CA95223BB0666
                                      SHA-512:0A01A0C9F463BDD520010258ECD14B5BCBB6C3E05D4E65A3C9F76BED691FD1BD9629B88A8FFA811773B9A427E6353D981FD97FA2D96F283E9B5E5ABD8DD59817
                                      Malicious:false
                                      Preview:%....................s.o. .'.A.......S.Z.btN..Mf.f.\...#..S.o)...e.6S....I....s.}...@.v.....J.p..+.2./.,.O.r.r.7....y....?..!......Zxm.....A.J.).7.1....f.%$..Y6.I../lyc......:....)Sx.ba...0....T...%..E....Yx.dd..,o......*.#....."...<..C.u........0.....^j.N.3#%....b..i.o.S.v.....H........L.!..&.V..D..b....P.S;.)...=AY...o+.9.....^..U.J..r...8.....x..{3X........p.?.9..Y./J..A.W...G.I.+d.3..Q..[.Z...3o:-X1..X...>V.3._.|9tD.....@.}........P.9.\....[.*.g.+E..p.../....o.t.[.....+..a+&...~....{.5_...X...Hf[.l.dj.1+.C}...%. .h. ZR.v.\..%O.(C..'.vQc....@....Tm..2..\..0h..!E.d./.w.;.G.>.(.pN....%BX...1..."\F......#...M9.R]X7..?......9......m.|..>./A..$g0.#5S.gy...o..`..0.vC.mFTQ=.~..........J%......E...&..K.`..g..X/...I`....kD(./.L....t...$.p..?..^..k>.+V9...nO.J..c..8..J.1.....w.h"....t.BL..$#.R.SYK:.v.4~...GC.....;.......rX.).../....O..^...h-.?&...U;.....B.....a8..D.m7........~.G,..=&!fK...=.!..C..W..j_.|.h>........A]...]..A.Ix........?....

                                      C:\Users\user\Documents\aVr9ogi.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1272
                                      Entropy (8bit):7.851129848667
                                      Encrypted:false
                                      SSDEEP:24:EPUWJKDJOOUyFdrCfPR8wHIIEi6RIswSgcjLD1nf9BskeDhX5xxxi/kUwG006H9G:uUGKdOOZ+nR8wHIli6R/D1nfbd6hXuas
                                      MD5:7F19FCD1752D67EDF382C2A3230D07D0
                                      SHA1:98645F289EF143A721B8854A35B6FA342E2D0E2B
                                      SHA-256:6EE91ADE48BDB73C1C14E437BAF5F2B581AB39637DC51E2CFBE056515645BA7F
                                      SHA-512:B91E8DFA7D48DD2E5E1DCF0D3769F20881BD97DC96B7E1719B8D5CC6387DC2B34E722F098E02A9029228E5BA95FBEC06C90F280DAA7ECCF5F3EFCEBC484530B6
                                      Malicious:false
                                      Preview:......#m.mu..Q..U.&v...t.C$:.z.%.u=.Nz.{%.K....Yl.3HLc!.GY.....*..2.h..N..kL.h.Jd"..%.y......X.I.L&.n.I..\.H...;.Z...{?.E.'..!..tL..R.....~."2.......r.%.:..+6..M...N.`...x..U.V\..7...z..-...O...e..@*%..d'.?8...C. '....+...u....\I....j..7E......:.=...k.8....Yw..>.B...K;..`..e../..a*..,.]......L..u.#...k}...[.cU.{....}..*...5.....R...G.~.9.v....P.E..c.....-..e.L.c...w..a..X9ft/....Mo.wT....z..q.SM@.}gfM..1..L..s.v...?.w..&..;W...2...|..K...kY.Ka....}8..D.'...D|...S.%.9.+...T.u......\|..P~H..wz...t..o1. #q..n.}......_..=.....,{...4V.E..u.....6..6.G.6.....qX.Zf.m.h.+....>........k. =$7.5.........Y.d..{..r.t.j(<....tw..l.I..0i*-].'m.A...+L..%"&.......H.x}.F...ri.b...`8.!. ..Y.R.\..\.R....N7.N....meT*.,-......u.M....G.`.Ro..7.`....n.!&.%....vg.;~..k)..AK..~.m.:.?,....)u....B.f.#x..to..X/..~..Q..w...z.@...o.Jxg..{?.+...{.O.Pv.y...I>ce.Gb..Q.....;....W..'G%:.Lf.O..T[.+.w....g.e..MJM.T..6,..r......'1..*.....Kt....4...J..3&Av.V.._R(....@......`

                                      C:\Users\user\Documents\cXUpQpf.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Secret Key
                                      Category:dropped
                                      Size (bytes):1269
                                      Entropy (8bit):7.814553318312664
                                      Encrypted:false
                                      SSDEEP:24:1tOA3eXl0Dai8Zq17O1oI+vZjDE+hPZkUL6qJQRM+dAc7GC3rG006H9G:1L3eXlnpZqNOF+vBblL6qWRM+SnC3N5G
                                      MD5:CC63F66C1FDF5653664669CB108B7538
                                      SHA1:63090D083C08FC5B4D91136DE9D22A61E67F2915
                                      SHA-256:38D5D5195F9BD5D1625B4C963C2F00BA346E36C4503229730C8F3D13B9F5CA38
                                      SHA-512:C3845ACAC724C8ABA868F758EDE58710B0990CEB599D1DB9AE0E796E1869D955362F3BD81FF157E7B88D5F29CC2E48F5AA9020FBE4D9368132CC76517A12CA52
                                      Malicious:false
                                      Preview:.m..G:..T....oSSQ.Y7..S=..p..#...~..){...\.....1..w..W....Y,.F?b.|U.d.y....Y.FM.Z.2.^.x.....s-Fb$.P.....1....I.s.Ts{.zV.8dt...0..=....a;=.....9L..By..k.........F?...........W...kF$D.-...'H...G....Q.=...I...lU..l]..Z...j0..X...C...MD.).M......V%%J.9x..2&x..Z.:.:.H......H.....z....)5.A....=.LyC......D1V.N..1.$Z.Z!...(...@C.a.#7<.".pAw.M...ka4....f..^>(..'..j...D.k......qcS..gY`E....W...3.....c ...&.....4.:^:.Z.B`.+.\.A..@1.qQefQ.8....&..5.5.j..._m.g4..P.V.z...).j.b...c....\..t.@...e..j....6..vzG.....Nca\.l....*'?.B..7.Gt&.^...]*Z2.....b8E.Y.s7..6.v........W6..`L..j.I.....*'p...x.T.....3..g+`..3..\.........!.Q_..]..V..:e...V.}..5.....,J..f....aY.3.H...6.cG.....e.....oo..u...f.9.._'g.>=M.S.H..8.s.W..X.._...]...6..n...G..r.*....L...mW...x.....\J.?.;G.?.!#9......"x...v91T.`...e.2.W.5Z.x......&..q..Z.x"...=m..?Q5.$^...bL..o...W...5th9.#q..V....9.....Z.'.vCbvx.......L...z....A.......m.z ..&..k... ..O..".k&<.Ba;...kd;7.:.p...C...c9.V....(VC.o....

                                      C:\Users\user\Documents\cd2Isak.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1267
                                      Entropy (8bit):7.853870794431945
                                      Encrypted:false
                                      SSDEEP:24:ao9zjZS57ifDC89GMDnyCraejv4EXxqQdPjRrg7pqZKFaehSfJFCsK6G006H9G:awfZS5mf289vjr/vAt7pChehqFhb5G
                                      MD5:41A19FEF21D6B3DAD60C5A5B1D896AB5
                                      SHA1:4759757EDF35F83E07C356A107FF2D8086DC946D
                                      SHA-256:BFD701F39A1D3108DC46680878FA99C422806DBDB986698AD4AD0A2CFC1BB68C
                                      SHA-512:057C1F3DE49A698E34265649C6D8E5C677FE0084F3E8C177C59FC04720AB5968A9DBF6A816BE2B9010A0F06B4845DF8C8577B3AA3B694310CD2CC4521EB13C08
                                      Malicious:false
                                      Preview:g...E..D@.M....P{...L.....qV.~.u3.|Wv.8.B.`|....'".t.vt...#C!\5...x.....|E..e...c........'h.`!.jh.~O.(..o^..w.].G...5.t.1..w.?.q|...l....z.*.1.?A..Q5m..=.ru .i...T............R...O...C......W...GP.....w,..../....ne....e...ix...mI../O..@...}....0.Mw..........K..............s.........M..]$..l+.k.N.7...S..V...ZjF...g'..b.@.M...hi."..0Oj...R...........r.a..:.s5%..Fw.z.......4H.!.=...xl.C..L.....U.A....q8e..u|...P8....f.....6wPI,..4(..@.)..B.E.p.a.`...!...h.V.;..$.s7.....p.\V...H>..*..t..G..op:......;.\.L.eY..r..lt..5...P.#..t[x).rn.../6..".D. .......ue...le.R.)...x.Z...N..'.....+.....2.J..#.R.......8m5...% ..S...#.1:..R.L.j.)./o...;.i..r.I....-.L....`.m...r..!*..q.R.\XU...@='!.v.V..0.q...:N..T..lmH.;..Z....|..m.~a...1.....9...B......o.....U.W....../...F.Kr.......h.S.Q..{~.Vb...#..@.....az.$07...[.K....=.f.R.kkr.q.o.Q.?.......[@|.6<2o...zE;....)..7.A..,.......9..w...;..........>\..;\J&..j.f_e.R...7...m.......=...<...|....?h!hn..#`..X

                                      C:\Users\user\Documents\ejqMSHp.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1272
                                      Entropy (8bit):7.864741179139882
                                      Encrypted:false
                                      SSDEEP:24:iyDvyflHX31lWK1dHQJjqXiK7QyBHVZAOG006H9G:iyDvyN3vWKHQBqXiKpVZD5G
                                      MD5:196C447A834E644F3136FDA3811AC466
                                      SHA1:EC0466285739B93A79E524BCFBC1439F4B231BCC
                                      SHA-256:56251B197A3B98759E859185B92C3116501D360A5155AB9A813E44F34E95E9A4
                                      SHA-512:4519CDD802C415DCFA98DA19211B3A762F714DD947B878A901BBBA91AFACE483730063C164C4B6057DB4965D69100C0E9379A40C4C95FF64762EEE02948AA035
                                      Malicious:false
                                      Preview:...zL....Z.....f.Z.F2...../..2.F.....A.U.......f.|.K.`......;0.t...........L.. ic...5B......t.j.k.....+KS3`...c...._.h.?16?..6.,.h..P@...ry.3...[..V.&M.;..q.Z.N.......`.......l.+'o...|.]..M...8....c ..ox..y}_6\w.\.....Q....G.b..N%..$...o.A...^.p.{/......7.,...Mk....hx....`r......HA...j.....j/.-.I.P.@5.~......m......R...Ue...@ .......<D.J}g...d..n....JC...(#...K..+..H.dIk.W..Q.......G84h..V.....)....R...V....7m.m.>....^........m/Pm....D.....O.bWJ51o1.~DI....+...C.Y......i..#. %....8.g\.1:.l..*.+3Y......&.i..v....1.q.....y...dHP.....U~....I.L..}...Z........F3.;$UI.Py...).... }.B?"..'Vy.u...2Y.Ao.,..K....K.f.*.... ...qnh..&+b."........:F..\..^.ec.w..W..<...}+C&.V.ei8n...;L...c....u.2iuQ.u...YJ....!.*;..x...z.%..b .......|P..Vr.......+<...&..._.M.J.z....og..&3p..8.O.rs..slL...]..e.o.: ..1V....**..C.^.o!.+N.@.0@7...).?.....8...E....H..x%}.%.D.........V......q..'.......1@t;-...P=|.r..W......(..~...r;..g!..!....JH..B..2.K...,..F.....`.sn=A>.

                                      C:\Users\user\Documents\weibr61.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1273
                                      Entropy (8bit):7.848784427660673
                                      Encrypted:false
                                      SSDEEP:24:HkAxTjRJBPqGuNiJgdEcP0sF9xhAoLB5w6APLirJhk+kleQ+tXhcBqYF3G006H9G:EeTjRdpudx3LNAj4JiDkGgYf5G
                                      MD5:DE8F861736C06E016078EA0FB5C5D2EE
                                      SHA1:036E76F76441BA526147C22BBD892FEE7475D1A6
                                      SHA-256:5C2003464E327416918B6495C590AD125133A71E4D87737E36F3145E22D5E2A9
                                      SHA-512:1A60EBF7D6222EEB9C9A260D918D57E5480FEF6114399CE5FF39BBA6DDFEFEE1E44624FB7355BBC4D1CC7BDF0CC71299CBDA383DB7E351B8AFD726AAF7D6EB93
                                      Malicious:false
                                      Preview:......&...i@&.k...].oUx...=mL..7v eo....X.....N.:.V.+..GL..91...>603A..R.;...O....m....C........i\-.v88=.}l.T.."...<U.n....Z.j.f.ACa.........,...k...Y{WvB/ ..X....a........%.RB.L..c....`. ...Rk..K....{.1.~..P.....~0f9~.F:...b..7a..y..@...........7w.I|o...ZG...t..m...... .R.;x.g4h..../. ......C/.....G..d.1k..Y.:...?]..c(>Fw.Q...=...Y.Z.W...lBUnB4a..rxT..j....i\IF*.:.Q..=..;0'..h.y.HP..l..?......d.'.S.....}.D.1t..~.K...=..G4.s......F.K.-7g..L.di.w.q;...N</.>..)....A.-"..z.$.....zBa!O6Z..>..q.J.....9...y.9y...t.-x....wI...Q..PA.*.;..<....Z4a.\./.....e,.'.,.C.-................~.V...dJ....5..%....p...1~b.b.].;.v.T.wb..s...HD......d....3.f.n. .p29._...d.t.w%s<..- r..N..._O...S...d[.D].CQF-|K:..jG.mu8fdS.t.c;..-....7.Y.{y...."...;....]]Q.@........a.ua......%.k,.|.0dd...ocf....2'.D.gW.../n.6roY..0|.`..D.-...a....T.4...6..L.m).][V..r.......7.:..j:bt6..x..Bs....d_....^I.a6....z.7.~Z"cZ....>.Wc.V..<. ...G..."..*.)}.?.....$3.......E..o....t..8.B.o

                                      C:\Users\user\Documents\zJBTz52.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1274
                                      Entropy (8bit):7.851620091967557
                                      Encrypted:false
                                      SSDEEP:24:u0qMM2TEtrsNvejewecbdNBIBaGUujx62+YiiohM5o9MIzBG006H9G:oGeIW/JLB0RQ/Bioqq9JP5G
                                      MD5:5A72C9F6F69559A4E98ED19E63F1CC92
                                      SHA1:78AA1E5707723514F3D7749F6316144AE6851176
                                      SHA-256:44149B1927AC66C4567E518486369A763D0BD7F51BC3D815A1A3715859202E67
                                      SHA-512:EB6C7919E002AD5C24995CDDA0D3198994F702F35C01EBAEBEC1EEE69DB165069E325970CEAFAD28540664849589D8EAEB7A7B6EA0FC67E72909D8798395F713
                                      Malicious:false
                                      Preview:.!....g..\...9..c.tW..FS%..3.AHd{..,.K{,..l*.8.Q..Y..1....ZP..g.$?RN.D.<........H..1.C...U.S.O.$y.jK.....;_..D[.........c...j....N..t...P...4l..@p.S.(q>.RC.F.Hs..X.^...@..qB*1.. ...be.).$+.J.....J...@&G..>.Q|n...[.,{.........5...^...A9]...&XJ..]...1.`....9U.2.......C........6..N{..G....Y.k.D.Q..!"...........d&...+.1v~g..L8.p$...t./6.CsR......&....A....]']r<..j..v..H....RD..x.Q$Jo.M.t.lO.Qt...!..e..*?j..J.hE..X...l.....+v./..W...".A-.'..3... ....P{}/...F.h)../.......F.qM...|.......*.^......0..tiG.(..Mr8.d.Q..Nx.0....6%<.....?@.5......$.c.z......./..]k(..............K.5z&.Kx..W.q.iY$.....b.=.)..jj_g.s:A.."Z~;..E.a\5......../m1........b.YD..K...H..`.Ez.L .k.?+._mD.......e3...._h..?..<....+.....L....hk....2.!..&...gBc#._.7|.K.w.D..-:.VC..HQWe^..^A2..a..F\..Y...N.....j...R3..}.8..=0...jA/..T...wR.....RL...1.....;o..L.hd.p.G{.`S..<w.. .a1K...?...6..{.....r.'@O...d..U...l......-..($s..z...$X.7.*.>.Kp..n-..... .iV&..fYq.U.."9.a....

                                      C:\Users\user\Downloads\0zLFyOC.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1272
                                      Entropy (8bit):7.8475027452635455
                                      Encrypted:false
                                      SSDEEP:24:o4mJnk+holx7qdkbZ9o1yn6l+prxYMRLzFOwza8FA78h1JeVGSzQaRk//iG006Ho:o4mK4SZ80xYMbtFA8h1sz5G
                                      MD5:47FBB9EB185D038312B85C7629A1CA91
                                      SHA1:402540C999B0ABEF11818BED0E70814719FD4BB5
                                      SHA-256:E1909AB8FC394F77C7BC5499340ABACE90EFA91D47023E59E0870272AFC5FACA
                                      SHA-512:440A6AF911DA15644F97723C3BCD2CB4F0A5E9F69A5D605D2B94BA8D3F2A4B726056A1CA58B4AAEC14BB8710F5A11CB5213358CB30332A67458E28E84FB7A764
                                      Malicious:false
                                      Preview:,...IG._...!]../.!......~.o....L.....(.{3.`.-z.?...d...A.5.,.2e.5...c...C}...m..zA|.YRM..VXw4C........,Q.H......$.U.....\~.`:g..+dT....`..+.....=Cl..........p.....x.@c9....+..N.o.LW...D.3..B...........B.Am*P...;d.........._. .i..F....u..7...".}\>..7E..mN....]...:tb.A.>[A....5...^..U<.+... m.........l.j.......O%.yy.|..H.e.......1ex.5.Q...GgM....s.....+...M._..>.....n.v.gQFc;..#.q...7&...S..~...Z...+z2.......1.jHc:i.....r^.}.q9m.[X$|...8.L..,I...*B.).LP.{...` .K....... I.$..).<.....<......K..[....a.n..p.....e-..y.l/..^.RB...u.r.Q.&..f.@....._(.I..7x..f.C4..].K......lbs^z.LF..xE..~.g.D.l../....u..&1..z...F..7iE.Y5..d.+&.'j..j".4...X.._...+}h... ....k..y.....fW).$..C..*%uF....-........D....(.....N......{...3.!7.|....w.).!.....w..fV]=(.f.kQ.Z.yb...........@..<Q.Y4,h5...|1.g....jI.EHO.}.m.?.6-..-^Y..Hx....._s,.. ..A.L..P7..~.......1....7i...n...c..y.k......5....A.p...X..]%.`..Y....*@.....F.....d.f..v...`F. _"....c.........Q.....'.zC

                                      C:\Users\user\Downloads\5twDI9U.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:OpenPGP Secret Key
                                      Category:dropped
                                      Size (bytes):1273
                                      Entropy (8bit):7.844213236936077
                                      Encrypted:false
                                      SSDEEP:24:QDE7uLDx/FD1pILWaaeK73+JadmexY+U8xtGCIDfthkBpgLgG006H9G:eE7IDNCS7eGr48YhHDl2fgI5G
                                      MD5:4347F07FBD3946151D86C7D1A0293F61
                                      SHA1:4733EC5C0C4F4D4977F575CA94930C7942B5F4BA
                                      SHA-256:BEA1B33D1AE0B82A50F5502D048C440A12AD8F6F3E794067787D3DA57AA6908C
                                      SHA-512:D29975F02DCB4A1E65AE05F38790184F0F00F8660366561EA65A65BD0CDE2290030C07982E74EEE198119116B86820E23E9819131DC8FF776233A70D26FCB6E9
                                      Malicious:false
                                      Preview:..^......2. ..|.k.[.pV.#...4...|$|k...x2.....t......)A*.....>..M..]`.*.d]....].\$Y6X..b\...l.v.f._U.|[..w...L.QB....S._j..../.S...0*.q`.O`.6~..'5/m..[..)....?..C.F...e...%..I.d....M.<..>.|..?......N....@..:...j.,...U+?.OY5....ZOMZ.5.C.:<.q.K..&!..s.......%GV8..Fxq.F%..q5.j........4..8....X..p.t.@.o..].....J...l......DO4Sk..x...K...$.._'[o._Ei6.H.....3./......R0%H..uY.x.....z-.ux.}4.1..=..x...0~.j.i<.)...%I.)....}.d/.3r)jy-W..{.y...,M..N,:.Ll.q.....s\...h.-.t.......+iWJ}.xi..v.....u..}.!.8J`....dr/....Yw.L..mq.,.a....u...J..3.i....E......d5t..<KP.F....`.Y|S.#..O@A.N...OO.n..S.z....yG....PQ.i....X..!.D..N.>.d.e....R...e_.....T..Y....$i=VL.....4hW.4..#3?:w.....#x...5.. ..\yU)......6.Z.....i.+8.!.X|.b..0{.8...W..|V.s....dm=....>...l.."...`..]..........C....x..1.i....[..N..a....../K..xs...\.#.6....gX..\.....D.....&..{D.7..{....f.q.6....W...D...v.]\.;.7.E)M D43I......;.8..zA_.7....F2.......F...d.....=X|Z.#.x......JK...L`...fW....M.a..8.lS..i.mI..

                                      C:\Users\user\Downloads\9ONFIK3.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1270
                                      Entropy (8bit):7.860625058396577
                                      Encrypted:false
                                      SSDEEP:24:S2ZvNLt+WESMDz9BKq6CI45I7hOHsUhDVAkC/E3aNp6B3AGJVz5RYyW+lcnG006I:NDBpEnDz9kqNI45GApIsGp6B3jVlRn8s
                                      MD5:315378461884EE4BA96F6220FC9654F1
                                      SHA1:CE55276B2A73BAB15B136E967F5F6E033B60C31D
                                      SHA-256:7877A1CDE57FC99951C63AC2C73F9AC16731D8692BAF6DCF97D7152878063493
                                      SHA-512:B868C98B1B7B7A92C9C2C737E84390426D26FECF7E08297B3CCA4EC2A7DCE264EB6C081EFCF4E041DB968D6BACD675FE73299512B371B26AC5DEB14220BF5EE9
                                      Malicious:false
                                      Preview:.e..2......p...E....0..&B.}.q"..4e%E..3)._^._.p..n)....LX-Y..7o......../S@{J.Lfc.3*...5.`S=..!...lu.T...0......[=....D..~b.(D`..K.A......I........||.../........6jZF...0,D......I.....~........:...*}.D...1.....=c...Ss...E.w..w...'.'.....Y....Q..|..LR..'^.s.Q..=.V...cl..- ...1-._wr.r{....SC.N..E....ud;o/.:U.FH<.W..d...:..Y..7..../.*].Ld..=..;.oZ...X$.......NY..5{.'..L.(.6o!...)*..K....P8p..9..25N ...\.86O.&.2.#\..L.;&....a.PXD7.....Ho..,J....K....+R.Y.F....o...3..f.^.)R.).)G>.p.3v@....!.b..c..G..z......o.o)G..}s.n0.F2 ..J..Jw......6..&)..#.r..w...P...C.....1.1..........`...oG'.GED......>.T......n%Y.t<.9 ..5.|C.......kj....6)...V.......aj.|F..4...K.../........^lM.|. .B.........o7.,.....l......uB.T..xN...(...U...Y......q.....fV..?.&.y..k.5n..~..ap...W&.me..../.)..D...w..-....4&...>...M..x......v..0.iOUvR[b....M{..'...........D.!.s...|?...[mG^.)....k...c|b..p&r..)..{CI.=M...q.q.|.J.r...X..+..p..Tt.&....Jx4.....m.@.....)U.L.....$,.

                                      C:\Users\user\Downloads\AfqjohO.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1270
                                      Entropy (8bit):7.823715096522146
                                      Encrypted:false
                                      SSDEEP:24:oLsuH7h8S7yLpsAEzErB0E5WPlkD7wmFJ1ocO+CKc6cyBtybdYHijx7iG006H9G:oLsMN8uyLjEm5ce7na5ocmybdH7S5G
                                      MD5:022640503D50329943D1CC4FA3BD60C0
                                      SHA1:82AD1DF2C19A2F0CBBE0BBC8214EA7D5EC050CDC
                                      SHA-256:ACBBFA5510FF97BA7DCDC768AF1C70278C6DAC5A1BF90D4EBE34BEC1CEA1CAEA
                                      SHA-512:09E52147BA717A9422D31E0C98261626C0E05FD5CD79C22ECF53BA7B230118FCCC10CC3792BB285C5C30ADDEF5B7E99601D996D70EF4D04321F7E4E03601053B
                                      Malicious:false
                                      Preview:.s}$)"A).<R/.@.....[~.-....Q.'.2.b|5P.)........N..Y+..|xQ.K..b.Y".Xq.|V.|.,......c&..1...v....H]]].mW..'P..Z2..{<..Lh....#.....2D.x......A|.N.g..W.s...E+..&...#.y..\.2.7x....j7..g.Q.nz.F..s....F+..a....~7k"v8.j}..m.$.UI..L..3<.B..v...K}S.......N..}....5.-.)..}I...Z5.....f......k>.h.|Y......P.E:A.$..r.6...I..."A.Z.z. .+.:0d.9G..)..e.m.Q.|.....V..\.g;4Z.C.<.Ck.wC&r......^..e......F.B..s$.|...0......B...:.5..@`..v;....'../.j......N.w.{..*kld.dD.d.............VC..b.(....f..,.1LM....@.5|..~..lH.R..:..|.3....H$%$.;.N.*5?2k.v...w.Y:{gAu.e<......U.T.u{0...2....a...J...,A^_..47..a.#-E..PY..R...4.V.1.Z2...[..CC.k..........`H.ouZ.6.Dk........D..X.l.q$m....)...,.......g}$...R....^Dz.B(.....fp....2lx......t......J.....$......B.<..y.S.u......y.....I...$.X.K..'.h/gl3.j..;).....(d. ..'....h._.I.*\.o.v,...\.n...y......k..q.._r.....@....B......>.>v@..Tp.B..~...lY.....-..uh,&,..I#9.....,mz.*-.u....YH.....<e.Ld~."..T....*wN.-..c)..Y..%gW....(s.*....S.r.[d.

                                      C:\Users\user\Downloads\BmYcnYj.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1273
                                      Entropy (8bit):7.8614831497404785
                                      Encrypted:false
                                      SSDEEP:24:c0CI9nBOSpPp91105+82ob1EGjj5AGJfdf4ueNHQ5cchcBBbW1nG006H9G:7C4B9X65+UbX1veFQ5ccGq1J5G
                                      MD5:BAB921A374F03C5918496F39237E48AE
                                      SHA1:154D596CA6B8118458BF5CBB30620E7ED43282B7
                                      SHA-256:2E9FBB1137C4845BC0D36946AB97A2114394F247541C3669FB9694C285692C0C
                                      SHA-512:CCFC0DD42940D0BCBE5794BE80D7227A6D1C29E4E240E8C03C1B0869754B65F3F4472BEE77035D1A93DEF4DFB1A67335287087F7376B6E67403984E7EEB18869
                                      Malicious:false
                                      Preview:....80...\o].^e.Xx.x..:...dk.E..-.>.cz...<Ec..F.X...|...o|....r]..c..AE/...cs.~....3..W.tk.6..n.......U..P....^....U=....dv...SDg.mN.6.q.a...q.x.z.Qv..$dq.ev...()....K..r...P..8>V.E....X|..B=Q.B..,=*)<..4....tMuU.l.....@.....2.y'........ H!.....'....W...|bB.R&..0aB0^)q.=6.{N.f..#..#..N ;.U..zU_).M$./...H.On.......&c..I....|K6p~..nd1.Ha.N.D6....%.S..T.(...h....u....g.27..%.k0dV.....z%....[l!.c..!.5.H.}.*....1.+.....s..m.Rj...8.f.c..Bjd&..9Z..S.../!.,...).#.......@.2.qn....@.>...Apyh5Z.X....$..2.B.......#...(=r..&...........Je..7.U..z.ma...l.H...ox6s.....9U.<.>cU1...0I.;..K4.W..J....;.R..|.......@..h.1}.....y...@....>`....Y.t*.Q~E.}._.{.....tH.F.R....@E..2,.C|N.s.d.\....d..=&.r...H.......e.QM`.m..T....,31.7v....W.n.I..=....9...p.}..XB.0mk*8....E...........#6..G.)...C"..w.......j.}.6..../..,.......1.*.....r..........oW_..i.#..."|..f.M.j)...B..k8BQZ`un.0#.......e..D..z...?.4t..f... .{;.0.=.D..{o[..KJ.u..a....57U...=@...1 .I..=.P.W.5.s..

                                      C:\Users\user\Downloads\DAPGDPA.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1272
                                      Entropy (8bit):7.838948268807874
                                      Encrypted:false
                                      SSDEEP:24:hKNNv07E9kWilHYxfKzie4BkII5sy4KKPCaqY5ZZMojG006H9G:gr07ESp2xSzieBaykCalv5G
                                      MD5:127B0F7CAB5E29EE0A709374EC5AA026
                                      SHA1:6E8CC7A83D1D7251B93FF98BD250CFEB1ED086B3
                                      SHA-256:876745165B4577817A7582627F0AD0675D28C1FCECDAF2BDE90D8BE865D41A5D
                                      SHA-512:3359281F4BFCD3FA3BA3EEFF00FD487683E59753C555DE379FFC76005296AC62775F1D460317BE9A8AE4FDCB4600AE22B33280CB8EE916BD025C1F8AB6EC63B3
                                      Malicious:false
                                      Preview:1....s..r.w.Lg.....)6.X.).N.iDL.V.tj.s..&E...[z6.4.d.$Y....X .&e.....A..;.[x.. .S.6..k6:.,Y.....2m.bA..Mw3s....FI.a.0.*..E.e.V.3..._..J.l.W...."...+`|d.+)qx.fs.G..5q.C..[.iN.K.v.2Vg&.u....BMt.......$.SA......mn.._....:..!.t....!....;.w....%D..(.b.P.._0..Y...)..t....-...LL:.....YH./z..v.-nL..$C*5i.v...G....'..k.[..q..e....V....^..1.....26P.=:........wz..`.*.qq.%V....Sd.p.[..o.F.nl...qy."....1F..d.O"..'.ZZT.n..MI'......u..].P.6..'3d....=.%.Z....f..b...X.u........d,.N...P!....%&R..&.OQ..A."...w(7J..+4...u.l.....FH.../.&._.|.t%.$jp....-...G.M.....S',..p..n.VB.0My(D....!...(........z.'.#.^...|.`.k.=.!..{....45m.n...R:.pO...)isa.T.C.}.2...K#t6M..C..`rl.z.O.....z.Q\.yP...<...Y..h..........:..0..t5.3vx.j........Z........G.}...4.A.m...l....7....>y..L...~....]Q.....N,...7..;...AE.>..C.......ryq..\:..~R....dW..'..^.~.\q..mV......!.'...E.0...7Z....w....[....+.K..85l.m@.t.N...h...T..=x.Bx.d...L....`........;k..a.....P....R8~.0.........kd...P...gz..0KE......

                                      C:\Users\user\Downloads\E3agF0X.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1271
                                      Entropy (8bit):7.855992185130305
                                      Encrypted:false
                                      SSDEEP:24:cuJY4/AhXd3bW1f8802aofIiyEgV0VKORB4cC68aukWQQ6gk2Z+G006H9G:cwX/Ahu8spIFcV5Ry68augZ2Ze5G
                                      MD5:9E956971B4DE9273BAA671824B9C058F
                                      SHA1:7CEBA79F20C4F48BE1475DBC8CED94C803FE1037
                                      SHA-256:3340D06E64110618C890ABE3BCA3D3C9B0EAED7804C4A377252EAC6D4D2379ED
                                      SHA-512:52A3FF57C716A04722679BCA9B1C1107367184240484C5F4FD24EE50D2E04F15A3BEE323E5A702D9699801CC7720029AB15A047F63EE923E5A3063F155202131
                                      Malicious:false
                                      Preview:....Etu#)..^I3...s.e.>9...7.v.|V.].....l%.....x..l.<.u.8.G..\f..F.X.;_P...k....W..q...:uRN...t.MR.O..*...e`...zz.....z..5....3J....,I.)t.4BO.PGEnr..|].|K....F..7......7K...Z.*.\..:?...........@,.[..(.D.l2..|...W{......v.......!=Ia.3...].._...S...&a...h...`U.).....`$&..c"...`s.j..{......L.B....+....T.......8S..O.........6...}N$y....<.e.L_h...f...\VX.....L.G.|<.I.s.z;#k..j.Q..U..W)$f..h.[....Q...f.M..8.z....v...@b.6=].4...../...C.I...m.....T.._...)..4......8.N@4.G..0..0"..}j....=.$kI.8o..3.._..1.#.l.9(.o).6d.....b...N.>.O^.L...#:..T.{..w..#.e...^i.:p^.e?....e.;..I..J..I.*`n>..%8.e..u."..(Vx.S...l.1.....h......,....c....D.......~.....!..D....!..bmZ..U.nr..h....!Z....Y...U.z.....3.}..~Mx..a....S.Z..k0.Q.$..'...bGy`k.....nF..6.W..._.P...%ruu.d1......z......U.zPG.{.usY..5[<I....w.c...x....M.....6..0..#.\.....;;..lVX'.....8t....DW.<.=#Gk....q$...s...s@.q..-.*..b.....eHW..B.|..ib...$.a1R...{........va.N.9.u.. %H.I".....[R(7(@....I.5....<..>..

                                      C:\Users\user\Downloads\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Downloads\QDddz50.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1274
                                      Entropy (8bit):7.845188430546565
                                      Encrypted:false
                                      SSDEEP:24:hzDIf9P9rjeqz1h1lvV6YNG/9u4qp7IWYob0W/ZFSJ4Fr8rG006H9G:hzDUV1zx9NW9lqpzYo0WjSGFYN5G
                                      MD5:7ED75620EF5028F9E8E64A0AD7E45C83
                                      SHA1:E8F78B6197B37B4EF094F5159586DBF626F255B9
                                      SHA-256:64FFB08D8EF1811B6974E031941A2EF4FC798B06C5E076BAB39D37B45E1C101A
                                      SHA-512:433BA755206B888E17AFF90483E3FBFDF19D4B24D91DA76658CE77D945E47033678E8A8CB4C62158FBC581DBEA96C9451DF31980E17434CE3DFA2BD9FCA29AED
                                      Malicious:false
                                      Preview:N.o.2..^S..)T/..o.ew.*!..Yg/f...h.n..]T.....f......i{.4xM.m.h=:.P........4p...&....N.q.gs..{.Z~Gm.....$...(:...aB?.....Ym*...........{|5.Cg.I...g...Z.e.(.k[.....2g......V(].......w4L....Z.q.....F...T......tsG}v...%.J.'..Y.V|.*q...h.|.<(H.g..*=..F...^.%...H...."....(<A..R......./.....i........v...3.*:..^6....?i....8....7.o.S.;.....H .;q.....`T.`..$..T...)..K.\..]C.`......U|C4.Z......Bf6-.?^n..-4.L...q......w.w..GCe..x9..J...X..5..A...XZ|../Sf.dh.o\....q.... .5.`v.y..#U..>..%...X..,.p?...@{6.g.G.C*.. q.-.r-..f1.0aO.3,....g..J..[......x-....g...A...~.?.N..F<1.h.@.U?Vt... {@3T..9.....x.0..Qc5..4E.0:.]3A.kD}.....{..M....?j...n....R......Hu.$..ap.A'..r,EJ...aj.,...c..p..7...A.H.+.[..X.,....i...6=\-.....*.<....}.....Q=...8P.'.....5....!..+....-.C..:&aG..v..t9t..7.QN0..]..u......XR6{..#.|.s.{.'AM..f..E'...9.$...Oi2...b..p...}..6....l.ST.W.&....UPl..H.j%gpQ.K....q.x..;..c.u.'{...C#.'.. .-.._....Hrd...;D.;!.U.Y...blC..y.@.]^..........\....?'....U .

                                      C:\Users\user\Downloads\WLBMKrE.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1270
                                      Entropy (8bit):7.8623273737082275
                                      Encrypted:false
                                      SSDEEP:24:Jx6HYo5/vJqHURH7qGFhciS7uoTfHxL7XsGbbdd5KRY7nTG006H9G:CH3E05qGF29TZUGVdURiV5G
                                      MD5:57FAEC632FAD92699603473FAF18B775
                                      SHA1:3042101723FBF1B5C01C8BACBAA511F6087DCFB4
                                      SHA-256:4B188BC79F57A42CFA7C5342A8BFD59F9DA00EF5FE2DB0AA3D870E27D3E374C4
                                      SHA-512:61D7DD8E613DD5EA025E0B1F62030CD5505C9A8452910BBD826419A39BB35033771F836DC71D34D79EC45FBA5A028C86416EB6C498D215B742FE66D56CEF3DC3
                                      Malicious:false
                                      Preview:..r.b...M...o........K..J'q....k.,PV}*).q..?i.......B......*V..YA..U..s$...Wl1G.g$......W)}...*+.?...&3.e....rA....^.W.CE....GC .&..d....|..$2.j..|./X).;0.Kh...B../.#.+j.n#.....EJ....$..bDD.2k._@....R......u.....7..L..w..[...W..@..!<8t]d)z...9=~.rB...i..]...M%..4..%..1M...h&...qj .........C.:..\RbB>....P.z...l3.A.'hcPr..}&'.Y.7.eU..).b..^. `.-....._=...G..b..-.{...u.~.6.W"..CB.....J..Uz..T.z..o.S.'.4z)_..F.Az...g..9Q.j.9..C..t1"..kr................0P,~.J....%.<.....j...A.....UY...I.9(]/.6.L....O>9....a,.AZ.....+`....Ub.....]...{.W. .g..i."......*..N...F.ck...>Z7..].....\U...g.B@.%...kfGJ\.E....;c.h~..".i>'..].X.H.v|J?..QtRfO}..uW....$....d...3..3}4P.%.:3.....z.0........-eK."...B....B...D....;.....$p("C..?t].0F......f.......B.M..>b.eQ...(..Ktx."..%.if..d.l.p.:..Ww. .....Z3..h.CAJ(4.<....9:...)..j.?Z.p..&@.uo. .=.-P...Y4.i..T"7....Qc..B.e..r0.^2... .V?=...1."..(@y.i.).._b..).....xr...;..K.<.XG9^.....w4..$..Y.....A.1.(.}:..e..-.6.xIT.Bo

                                      C:\Users\user\Downloads\cfnjFhv.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1269
                                      Entropy (8bit):7.834915350732878
                                      Encrypted:false
                                      SSDEEP:24:uGDyKB1Blm83m+j5MmAOtnXctzvgYb52Uf+AcAydG006H9G:uM9OsmNatXctzvAgmb5G
                                      MD5:D36C29CFE58BC1843BFEA5B44E50721A
                                      SHA1:A4E2053A8A5126473FD6006F6B2F125EFE45A92A
                                      SHA-256:8176DD8FF60BBF29F1094569C9841A7DC2894A433E0D1D40C1CFEEC8AE97ACE7
                                      SHA-512:A3094B08FA16B9A2DF22666945B599371980FC412675E61FC14EF662BF67D61F72AB108E563180D6806737CF0CC42D3C3B6179FF11A4F9DBAD09ACA74A1A70AE
                                      Malicious:false
                                      Preview:@.8@.[..u..d..{.Z..$...b7......`J{..?.....[.n0i...a.@......w....X.E)T. %z..js.... E.%.]/I&.....7.?..Q.(.FIN..tcH..-.K..V..p.1...^..f..G}..@@.Q..t..]U......P3$t..5..|..9S..h..^Wnu....IY*..B..).L....:..B..Bj."..../.[......u[..../........D..1>}.[..N.9.2....9.n.m.=..qF...;..'.:....'...Ar|....+..G].". )...I.h...7......&.....B)....y.%0anxD|.1&".^.Q...Ra..Jk@..bIm[r1....0..k..a..|0.i#Sk.G....w.}..csX..a...}....Y."3..P......G..?z1..5.j..F....z!.J!.S.../V....}..B...P..c.."MZ .....^..E.U..f...6O..Of...O.....B.....#VA..t.m.!AO+..A.@....O.V.|.c..l..c..Rx4O....3..p8..e...c..uJHla0g..O...|I@...$C..6-2....R.V...7......1..^.q...7=}.|..).kQ3..~YQ.>...9..R.9.....F..Y..bU.(...h..st.n.Q.z..C...U&...Y;...U...\..@.p.V83.3L.a....6WTd......3...Z..E$...H.keb....G.D..pAz..;6y......Q..s....A..s..&......i....n.....>.BP4(.?..gi.f..U|.....M......L..e.H..rM...6..f.<.OSH.}....q..\z$ZE.^...*.^...../.p.R.+....>E.,B.@..0Pn.1...k.......R.o.J....^.F._.`...m...@&....!.."u....}.

                                      C:\Users\user\Downloads\dcJ7enL.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1267
                                      Entropy (8bit):7.856955240705087
                                      Encrypted:false
                                      SSDEEP:24:BwzpqaQaKZg3HDxh1chldLWYSWwhrzuFGkqtQxIwDke8X5QG2nxJFhZK/0HBRDiG:kpXQPZg36ndL9MKFOtQxhz8pQG2nfFC8
                                      MD5:EE85321532D091583F7F147CD2DF2DF1
                                      SHA1:40A9EAA5D774A4E2B496B0000DF86A1DDC4AC709
                                      SHA-256:DCFAB913C7F21C7CD2C0D9DD4D7B66FB1C55575134A66BF058E90822379B2310
                                      SHA-512:4B41D1BB4AF71AB656CA21142CC3BAB66F5CC9EE3F3ACEC0B7EAFB1AC940952B9EA1BDF6CC8A058DB53A654EF3AE466A667F3A38A2BD0E3CA3105690A4BAFBDF
                                      Malicious:false
                                      Preview:.?1..g....vE..V..f...(..{E..).+X.(.a.\..X....."..g....*.c...$...7.GJ..+..fDL%.a..0.N..aj..N.h.BE..;]....38.Y.&E./.V..{N.m?....kD?...b}.#...AZS.)..4.y..&."...m.B.....0(..KGC..}./w..U.n.&.;x...=.....9\..f...^..?x....1.:....B.*,g..O;...0.8.n..0.99...M.........q.x..(q.........B.X.^.......z.B.7.D.........ek...e^..}WC..j...k....}..s}...6.H..."........f..\......N{....*...!Aq....8.M&..a..w.Y.;....%...UG../0..P.@....z..o,.B.....].Q.8.Xu........"Xed...k>.I..u...89!Tk#xDMU.'I*(t.i..M..B...K_...k...[9cp...y4`.yz&D..]9.F6...T,..[..E..n.j...T%1......k.`..O..5....K...F1...8N...l..R......_...:...eEg.bE.r.4....T....q..Nq<......"........S.[....j&#...-.......pR.A..K....5.)..N.:.i..... .J.1..`.,....D[[ff.T....u....I*.[..!r.w.|W....t...A..5...E..k..Z........5=.....u..oY....M....x'Y..}..#].87..^'.....<(.D.-b..../..P...V..zd].>.^..........^I$.a.g.L3M...E....LR*..Y...]Q.`p.X.........<.c:..F......l*B.H.itTq.c.'..H.....^..... ........k..Y..".5mZ........}...T

                                      C:\Users\user\Downloads\fwwIhq4.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1271
                                      Entropy (8bit):7.8705618812311755
                                      Encrypted:false
                                      SSDEEP:24:LYs2+EEDtC0kbVjBpFgueu2WPU5fre/4ZsgQ6njxG006H9G:nEmtCzjBpFN5PUyw3nj/5G
                                      MD5:6ABDA3A1AF8547B418784A6FDE63AA65
                                      SHA1:A19C0E69AFC78DD7D9A558EE60B1AF17018271BA
                                      SHA-256:A0A302DE106E1A469208E574EFA5330181E0837E9FE73D94C4E28BF03E8E1529
                                      SHA-512:74105133036D7F36B221B1A8F4BB10A7DC82B193963A391FDDF6255E31A07BDB49879F7B27A34E52464F2BAD30A430BC173AA2D9D0AFEF2E630B258CEA01DA03
                                      Malicious:false
                                      Preview:\0..>a.%2...,:.R...ysI.k.f.d...O..-..7.....5KQ.;..8...u...8...L.H..@.H.v..E]...........+7..p.......c.%...=iv....4...EB3HW4g.t.....A.v7Lo?q.....%..K..^.g.H...{..b....$.......Vx.....Ko...Q_......D..'/.*.X..}.t..oe....~%...+.VaI8..<....c...O.e.+....f.h.U....h....*..G....PK.Y...y....0]p..2...c....Rx...h.m..K........q../..}.Wl2lO,...'N.....F.2..K..p@....[....M2..].f....z...9..S*....b.m..9.."74r;.n...>.z.#i...]..X....$.1..........&..a..n19z..n.....My..m..>...jQpV...h...........4.C.....S).....>.cm.B..NB..?.n....C^.u..3*.F.8...]...d..@..&wz....7).y..........n....1@...o..,.Q.`k..I./....W./3.C.C...&D.+.WK..bE.....B.....).|..-..!.Z.q/..f... .%.....(......v=.^w.Q......u./M%.s.....udb.B>..jk. ....>.m..(...Iu..G.^o...&...l..o.:.s.AW.3.....Rl..p....l5.5.....j.4..{e.[.cR.=..Dx._..'...lBo..K8yt.{.+[ .(..&p...q..w.r...2GM...?....{...BT6....S.vaI.7j.$.i.........=.80.Nj.%.zJ..3..-..${...&.\.@`~H.Cq.f.x2=.H<<..A..1~..8.r..b..}qb9/S..%.n.a.K......I".j...3H.{

                                      C:\Users\user\Downloads\g2eet4M.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1270
                                      Entropy (8bit):7.836672792393856
                                      Encrypted:false
                                      SSDEEP:24:UPIAZhkvJAUfPx3vIAR3Mg2jhen20LnlCt6tW2R/ZkNQtAnYIAAEYaVBG006H9G:UV6AUftI+2cn2anKU9C+mWAEnVP5G
                                      MD5:B70CA645EB756CE99400C787FAE310C7
                                      SHA1:42581A9E556D9C30758ED475005EF5951174CAF8
                                      SHA-256:A1DE749AA16538B1A0C8513ED6E21484FB281985F592B9484753115F4AB12E23
                                      SHA-512:EFE3C450CD2A02DBAA8FDF2CDB6A6D07E3FF2718133AEE622B3CC8B8C935BA883DB9BEEE1D3C7E84706509D16365DFB6637E80EDC8A077E6C3C73798F7180212
                                      Malicious:false
                                      Preview:......m.#..S.....b..R..J.&.....4.+..k......P...c....qt.9+..\|>.,...|.g7.G.......R...t.|..Hd..xlz.k......SQ....a.U).e.`C...b.k!.=........>6.....c..K...F=.6nG{....I.d."j...0.'T. ....gXK..[.3.t...j.!...Z.._..Dxr.r95.R.F.A......4...``.12.!.b8J..-.....9$.@..?....Q..C|...J.]..e.@.?..@n.mi..q@....V.X......y.-.G.T.h,....d.....V{..#t|.M...y[.X...#.c.....'.....I..;0:..aO.A..gf.....+.*6T..........R...e.~.ph...4.....P...Us.p..j........Hl...N...a..../....j....4.....8.......H..K..........w......V.W"..%....I=o/k....\...4H.a...,|..Dg`..F..Hh.....>..r..Ud....`4~.u.z(........D..o<.G.-.nm.m.....\..]..{.I...H/........[.......q.o..N=...Q.....N.X.d.....yd..CG..%.....zJi...h.g?2.>.c..kI.N-.*.:..`r.k.3.E..9.tG.A@.......P*..a...4._....J.7n...J.X~.....C?...C..x.........d..o.%h..H..g....k...rG8X.D..(?.Z..2}_P?.dyopM....n,...?..f.G..I..h.5........3_....<]..^j....F.O..`...0.....-...)......~W.....,....._G.q.jL...X4.`.Y.b,..4.a.N.W...P......E?>..~..g0.......r4]P.w...H..

                                      C:\Users\user\Downloads\iQj0Dag.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1274
                                      Entropy (8bit):7.860041204736701
                                      Encrypted:false
                                      SSDEEP:24:0sApbNTJ0dxSnFxFecJ1TeHraWPAxRdxKFc995QwUHshxdG006H9G:0sAV0donFx4c7TMgRqFcJQBHs/5G
                                      MD5:BE3054C60C3406B9D50AF2A7CC830AFE
                                      SHA1:2BC1C744F4041E3357C8936E805EFF0755D643ED
                                      SHA-256:29976D3F9FB294D60D5F91077F20B3EF4B048E7FE9EC53B6A5C42E3C16A88BAB
                                      SHA-512:1D2E05013418B1FC12FADEC189F57229192F62B3AFF3D34B305DBCF0BDF2D5B4BCAB9427EBBF53EBB73AE3CED514F7B8D1CF73484C31920B8E44854DFEDE3994
                                      Malicious:false
                                      Preview:.(]hs"t.f.3......mi....`.A..to`...6j..<..}=....`X...%{z.uf.mnkB........p..D....bD.Sz|.P.2.F.......m..<x\..).}.&...sn.2.....6b....'..B,."r....e=...P.:=.N.]..g.....w.b.Gv.........W.*...../A+.W..=.SR....bg.oK.+r.......C..../.C.L.T......-6%.../.D..W..v.L..v.-..W.......I..?e.X{m...n."E_....R..>j..."9.@...Y...h../St....k.|."........p4...G.?u.c.......7}..s.U..l]'..F..wN../.M.l...........!...|.Cdg.9.+s......}.2>......i?.O....|..!G.... K.Q.bVV.....".$'q#o/p.S.B<...a.7P.........s)M8../$.;.1 ..!.^..l....g83m."..?.qS.=..k..iae=..{....).D.....~..../...6...~<.\sR....2c....V!5.9.=....{@<.t..1k.lF...N.I....>.q...H....H.(..&....4.7..S...;.o..%....-.-..U 5.}.......E...%F..`...2L..xLQ7.kRc.V........CO..m.>..$Jr.dH..:..........v......G.o.&.ct.j.<.x..1..`.....p......oI.94zx.......R_..e./4..Fb._..3.G..E...-....@....T..5...65....@.#.<.a..)..J.V4..c.H.7u"..>..i.s.D...3^p....Lc....e\.t...m....sn5hi}.r..u;.y.\..*.R...J.Jh..\.....l....a..H...[)/T'n..7m2.Bo.......86...#.n.

                                      C:\Users\user\Downloads\nb3Wf9R.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1272
                                      Entropy (8bit):7.860078607246883
                                      Encrypted:false
                                      SSDEEP:24:+ryq3BtTshXiFn0abIKRmycQ3Sn6eZlccZsD4o96qLTMKovDAaBG006H9G:BqnTK0n0YReQin6ClcEsDb6qnMKovsak
                                      MD5:68E3D9C0B411001BF8B273E0B8CFE728
                                      SHA1:C0F0C73EE79FACE4D9788F43E2E03B0B323957FF
                                      SHA-256:BDE7E334995CEF1D2D47CC20BD08411CCB2A310B622F43E82D6C85552BD04898
                                      SHA-512:131560C16701937F19312B23160858B26D5694658C7950F784E9F130A62F092A2399F5D93CC3BA1DF7358AE9216835F3B50EE61F0918197DCA5806E33AC9E8FF
                                      Malicious:false
                                      Preview:P..*.....E,.t..i4j.S.o..Wq..@@ZO".8... <.Oy.zJ..(!...xj...&.Yh......bEC).*...S..Y.{......y.|..|...vTuCu]/.>...?./.MA.m....rp..Y#.<....e.7}..reZZ.E.m..i...X..:...l.....4_R......L...K....Z...68.b.\A.3>X....sL..c..V>L.V.....(....Q...|4&(si.q...l...C......3F..'..C...n,..............F..L......n.4x\.F........m|....Z..6:..._..W....xh.<q.."..n...{V(....Io.[W..9!pl.m.....i.....\.!..`J....4.M........`q.T.yB...............c...,.o.....k:U......d.X_...}..........?.4X.R.Q.s..0.......0.....C..;...e+....>5...B.._1T.U1...l5s.V.Y..x....._.h.9..2.)..w..8 7............*.C..'w.W...`.........k..E^,....IN.()..b..c.u....G.\....C..xF{...G......l...6#...}w...h...z..4.VOw^.z.l,+..YhY..eM.C....:.....f.%[/.0"...?.).dc..n.P.[.f.).&.........).J.f...j.-'@jN.!.c.-.+4E..6|.g2~Z..."..lK:..4n.......lm.FDg..D..s.N._...[....`....?..I.9.......Y_:.UMW.8..l..../u..%....i.........p.B......:.....m.)..8.x....,rd..r.E....6."..u...........V}.vE..Cr...4.3w..9.._.Q.j..d....z`.e.h..ap.n...

                                      C:\Users\user\Downloads\oDKJvKm.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1267
                                      Entropy (8bit):7.829576678155197
                                      Encrypted:false
                                      SSDEEP:24:eOBJ20WcU1e3RWFKYdz7eBCFKp5yG3MsWGzuQqADblG006H9G:hBYeIEYeBgdADbj5G
                                      MD5:72149D043640EEA28C89BB109D427E03
                                      SHA1:5B6926A5818139518F2187BE0B2673E5BD64B413
                                      SHA-256:B6ECC8F0B2304F3DB70B09B87D6CE24DC17641ADD6C39F2FAFEA5780A04477C0
                                      SHA-512:FA213E250C3D62BADAFDF5FA19D7D0EF5681C62CFDC0B9B6A0F2AA5ED3381482E9134AE606E5D6414629E50D283342E5105C490984E99AB60136D459EC3364FE
                                      Malicious:false
                                      Preview:.....t..?t.Z.B.,(...e `q.*.\.-..'.qu.........'Q...<$..}.D.g.|.({p."..,#)49p.o.G.f?*....}..+...y...GTz.....S...TWRKs..x......nMk ...m........6n0.'.YB.~u.A*=x....Vbu.}I.....T...m....9..." .425i...{..:...@~.d...:...%/.`. ..H...;E....~......8>"....M.r.......0.u...6Sa.M'...~.|.....i..&...;D..~....G\.{..li.....hc..Q....x.GY.(.Z5.?\.. CZ..]..o......#.*....a.xFg.).S.AD.9....>_.n.W.G.S..b.....G...4..G8....?."./..+.H...=}.>[.A8o.8..y08...q.../!.%u....8...Z.A.\. ....-.....K..@........7.,B...,(......].W...].....B.d..d.+4k.`F.0].w..0..d.....6(..1......w.d.o.um~...n...`....v...j.A.........#Z .J..=..0....Vw]=.J.c.]...1....;b.Z.~e.k..c.z..j...v.......mK'...".a (...8rnI...[.......f...e.{....8w.s..X{.c...)3.[8G..0.v$._......di^!/. ......Q..\...O...?e..]..#.g...Ub...=s1.Rc..}.3...}..... .b3_.,.s..@.yy;.v........(./.......W...B../.....1..).....+]..G.y[.....+....~8.n ....'...l/....v.D.[....x..^cR=4..j3#U....).x.r..r.m~O.L.3.2`.....Y.Z..)<....BZD.....

                                      C:\Users\user\Downloads\oWJxGGC.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1272
                                      Entropy (8bit):7.837055940391563
                                      Encrypted:false
                                      SSDEEP:24:2UERAKFOiguBbPO25rpZ/5NCJTfEDGwGFd1wp0TECLn7Xx7wbZzzIxxwG006H9G:LE6iOiVbPhxCjqGwGFPwp0Tr7tsbZfxs
                                      MD5:8336EA1AC1772ADF0F034BFDCC8A1300
                                      SHA1:90EF1E8F311D0D73F31F53AA75B7DD990C801C28
                                      SHA-256:B2A22CA3CC748180652D9038D7EB95E43B852BE7792D7C3A6A7CB9FB531903C0
                                      SHA-512:78FFA9F9B60FFF9DA262B4EF05A1C76ADEF7F04A21CB8FADABC63C12D69B107E650D7DF8AC4CB08B706C4458D1CC5297F98FBB042DF2843425F17BAAAC8350DA
                                      Malicious:false
                                      Preview:.J.BX..a....uYY...G\.Vj.0...Im.tk..ga7.1.X.d3..NU.2E.:..p}.'.f.B.A).4.+.O........c=..m.|...Wb...7] ...7._....C.....LA..[.W}.....]..w.kc-xd....K.....P..`[.J....T>i.7........r..l,...J.....'..^.......}.JE|....l)$ ...'..7.yH.#.#....`..)...~.,....b.e.....a..~/.m....Y..s.~:.;.,i..!.!.E.|..r.}.-.1...y.5..:.Zw.a9...K....C.{k.rU....?.C.t.......my>....yTq..ETd,..7.....-...~..S..3D...=.x!.|.AM..R...9........o...cVI.-.[".v...0.Z...q......B....)9..9..2..)Y..:..y.?f......xK?.Q...F..u.>..be..}}!.p(q.8~..6....Pki...f.L......Q5.&.O..z@VJ.f .k..\.?..x..{..+...}zx....X.._)/6!..H.e.6.E..,k!y...:S...T....R.....f.....U.....y.c..^..f.U...._jQ.."w...!.R...I.Kg..R..O.K..7.L(.;.l....E.."..h.`..p...G..z5.+..^B...c......3>.......U.\..$.r%.._.Uj..`!..!...k".|.t../.U. ..sQ.[...........@X.q}aQqE....K'.ds....C..a...B.TD%...y3:.u6...[..vW.$ a.]$.%.N.c..........a@..6..w..K!.......A..O.;t..K.H ...S......CL.^s...J..1....6EV.....0.%."..Qr...f.).........f..T...R.....-.>..o..

                                      C:\Users\user\Downloads\uQUU0h4.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1269
                                      Entropy (8bit):7.839921429882699
                                      Encrypted:false
                                      SSDEEP:24:OTya5Rd/fX2O2o5DEv7WEvHSCJIosHyUzlN83FPA0hhXWN0M1lVg61n6G006H9G:OrdXXd2lv7lSUTqNUFPA0hhGN0mVTq5G
                                      MD5:02FE1E987D790F8FA02D67DA4B839AE0
                                      SHA1:9A1F95F2B9D869A53EB72FE848104D9D902E6332
                                      SHA-256:89805A411AF4A6F918B297286F44A99B769F2C8E1348FC6B6BAEC57BBB5C1AC8
                                      SHA-512:539E22D7F81AEEA01B28C6C0458C94C10D28A11D487B88D433B1CCA51A99CC549886415290C4D1DC9B7D24A464186F915B8C4E81F4C073EB03DB094F6A54236A
                                      Malicious:false
                                      Preview:...6.....c..0s.m.H...,..AK...V....L.u.H........D.vh.}..:....Y.5X.}8..&{.7=..] a.i.P.k[... .=.6.N......}...a>..D.O...K"......[..Q..P....7..".A.....=l...&S......zx..5......HF.Z._...FY.(...\t....EA..S..c.QS..x.d6.Re..fs.e..b.f-..T.PIg...a*c...~.r<.T...oH.*......:..w!....Z$~..n...V.;F..;J.*=......N._.%1...z.........y...S./H..1..I.i.7/&.&*.U.96@...5...D...(.zGT.4.....#X.J......B.......3q.q.L2.'.t|..j.h.`...Id}.....ao.1...dF7.e..I...+...=5K6.S......nN.s.....B}.9.....\...}.U.~.E.....28.;..L..8.-..2....6.{e....wsQ..c&..y...AgP..d..{.....=...3Tdz&............2..\z...m'...h..!.ZB.Q.d.....o....K..)t.ob2*d^....V.V.O.>.........j...e..L.'GR..-.#........oZk'Z._X ....0.c/.{........6..._....lU&$...N..tvI....d.L.E.tf .....nE'JVZ..TG.]L..)g..q...d........zG:...?....y..n..h@oT_.... .......X.f..7."Oe.6....!~.89.fB.$.Y.1'.....:`m.hcM.z.F..N.[&!C.qgi..*.'W.U..0.7./...:.mQ$.20[...2.a.ta...19.6.K*.{......?..OBU.d%.28x....:P..O,.H...W_.E... ...X.^i]$.....0...e

                                      C:\Users\user\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Favorites\21ca9z5.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):350
                                      Entropy (8bit):7.401963353173225
                                      Encrypted:false
                                      SSDEEP:6:fk3z2nhMlhbmsHToY4QINjVMPDFQXosmsxs3630gK2T0V3AY9mxU0ud6687d404d:f2hbmsHTfINjVMPDFmqP363pK20VTmGH
                                      MD5:7854106CA08E5633E78ACAD2A3A04387
                                      SHA1:8CB952EB2E720F9AB8E9528109ADB99151716EDF
                                      SHA-256:6EEB141DDD1F6F6AF04869C2EBF3144FD080600DE913348ED92ABC6DF276579B
                                      SHA-512:26EF903956621EA8CE1B58EE8BBFE5AB76DC3B93C5A9320C5C309E80EAECF042D9C1CE384F87515EE9827182F6675F21EAAEFDB03B8A5B2F36438F361BAC4814
                                      Malicious:false
                                      Preview:jS.K.......J..}.....\...^...$v...1.i..T......Z....O.}U...Bm.kv..l...7.cw.s.yr.....h.u*.....5...x........'..D...J.>.-.Q?J....>.r..F.&....T..9......S5...M....0... .gi..:x...q.....XY.P./.,....`QJ..o..IN9[.M+>~X.8.h.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Favorites\6aU2aQT.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):350
                                      Entropy (8bit):7.4235477189621575
                                      Encrypted:false
                                      SSDEEP:6:PGOrI8lyxS0Kzkx22UckCadvL0Xb+rZOAY9mxU0ud6687d4046HIhKcQNJ/7pk:PGOE8lyxSCx2zPvKCZ4mG0Z6A546H/cn
                                      MD5:3DA4777D8CC6FD5A4169B0070CF6C8C1
                                      SHA1:425FDA69623AFA5D77D3669CD88DB101643269E7
                                      SHA-256:E4E218997199DCFA658819E985097D53121EB1E3ACFB60C4E81D4745664288D8
                                      SHA-512:F6A628E194125EC0723DD64113AA8EB0F3C4977759E69020C3E3E1F75666F4297EDF2AC7C1C715A0037BC31BF36FEBE45DBEEF08E26C1B116D3F4D87529610FE
                                      Malicious:false
                                      Preview:EU..#*.......p....&1vmr..1u..~....3[..*'r. .........s,./.3.^.D.Bu...g.R+.q...Y../....=y:..&.W..l.>.r.`...J.>.-q.Y...DZ"....'$.......9......P5.........T^.\.`.z..b.....(..m.#...*......<.L.Z&.^.<........l.!4i.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Favorites\BGOVj1F.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):356
                                      Entropy (8bit):7.384910275283406
                                      Encrypted:false
                                      SSDEEP:6:yRFHhYMFxZNGI7GWhgPVSDmOs7RLDXt1iS3AY9mxU0ud6687d4046HIhKcQNJ/7i:CZhYYZNGI7G99SDmb15oSTmG0Z6A546I
                                      MD5:EB67FCFE1CBD4A28CB4BCAC221725E84
                                      SHA1:E62E6C2FA97E2ABFE7FA9AC76C5AB5C899F8E759
                                      SHA-256:9FA94823674809411EBA0B365BEB4D005FC950CFC1D6174FA9F39D7A8FFBFBB3
                                      SHA-512:D48EC0D230BAC0ADAF38045897C3C46727764299446E1E9772B8015AD93D26FD577D4D20FC42BE08A2DF85672F246470378F07A452B596BC51A592314C192D7F
                                      Malicious:false
                                      Preview:.4.......0j.e/....Q1ts..I.~,J...E.`+h....'xLJ.)....U....nVs.;..6....0{M.!&.....D...hj.C..e..T...A...X.j....D..|a..J.>....8M......r...wJ=N.....k......S5..H..7..s..I.X.]'..W...Q)..4.....`@.F....0.Q.Pd..._*......O..W.E...l.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Favorites\DuR5nGi.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):355
                                      Entropy (8bit):7.447127672291395
                                      Encrypted:false
                                      SSDEEP:6:KSkPc2dB5mZLL6Zj2IRLgBibbePpdo/tNbrGdtwtjFOg3AY9mxU0ud6687d4046I:KS92dBkLOdeUvSpdo/fr+wRbmG0Z6A5Y
                                      MD5:5C93B9441DF1EDBD4C9F6DBD9CD98D09
                                      SHA1:F9C15646D593DE73BC359EC484E013C4333C89C6
                                      SHA-256:20FF21A55D06689C413CFC1ADCC3CF8128CAA8211898652DFBA59F6D367D9ED4
                                      SHA-512:5C174B58666647B1F9269A8D4FA1D792128BB68DD0454EA17DC1209191D9C2F02FDC4C33866978009F5E062B9BCFD152A67103A7B76B56A8696BFFADB17A9066
                                      Malicious:false
                                      Preview: s......~Z.R..f.j9W.4...)i..xL.........8..HPF.g..s.E.r..]DY.^.f.i.$V.w6'Z....Q..,..I.|F....N...*.jB........_....J.>.-n.T....!.p..J.......k......S5..H..W;.Hw..h..I..Ft.].d..7.|...[H.*.....8-.....P......iN..`.m.3A+.sl.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Favorites\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Favorites\HHyY6Eb.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):443
                                      Entropy (8bit):7.577556160690516
                                      Encrypted:false
                                      SSDEEP:12:SgvIyw0PhR7chglJVYHmG0Z6A546H/c2J/u:SgvrXlJiGG006H9G
                                      MD5:0EE1120141A619ED24FF565FFAA36070
                                      SHA1:77ADD6F37972B08F5AECD472D664A8DB6D6E24F6
                                      SHA-256:508A650E40BB2A5E1FB70D8CC1281A2583B10D95353A492246297D22C3236660
                                      SHA-512:32FF99002DA3E1AC7A784E330FD2CAA6B61EFF30B7D6EF057E01FEA545FCFB056094065A0CF851D7F052A8F9A43D73949557B334265A332A96A6394E854975D0
                                      Malicious:false
                                      Preview:<.Y.H.(V..h....#.'...p.z./.........r!+.3./q.....B....{Mj..&..E<.w...o...f.]6.x...t...7mK;e....^.8)G_kf.O..nNj.Wg.....\... .=.sv.T.A.lg.2?.F.yix.y.p.5...`Y7d.$mp.{ ..z:.TI.....S..*.i,.gf.(..?.C#&..r.J.>.-l.....DC#".~.&......9........N......c.<L.F...Yd.;!...K...ZyN'......z[t.B.K...C..{,.@.gf.e.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Favorites\Links\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Favorites\eiyX7cx.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):349
                                      Entropy (8bit):7.469973905173823
                                      Encrypted:false
                                      SSDEEP:6:cIe5bD+bLbzxNN4xplyPIjbmM6MPDFQlFei2d7OPRNUkAY9mxU0ud6687d4046Ho:2dD+b3LN4nlcIjbsMPDFQid7o6umG0Zi
                                      MD5:9C7117066292F31AEC352D30DDFFF255
                                      SHA1:2E65B6232C1E4E0C2C9A60B0FE2C08020D3B8A87
                                      SHA-256:BF3FE7B66A11F3A969A7D59F379F535821642188EE039DC4C2B50444A0644606
                                      SHA-512:15F588B7F53580781C3BCEAF911F6FFDFDBE3EEA1BEDF62462C2A23EF622F0914A0475CCBD6884695F983D561EFF33B35A4DC28A830E6799474C04F4D197068D
                                      Malicious:false
                                      Preview:,.3.u.m.....=.n.._...lbS..9vM...E.Yz.J..`...GMc....#.p...<...[}]aP.(.m...\l=.~P.....A.o....+.!.m.M.........J.>....8\.]..!...e..&....T..9......S5....K..D..f.......]b@=.x.4.}.......|{T..esw.......Z..z'd=...h.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Favorites\fFEgEjf.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):347
                                      Entropy (8bit):7.333675003909046
                                      Encrypted:false
                                      SSDEEP:6:IgQ6uukaI7qGCHc6ZKOzdMBh47dBZszQqncXbQPucMEnlTkAY9mxU0ud6687d40Y:8eTI7q9/ZnzdMr4ZBZuQkPhbn4mG0Z6t
                                      MD5:69BCC64768D6A8EEB26E406EC0EDDD26
                                      SHA1:B73F8384852104F86C3372BFC57244B1BBC7E8FC
                                      SHA-256:923F7057B37F7E5D0E307B0BC6A3DBE1D7E7FAC8EFDBE5C4D293B598E80357F4
                                      SHA-512:6A5B9A45E2E41B466C137A521EDB0F564541C524755F9FB2B32E8344F9EDDF59E7A5D644DEEED9EF9A6D3C7ADDC4ECDF0E6FC6069669150B638D31405A9704CB
                                      Malicious:false
                                      Preview:\"Xqk.0....Q..*.>.5..T...........#..~.9nY$..\.$....2..B...M.....$#..4=.vu..8..mvj......aL....@....+7.z..8d.....J.....8M.].."..J|..&..@....:......S.....%."...GB.$...e.zl...o.P..;.rm.6J..k....7.(<........\,!G f.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Favorites\i8IEuVb.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):350
                                      Entropy (8bit):7.391723899100441
                                      Encrypted:false
                                      SSDEEP:6:66g4dkK4SIgNjbeRRMhM3lkVMkI2MPDFQkU7TaEAFf6+RsD3AY9mxU0ud6687d43:G4dkuISjSRRN3lSMkI2MPDFL++EmG0Zi
                                      MD5:51C75225E632C18596E83A0CC26BB3E5
                                      SHA1:E972EBCEA51AA452BAA4E08D3C556AAF002C8CB6
                                      SHA-256:C42FD588C28C77FD9A6D87E8B83DC05A59F40AD2ABCF7056389C15DA3A1207AE
                                      SHA-512:F7675599CF3F5D1C153F7CCA8A19CFCCA0CF017CFACB668B0231DC919BBA21F7B56A6F82F9C26912A4DE52EB68B803E7085C619DC898E3D9DBBE3DDE7C0D9830
                                      Malicious:false
                                      Preview:...t.%..Z.......Sr.'3.US.&O@.<..M7.2-...........!.\..L5d^..AiF.e.8......L..,.=u..C......_.=...?`.....\.PQ&..J.>.-.Q3M....#....F.&....T..9......S5...}3.LHa......r.v.X?...d].. .O..R....N.~....v$(._..../.v....Z8.h.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Favorites\p1SYdfa.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):353
                                      Entropy (8bit):7.353660200538393
                                      Encrypted:false
                                      SSDEEP:6:8/5ZiFZiCL/FV5MLla2K834aVsbTXXjM2dRPu7x8hnRiJiOAY9mxU0ud6687d40Y:cZEZrrFVS5a2h34aqM2XPu7xWX4mG0Zi
                                      MD5:B1646533A65DEB80B61EB1549A337E0C
                                      SHA1:FADA1ACE704FC7BA588E7E7161608E887D79D336
                                      SHA-256:92AFF9B8C556F02886A314AF52604F5EE39A8D31CCBC10055F0F9B45982D8C38
                                      SHA-512:72E9B9169BADB3A53E23C8BEEE09A3D71B6C31784B02B96BBAD43A469A4AE4C8C38BF729BA4985487A301F01DC8B63341B2642121CE2363A97314D3AB08FD5A5
                                      Malicious:false
                                      Preview:.S.F.LT....,..e7..".....QN........ ..\.N..J...C...1..]K.. ....K..M>]...D..C'.. .`gX)..O...+...^i..../....J?>.-b.[...D."......l.......9......S5..H.?.ZCm.j.R$.x)..(V....._....TY.(l.{..H.h..=*.Z1...>U....<.~.(.Vk.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Favorites\zz8pO9H.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):344
                                      Entropy (8bit):7.3574677341394175
                                      Encrypted:false
                                      SSDEEP:6:smYLYdp0K/uDMbb5vLIzssZXMtflJ3ch4zC7T+xs5XLOAY9mxU0ud6687d4046Ho:4LYdaCQMbdvh4ctzch4zyT+c0mG0Z6Au
                                      MD5:375E6BE978668B9C4253F54B98699616
                                      SHA1:57766F6B2F4B0338CF6E4DEA0B787FC97488AE3D
                                      SHA-256:E112457A7996B2E5156FC53873BB44D696ED4B3EC63611AC86F558600E29F551
                                      SHA-512:9488F8E263455D8D9DF35B509837EF61E89A9C4E4EB613CD475B6D75DAE4B75DBBE1AE9F950F1822485A9479692B30982DACE000546AD89243AA54E47D5B87A6
                                      Malicious:false
                                      Preview:..d..>8.0...B.y.P.v..*.9..%......w7.#.\v....%..i.i.......k%.\.q..g......{M....QO..>0....4.... <..#w...D.J.>.-n.....DC#".~.&......9........*.Uf..>...A3.R..|~z..-.p.<.M....4<..l...\.s?$........{....e.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\Links\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Music\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\OneDrive\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Pictures\Camera Roll\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Pictures\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Pictures\Saved Pictures\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Recent\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Saved Games\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Searches\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\Searches\SOGCPC3.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1173
                                      Entropy (8bit):7.84154941835062
                                      Encrypted:false
                                      SSDEEP:24:3dDLMdduA5YRX8mn8EzYwHvKOKF81cJeh3FyV0tMFovtDG006H9G:tczYRbPHye1cItMcr5G
                                      MD5:0BD29F46C73B2F756964F9098F20A81D
                                      SHA1:2F2C8B78E62149CF1F9B97E0837F72E94A0D4412
                                      SHA-256:FF4EF00621D641835ECA32989592F3E0605CB57662826DD4DEDE76CE75E8A280
                                      SHA-512:08B1E73BAAEBA7109318B8DBE3FEB635184CB95F79CBB8B4C8EAAFB3F5DB57818DBC82FE5CEEE845580793A1A8E881A6D08E518CEAF4EDD7D8B01DE03A6AAE49
                                      Malicious:false
                                      Preview:3q.e..w~....;.Uxq%.I.L.\C}I...r....vAn..j.|f.Ij.|..u.<....wd....!.=...$|ml2.,...V....9.?..&...v.."6.8....J..B..@...p..Y..S5.....S._P.f...P;H..{.S#...F..7....^[...,....m....Q.`".....P.X..J>Ga.....m....'S......5...F?.a.(..T....e.V..u...:B...E4h..i.A...C.N`5L...........L......9(.U........D#n... .W.x+..&BK...MV.d..N"I...cWg.e\*..5#.p0"=s.....jVd7Uw...c.9f..^....{....-L....btoK.<...B..m......D..C.....-A.E...z\Rz..,.{.P.......e...4..M.."..dx....<.3...wi.!...dR.{r.&..?.$Mjt.t5*='`..O/Q..7~hm.%......B.~....D3..M..,.l.....dg.?...{. ...\Q.U X#.....A/.......v._..;..9v.>..v..C..@`y5.D...1.?..#..6..8..E+.;0i....2u.%5._....2.=T...M\8.=/*\......*RQ.1-.EQT.r..V.:h..g.$.......'..hHI..y]...$w..#E...f.c.....H.Z..|Q.?O.PM,:..m:.c...5......M..\eF...4/.;|.w0/B r...(y.. . ..{L.E.........N~p.i.....4iKs..t.=.XaHB.....y&&.Dr..%.b.J.>.-y.B....#........dU...!..&.x~..,..%.J.....]/->...o..=.Ut.-.....($..y...pk.X.....}E....p..rX.g....4f|.p.K.....=....$"........o

                                      C:\Users\user\Videos\EUPTJQjet.README.txt

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1661
                                      Entropy (8bit):5.198506469867547
                                      Encrypted:false
                                      SSDEEP:24:aaJ9rsxXB9FouiPCW3IPuzmxe58LL0xLHQrcEJ2IoeXHGnaZaQbsEk5G5ait9rd:aIpshBHif3F+SLTEJnZGM9Itc8it9p
                                      MD5:548D0D12F49D3F89082C1EEE19BFB4D9
                                      SHA1:75D0246BCF466454F994B4DBB0442A8BB6030C51
                                      SHA-256:1DA2A3FDC6D8C4CBD27C21DF57F644CA824F290C3E5582EA1EEA04063DF42E3C
                                      SHA-512:E153DDB8FCB3DAF94D3623EEB6F6C01D06C7DD5498804EDECC605815D0D319396FC3DFF7A0C5C14195460F2EF76337E378424AC939977754BFDD36328F35457A
                                      Malicious:false
                                      Preview:Hello! ....Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.....--- Our communication process:.....1. You contact us....2. We send you a list of files that were stolen....3. We decrypt 1 file to confirm that our decryptor works....4. We agree on the amount, which must be paid using BTC....5. We delete your files, we give you a decryptor....6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future... ..--- Client area (use this site to contact us):.....Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion...>>> Use this ID: 39C1BACACEDFEC0F0089A12EC6A0DFF4 to begin the recovery process.......* In order to access the site, you will need Tor Browser, ... you can download it from this link: https://www.torproject.org/....--- Additional contact

                                      C:\Users\user\fpjGXkb.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):239
                                      Entropy (8bit):7.076461709750637
                                      Encrypted:false
                                      SSDEEP:6:k8TYvvsKSTurkNIxYSwypAY9mxU0ud6687d4046HIhKcQNJ/7pk:XYMJureIx82mG0Z6A546H/c2J/u
                                      MD5:CC6FF1BDC378A51432741301261D15B8
                                      SHA1:C4A418625BDDF950D015F49B72E6C6D386FEBBB8
                                      SHA-256:C022194DF484BE589B69ED1257006D05CDDD77F49EAB51BA4294F06DEED90E4E
                                      SHA-512:BB32E033D2FFBF1F12097F546E12D1454AEF7D3F1D3247B4E4B6B431F6AF70D6859C55E5B8B3DD672ECA63B5A7CA780C269E47CCAC6B5DB1C9E6CF472DD80EC2
                                      Malicious:false
                                      Preview: .q..Z.v.J.>.-y.Z..g./..~..&.......9...F.R.(..4Vs2........4R?..S....-.l^..%..).......n.ZY..RZ.LV.a.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Users\user\u523vgN.EUPTJQjet

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):239
                                      Entropy (8bit):7.092508584075406
                                      Encrypted:false
                                      SSDEEP:6:OFnYvvsK4B3GlRLsUsIFwpYAY9mxU0ud6687d4046HIhKcQNJ/7pk:eYML2DLsUkcmG0Z6A546H/c2J/u
                                      MD5:80D0D26E3E4D8E4E2F02746E31CFB237
                                      SHA1:50C8D95835A1CAD5BB7507C0D034A5A5D0CC778C
                                      SHA-256:B85D4BE01AC62D772EC9C3D4AE3E684811FA41B48F4F4A4D5EAAD0F7C36EBC67
                                      SHA-512:5A30931D320ADAA79A7CDA61AEE6FA0FB83CB877B87240726F2FB8A69B48C3E81A47FD18AB277702909CB45700E0DCDC2A47327F19B9FFB4C7A49022CAE484EC
                                      Malicious:false
                                      Preview:...0...J.>.-y.Z..g./..~..&.......9....}.4.......<.c....{.>1.s.?.>.9#..7.B....yp..j...!.m&.<..- .a.vR.p.-].0._...N...O...P..........7wG..........Q..d.<.U...]..?.S.......U........Rt.......".p/..-K.j9q.S.yZ]+.L.TH+.%....U.'...

                                      C:\Windows\System32\spool\PRINTERS\00002.SPL

                                      Download File
                                      Process:C:\Windows\splwow64.exe
                                      File Type:Microsoft OOXML
                                      Category:dropped
                                      Size (bytes):13757490
                                      Entropy (8bit):7.891417365960129
                                      Encrypted:false
                                      SSDEEP:196608:tZyDsFjVMKMLaqAl/gDgbw/LcbcaLgBVwhu:teGwD
                                      MD5:69B37A614B91961F68EF87E85E22FFBF
                                      SHA1:20D8F9AA46B932432C656274635C2AD3392D8B73
                                      SHA-256:B6D18CB624E76CE4E243D3CEE7312EAE8A14F084B2FB9258E28A90A83AA239A5
                                      SHA-512:2E781AEC0E372AF932161D064BB4C93F5C68B603785D3285F88BBF1CA6B784B9A7E67BD5742EEE8C84747A2B6B999FC398D005C0C4332E377C063112804C32A6
                                      Malicious:false
                                      Preview:PK........#FsY................[Content_Types].xml/[0].piece.....0..W..o.x .....e.(....Ql!..<...S^.MMw....#Nr.9....p..:..J.z..`3..DM....T.n..J..-c...3....&a#......PK....X.j...q...PK........cFsY................[Content_Types].xml/[1].piece..1..0....eE$....{e.C.&..X.........H\., .....o.T..i.."...K.s..4..VW...i+.Ak.....}....\.+..O?PK..K..jb...l...PK........cFsY................_rels/.rels/[0].pieceM.A..!.E.B.w...1.....9@...C!...?,].......f..4.qp.,.._^I...y?\`.....Cc.jF". .^...#g.T.A.e.c.........3.....PK...BpJl...y...PK........cFsY................_rels/.rels/[1].piece..K..0....9@&.....nk/.....O3S...s....L/'.UN...'.......P....UO:....=X......B..gD...c]...[..[..3..9.9a.... .....N.PK..4...u.......PK........cFsY................[Content_Types].xml/[2].piece-.A.. .F....p.u.q.&....!...m..[.n_^..kA.......>|.......f....`........}..F..(v.6.t...0-.n.C|@.N-.Z...PK....[Pm...{...PK........cFsY............%...FixedDocumentSequence.fdseq/[0].pieceU.M..0.F..fo&.....H.`..2.....H.o..p

                                      \Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON

                                      Download File
                                      Process:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):64
                                      Entropy (8bit):3.6945488277869583
                                      Encrypted:false
                                      SSDEEP:3:CnrlL5I2Y1An50FRR:UoG58RR
                                      MD5:F7ED45B1F749687A7EE212F6D0756977
                                      SHA1:E4A50B48319466D61DFB0F72EAEB8A06CCEEDB80
                                      SHA-256:0611D1573BC03A517BC2A2710542FD1FE2374F1DE71E4A33B69964345D10CDDE
                                      SHA-512:15D00D351A360995E51932685CC62F94B2CE4309C98C382C26AAFE2B9A57EA407C2DBF7AC89061DC682C63F6046193EF9DB4CA01B87B31858D5703531BAE6D4F
                                      Malicious:false
                                      Preview:....3.6.7.7.0.6.....\MAILSLOT\NET\GETDCC4B13B33............ ....

                                      \Device\Null

                                      Download File
                                      Process:C:\Windows\SysWOW64\cmd.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):22
                                      Entropy (8bit):4.095795255000933
                                      Encrypted:false
                                      SSDEEP:3:otlAloyn:ot+
                                      MD5:1D0C2E40B5B94E0FB64D661FC74134E2
                                      SHA1:FD402FE96EAF445A21D689EE989C042423B8A6A4
                                      SHA-256:828B769F5E3A3EF35B32A9E7095F8B5E0326C899093063F577ABB81E0E27CDB6
                                      SHA-512:77F6ADEDB143ED3B32FA1B2DEC1DBFD041784F5094D2BE625CBDCB3170FBD76AFFD9D285FEC73C92BE33E37EC1C0F330942B2942B1F39A0DBD3644B9310F0194
                                      Malicious:false
                                      Preview:C:\PROGRA~3\3B5A.tmp..

                                      Static File Info

                                      General

                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                      Entropy (8bit):7.845553325757237
                                      TrID:
                                      • Win32 Executable (generic) a (10002005/4) 99.66%
                                      • UPX compressed Win32 Executable (30571/9) 0.30%
                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                      • DOS Executable Generic (2002/1) 0.02%
                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                      File name:zhbEGHo55P.exe
                                      File size:92'160 bytes
                                      MD5:6c755a742f2b2e5c1820f57d0338365f
                                      SHA1:0b22b6e5269ec241b82450a7e65009685a3010fb
                                      SHA256:82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69
                                      SHA512:580fec443cb3236201750e643078b98e3d9f46cad3cc890b74371119f0ec33a0c5ba526e6135cc1ddcb90d867c214e37c700af55309c7725ed44e100173630ed
                                      SSDEEP:1536:yvXFnGvewvD/F3nICjRM5CEL92vR2zh9ckMBsA1RXZN1Mevt5:Ow3FE79UUzh9mBjBZNe
                                      TLSH:329302DD74A97253E7C625BC8F9DED722BE04CE58CEA18978C55C631A0B4AF08C08963
                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..c.................p....... ..0....0........@.......................................@...........@....................

                                      File Icon

                                      Icon Hash:00928e8e8686b000

                                      Static PE Info

                                      General

                                      Entrypoint:0x429130
                                      Entrypoint Section:UPX1
                                      Digitally signed:false
                                      Imagebase:0x400000
                                      Subsystem:windows gui
                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                      Time Stamp:0x631A9665 [Fri Sep 9 01:27:01 2022 UTC]
                                      TLS Callbacks:
                                      CLR (.Net) Version:
                                      OS Version Major:5
                                      OS Version Minor:1
                                      File Version Major:5
                                      File Version Minor:1
                                      Subsystem Version Major:5
                                      Subsystem Version Minor:1
                                      Import Hash:735a109d616d3347fcbd3bfda19abc79

                                      Entrypoint Preview

                                      Instruction
                                      pushad
                                      mov esi, 00413015h
                                      lea edi, dword ptr [esi-00012015h]
                                      push edi
                                      jmp 00007F30ECFCFC6Dh
                                      nop
                                      mov al, byte ptr [esi]
                                      inc esi
                                      mov byte ptr [edi], al
                                      inc edi
                                      add ebx, ebx
                                      jne 00007F30ECFCFC69h
                                      mov ebx, dword ptr [esi]
                                      sub esi, FFFFFFFCh
                                      adc ebx, ebx
                                      jc 00007F30ECFCFC4Fh
                                      mov eax, 00000001h
                                      add ebx, ebx
                                      jne 00007F30ECFCFC69h
                                      mov ebx, dword ptr [esi]
                                      sub esi, FFFFFFFCh
                                      adc ebx, ebx
                                      adc eax, eax
                                      add ebx, ebx
                                      jnc 00007F30ECFCFC51h
                                      jne 00007F30ECFCFC6Bh
                                      mov ebx, dword ptr [esi]
                                      sub esi, FFFFFFFCh
                                      adc ebx, ebx
                                      jnc 00007F30ECFCFC46h
                                      xor ecx, ecx
                                      sub eax, 03h
                                      jc 00007F30ECFCFC6Fh
                                      shl eax, 08h
                                      mov al, byte ptr [esi]
                                      inc esi
                                      xor eax, FFFFFFFFh
                                      je 00007F30ECFCFCD6h
                                      mov ebp, eax
                                      add ebx, ebx
                                      jne 00007F30ECFCFC69h
                                      mov ebx, dword ptr [esi]
                                      sub esi, FFFFFFFCh
                                      adc ebx, ebx
                                      adc ecx, ecx
                                      add ebx, ebx
                                      jne 00007F30ECFCFC69h
                                      mov ebx, dword ptr [esi]
                                      sub esi, FFFFFFFCh
                                      adc ebx, ebx
                                      adc ecx, ecx
                                      jne 00007F30ECFCFC82h
                                      inc ecx
                                      add ebx, ebx
                                      jne 00007F30ECFCFC69h
                                      mov ebx, dword ptr [esi]
                                      sub esi, FFFFFFFCh
                                      adc ebx, ebx
                                      adc ecx, ecx
                                      add ebx, ebx
                                      jnc 00007F30ECFCFC51h
                                      jne 00007F30ECFCFC6Bh
                                      mov ebx, dword ptr [esi]
                                      sub esi, FFFFFFFCh
                                      adc ebx, ebx
                                      jnc 00007F30ECFCFC46h
                                      add ecx, 02h
                                      cmp ebp, FFFFF300h
                                      adc ecx, 01h
                                      lea edx, dword ptr [edi+ebp]
                                      cmp ebp, FFFFFFFCh
                                      jbe 00007F30ECFCFC71h
                                      mov al, byte ptr [edx]
                                      inc edx
                                      mov byte ptr [edi], al
                                      inc edi
                                      dec ecx
                                      jne 00007F30ECFCFC59h
                                      jmp 00007F30ECFCFBC8h
                                      nop
                                      mov eax, dword ptr [edx]
                                      add edx, 04h
                                      mov dword ptr [edi], eax
                                      add edi, 04h
                                      sub ecx, 04h
                                      jnbe 00007F30ECFCFC53h
                                      add edi, ecx
                                      jmp 00007F30ECFDFBB1h

                                      Data Directories

                                      NameVirtual AddressVirtual Size Is in Section
                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x2a0000xe8UPX2
                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x2a0e80xcUPX2
                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                      Sections

                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                      UPX00x10000x120000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                      UPX10x130000x170000x16400ae1d7a16f02179b3c2e0886c2c9544efFalse0.9693425210674157data7.857377972653934IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                      UPX20x2a0000x10000x200606cb6b8b3a25253e435727d873c26c8False0.31640625data2.1963755113672714IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                      Imports

                                      DLLImport
                                      gdi32.dllSetPixel
                                      KERNEL32.DLLLoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
                                      USER32.dllEndDialog

                                      Network Behavior

                                      DNS Answers

                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                      Nov 19, 2024 14:42:12.956392050 CET1.1.1.1192.168.2.60xd3c7No error (0)shed.dual-low.s-part-0015.t-0009.t-msedge.nets-part-0015.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                      Nov 19, 2024 14:42:12.956392050 CET1.1.1.1192.168.2.60xd3c7No error (0)s-part-0015.t-0009.t-msedge.net13.107.246.43A (IP address)IN (0x0001)false
                                      Nov 19, 2024 14:44:02.279485941 CET1.1.1.1192.168.2.60xcf79No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comdefault.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comCNAME (Canonical name)IN (0x0001)false
                                      Nov 19, 2024 14:44:02.279485941 CET1.1.1.1192.168.2.60xcf79No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com217.20.57.20A (IP address)IN (0x0001)false
                                      Nov 19, 2024 14:44:02.279485941 CET1.1.1.1192.168.2.60xcf79No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com217.20.57.36A (IP address)IN (0x0001)false
                                      Nov 19, 2024 14:44:02.279485941 CET1.1.1.1192.168.2.60xcf79No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com217.20.57.19A (IP address)IN (0x0001)false
                                      Nov 19, 2024 14:44:02.279485941 CET1.1.1.1192.168.2.60xcf79No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com217.20.57.35A (IP address)IN (0x0001)false

                                      Statistics

                                      CPU Usage

                                      Click to jump to process

                                      Memory Usage

                                      Click to jump to process

                                      High Level Behavior Distribution

                                      Click to dive into process behavior distribution

                                      Behavior

                                      Click to jump to process

                                      System Behavior

                                      General

                                      Target ID:0
                                      Start time:08:42:19
                                      Start date:19/11/2024
                                      Path:C:\Users\user\Desktop\zhbEGHo55P.exe
                                      Wow64 process (32bit):true
                                      Commandline:"C:\Users\user\Desktop\zhbEGHo55P.exe"
                                      Imagebase:0xe00000
                                      File size:92'160 bytes
                                      MD5 hash:6C755A742F2B2E5C1820F57D0338365F
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Yara matches:
                                      • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2850291863.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.2852246091.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                      • Rule: Windows_Ransomware_Lockbit_369e1e94, Description: unknown, Source: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Author: unknown
                                      Reputation:low
                                      Has exited:true

                                      General

                                      Target ID:4
                                      Start time:08:43:05
                                      Start date:19/11/2024
                                      Path:C:\Windows\splwow64.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\splwow64.exe 12288
                                      Imagebase:0x7ff7480b0000
                                      File size:163'840 bytes
                                      MD5 hash:77DE7761B037061C7C112FD3C5B91E73
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high
                                      Has exited:true

                                      General

                                      Target ID:7
                                      Start time:08:43:17
                                      Start date:19/11/2024
                                      Path:C:\ProgramData\3B5A.tmp
                                      Wow64 process (32bit):true
                                      Commandline:"C:\ProgramData\3B5A.tmp"
                                      Imagebase:0x400000
                                      File size:14'336 bytes
                                      MD5 hash:294E9F64CB1642DD89229FFF0592856B
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Antivirus matches:
                                      • Detection: 100%, Avira
                                      • Detection: 100%, Joe Sandbox ML
                                      • Detection: 87%, ReversingLabs
                                      Reputation:moderate
                                      Has exited:true

                                      General

                                      Target ID:8
                                      Start time:08:43:17
                                      Start date:19/11/2024
                                      Path:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                      Wow64 process (32bit):true
                                      Commandline:/insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{D79D5AAD-BC63-41DE-AE42-49492D7025DC}.xps" 133764973860940000
                                      Imagebase:0x8a0000
                                      File size:2'191'768 bytes
                                      MD5 hash:0061760D72416BCF5F2D9FA6564F0BEA
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:moderate
                                      Has exited:false

                                      General

                                      Target ID:9
                                      Start time:08:43:18
                                      Start date:19/11/2024
                                      Path:C:\Windows\SysWOW64\cmd.exe
                                      Wow64 process (32bit):true
                                      Commandline:"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3B5A.tmp >> NUL
                                      Imagebase:0x1c0000
                                      File size:236'544 bytes
                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high
                                      Has exited:true

                                      General

                                      Target ID:10
                                      Start time:08:43:18
                                      Start date:19/11/2024
                                      Path:C:\Windows\System32\conhost.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      Imagebase:0x7ff66e660000
                                      File size:862'208 bytes
                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high
                                      Has exited:true

                                      Disassembly

                                      Reset < >

                                        Execution Graph

                                        Execution Coverage:19.1%
                                        Dynamic/Decrypted Code Coverage:0%
                                        Signature Coverage:14.9%
                                        Total number of Nodes:1940
                                        Total number of Limit Nodes:121
                                        execution_graph 11481 e0aa20 11482 e0aa43 11481->11482 11483 e06844 RtlAllocateHeap 11482->11483 11486 e0ab2f 11482->11486 11484 e0ab03 11483->11484 11485 e0686c RtlFreeHeap 11484->11485 11484->11486 11485->11486 11487 e10220 11501 e1011d 11487->11501 11488 e1028d 11489 e0686c RtlFreeHeap 11488->11489 11491 e1029b 11488->11491 11489->11491 11490 e069e0 RtlAllocateHeap 11490->11501 11493 e10313 11491->11493 11494 e0686c RtlFreeHeap 11491->11494 11492 e0f6d8 NtSetInformationThread 11492->11501 11495 e10321 11493->11495 11496 e0686c RtlFreeHeap 11493->11496 11494->11493 11497 e1032f 11495->11497 11498 e0686c RtlFreeHeap 11495->11498 11496->11495 11498->11497 11499 e0b3c0 NtSetInformationThread 11499->11501 11500 e0686c RtlFreeHeap 11500->11501 11501->11488 11501->11490 11501->11492 11501->11499 11501->11500 11308 e08ea2 11309 e08e63 QueryServiceStatusEx 11308->11309 11310 e08e83 11308->11310 11309->11310 11311 e08e85 11309->11311 11311->11309 11311->11310 11682 e08f66 11683 e08f68 RtlAdjustPrivilege 11682->11683 11684 e097d8 4 API calls 11683->11684 11685 e08fa0 11684->11685 11686 e09880 NtClose 11685->11686 11688 e09010 11685->11688 11687 e08fae 11686->11687 11687->11688 11690 e08fb7 NtSetInformationThread 11687->11690 11689 e09035 11688->11689 11691 e08ecc 4 API calls 11688->11691 11690->11688 11692 e08fcb 11690->11692 11691->11689 11693 e08da8 6 API calls 11692->11693 11694 e08fe0 11693->11694 11694->11688 11695 e09880 NtClose 11694->11695 11696 e08fee 11695->11696 11696->11688 11697 e08be0 2 API calls 11696->11697 11697->11688 11461 e0ac68 11462 e0ac50 11461->11462 11463 e0ac83 11462->11463 11464 e06894 RtlReAllocateHeap 11462->11464 11468 e0ac66 11462->11468 11465 e0686c RtlFreeHeap 11463->11465 11464->11462 11465->11468 11466 e0686c RtlFreeHeap 11467 e0adb0 11466->11467 11468->11466 11698 e13168 11700 e1317f 11698->11700 11699 e131ce 11700->11699 11701 e12af8 4 API calls 11700->11701 11701->11699 11502 e0782a 11503 e0782c CoInitialize 11502->11503 11504 e07c9f 11503->11504 11506 e07861 11503->11506 11507 e07b6a CoSetProxyBlanket 11506->11507 11508 e07ac6 CoUninitialize 11506->11508 11507->11508 11508->11504 11251 e0f8f0 11253 e0f8d2 11251->11253 11252 e06844 RtlAllocateHeap 11252->11253 11253->11252 11257 e0f8ee 11253->11257 11255 e0fa12 CoUninitialize 11256 e0fc77 11255->11256 11257->11255 11258 e06844 RtlAllocateHeap 11257->11258 11258->11257 11518 e0e430 11522 e0e3f3 11518->11522 11519 e0e3c5 SetFileAttributesW CreateFileW 11521 e0e40b 11519->11521 11519->11522 11520 e0de48 5 API calls 11520->11522 11522->11519 11522->11520 11522->11521 11469 e14070 11474 e140b4 11469->11474 11470 e144e2 11471 e144f0 11470->11471 11473 e0686c RtlFreeHeap 11470->11473 11475 e144fe 11471->11475 11476 e0686c RtlFreeHeap 11471->11476 11472 e0686c RtlFreeHeap 11472->11470 11473->11471 11477 e06de8 RtlAllocateHeap 11474->11477 11480 e140d2 11474->11480 11476->11475 11478 e14186 11477->11478 11479 e06844 RtlAllocateHeap 11478->11479 11478->11480 11479->11480 11480->11470 11480->11472 11523 e0f032 11524 e0effb 11523->11524 11525 e0efe7 MoveFileExW 11524->11525 11526 e0f034 11524->11526 11527 e0eff9 11524->11527 11528 e0686c RtlFreeHeap 11524->11528 11534 e0ece4 RtlAllocateHeap 11524->11534 11525->11524 11525->11527 11529 e0686c RtlFreeHeap 11526->11529 11530 e0f051 CreateFileW 11527->11530 11541 e0f075 11527->11541 11528->11524 11529->11527 11531 e0f07a 11530->11531 11530->11541 11537 e0ed30 2 API calls 11531->11537 11532 e0f14d 11533 e0686c RtlFreeHeap 11532->11533 11536 e0f155 11533->11536 11534->11524 11535 e0686c RtlFreeHeap 11535->11532 11538 e0f08f 11537->11538 11539 e0f0a3 CreateIoCompletionPort 11538->11539 11538->11541 11540 e0f0ba 11539->11540 11543 e0f0dc 11539->11543 11542 e0686c RtlFreeHeap 11540->11542 11541->11532 11541->11535 11542->11541 11543->11541 11544 e0686c RtlFreeHeap 11543->11544 11544->11541 11554 e0ddf2 11557 e0ddde 11554->11557 11555 e0ddf0 11556 e0de3d 11555->11556 11558 e0686c RtlFreeHeap 11555->11558 11557->11555 11559 e0db90 NtTerminateProcess 11557->11559 11560 e0dc60 NtTerminateProcess 11557->11560 11558->11556 11559->11557 11560->11557 11259 e09af9 11260 e09bb0 11259->11260 11261 e09c5e 11260->11261 11262 e07fbc RtlAllocateHeap 11260->11262 11263 e09bc8 11262->11263 11264 e09c11 11263->11264 11266 e104b4 13 API calls 11263->11266 11265 e09c31 CreateMutexW 11264->11265 11267 e068ec RtlFreeHeap 11265->11267 11266->11264 11267->11261 11276 e0b6c8 11277 e0b715 11276->11277 11278 e0b71a 11277->11278 11279 e0b71c RtlAdjustPrivilege 11277->11279 11279->11277 11279->11278 11328 e0d88a 11347 e0cd04 11328->11347 11331 e0cedc RtlAllocateHeap 11339 e0d8cb 11331->11339 11332 e0d9cc 11334 e0d9da 11332->11334 11335 e0686c RtlFreeHeap 11332->11335 11333 e0686c RtlFreeHeap 11333->11332 11336 e0d9e8 11334->11336 11337 e0686c RtlFreeHeap 11334->11337 11335->11334 11338 e0d9f6 11336->11338 11340 e0686c RtlFreeHeap 11336->11340 11337->11336 11341 e06de8 RtlAllocateHeap 11339->11341 11345 e0d8c1 11339->11345 11340->11338 11342 e0d921 11341->11342 11343 e06844 RtlAllocateHeap 11342->11343 11342->11345 11344 e0d974 11343->11344 11344->11345 11346 e0cfcc 2 API calls 11344->11346 11345->11332 11345->11333 11346->11345 11348 e06de8 RtlAllocateHeap 11347->11348 11349 e0cd56 11348->11349 11381 e0cd5f 11349->11381 11382 e0c658 11349->11382 11352 e0ce70 11355 e0ce7e 11352->11355 11356 e0686c RtlFreeHeap 11352->11356 11354 e0686c RtlFreeHeap 11354->11352 11357 e0ce8c 11355->11357 11359 e0686c RtlFreeHeap 11355->11359 11356->11355 11360 e0ce9a 11357->11360 11362 e0686c RtlFreeHeap 11357->11362 11359->11357 11363 e0cea8 11360->11363 11365 e0686c RtlFreeHeap 11360->11365 11361 e0c8c4 2 API calls 11364 e0cd79 11361->11364 11362->11360 11367 e0ceb6 11363->11367 11369 e0686c RtlFreeHeap 11363->11369 11417 e0c928 11364->11417 11365->11363 11370 e0cec4 11367->11370 11372 e0686c RtlFreeHeap 11367->11372 11368 e0cd81 11422 e0cb20 11368->11422 11369->11367 11371 e0ced2 11370->11371 11373 e0686c RtlFreeHeap 11370->11373 11371->11331 11371->11345 11372->11370 11373->11371 11377 e0cd99 11378 e06844 RtlAllocateHeap 11377->11378 11379 e0ce19 11378->11379 11380 e06894 RtlReAllocateHeap 11379->11380 11379->11381 11380->11381 11381->11352 11381->11354 11383 e0a488 5 API calls 11382->11383 11384 e0c68c 11383->11384 11385 e0c692 11384->11385 11386 e06844 RtlAllocateHeap 11384->11386 11388 e0c832 11385->11388 11389 e0686c RtlFreeHeap 11385->11389 11387 e0c6a4 11386->11387 11387->11385 11392 e0a488 5 API calls 11387->11392 11390 e0c840 11388->11390 11393 e0686c RtlFreeHeap 11388->11393 11389->11388 11391 e0c84e 11390->11391 11394 e0686c RtlFreeHeap 11390->11394 11408 e0c858 11391->11408 11395 e0c6c1 11392->11395 11393->11390 11394->11391 11395->11385 11396 e06de8 RtlAllocateHeap 11395->11396 11397 e0c6d6 11396->11397 11397->11385 11398 e06de8 RtlAllocateHeap 11397->11398 11399 e0c6ee 11398->11399 11399->11385 11400 e06844 RtlAllocateHeap 11399->11400 11401 e0c71f 11400->11401 11401->11385 11402 e06844 RtlAllocateHeap 11401->11402 11406 e0c748 11402->11406 11403 e0a1c0 5 API calls 11403->11406 11405 e0c7ff 11407 e06894 RtlReAllocateHeap 11405->11407 11406->11385 11406->11403 11406->11405 11429 e0a54c 11406->11429 11407->11385 11433 e0a108 11408->11433 11411 e06844 RtlAllocateHeap 11412 e0c88d 11411->11412 11413 e0a108 NtSetInformationThread 11412->11413 11416 e0c8b4 11412->11416 11414 e0c8a8 11413->11414 11415 e0686c RtlFreeHeap 11414->11415 11414->11416 11415->11416 11416->11361 11418 e06c98 RtlFreeHeap 11417->11418 11419 e0c951 11418->11419 11420 e06844 RtlAllocateHeap 11419->11420 11421 e0c955 11419->11421 11420->11421 11421->11368 11423 e0cbdb 11422->11423 11424 e06844 RtlAllocateHeap 11423->11424 11425 e0cc88 11423->11425 11424->11425 11426 e0ccb4 11425->11426 11427 e06844 RtlAllocateHeap 11426->11427 11428 e0ccc6 11427->11428 11428->11377 11430 e0a58f 11429->11430 11431 e0b3c0 NtSetInformationThread 11430->11431 11432 e0a5a9 11430->11432 11431->11432 11432->11406 11434 e0a13f 11433->11434 11435 e0b3c0 NtSetInformationThread 11434->11435 11436 e0a159 11434->11436 11435->11436 11436->11411 11437 e07e8a 11444 e07e60 11437->11444 11438 e07e72 NtQuerySystemInformation 11438->11444 11439 e06894 RtlReAllocateHeap 11439->11444 11440 e0686c RtlFreeHeap 11440->11444 11441 e0686c RtlFreeHeap 11442 e07f40 Sleep 11441->11442 11442->11444 11443 e06844 RtlAllocateHeap 11443->11444 11444->11438 11444->11439 11444->11440 11444->11441 11444->11443 11561 e0ddca 11563 e0dd81 11561->11563 11562 e0ddf0 11564 e0de3d 11562->11564 11565 e0686c RtlFreeHeap 11562->11565 11566 e06894 RtlReAllocateHeap 11563->11566 11567 e0dd9d 11563->11567 11565->11564 11566->11563 11567->11562 11568 e0db90 NtTerminateProcess 11567->11568 11569 e0dc60 NtTerminateProcess 11567->11569 11568->11567 11569->11567 11280 e0b4cd 11281 e0b4dc CheckTokenMembership 11280->11281 11286 e096cd 11287 e096af 11286->11287 11288 e09735 11287->11288 11289 e0686c RtlFreeHeap 11287->11289 11289->11288 9409 e09990 9410 e09995 9409->9410 9454 e06f48 9410->9454 9412 e0999a 9487 e0b4dc CheckTokenMembership 9412->9487 9414 e099d7 9488 e06d40 9414->9488 9416 e099e6 9418 e099f4 9416->9418 9491 e0bb70 9416->9491 9417 e099b9 9417->9414 9523 e0b4fc 9417->9523 9421 e09a00 9494 e0b708 9421->9494 9431 e09a13 9432 e09a9f 9431->9432 9553 e0b1ac 9431->9553 9435 e09ade 9432->9435 9440 e0b674 NtQueryInformationToken 9432->9440 9433 e09a3c 9433->9431 9536 e0ae74 9433->9536 9507 e0c3f8 9435->9507 9446 e09acc 9440->9446 9446->9435 9577 e131e8 9446->9577 9447 e09a7a 9447->9432 9574 e0686c 9447->9574 9450 e09a89 9451 e0686c RtlFreeHeap 9450->9451 9452 e09a94 9451->9452 9453 e0686c RtlFreeHeap 9452->9453 9453->9432 9581 e06de8 9454->9581 9456 e06f60 9457 e07237 9456->9457 9584 e06844 9456->9584 9457->9412 9459 e0722f 9460 e0686c RtlFreeHeap 9459->9460 9460->9457 9461 e0686c RtlFreeHeap 9461->9459 9462 e06f7d 9462->9459 9463 e06844 RtlAllocateHeap 9462->9463 9464 e07000 9462->9464 9486 e07221 9462->9486 9463->9464 9465 e07033 9464->9465 9466 e06844 RtlAllocateHeap 9464->9466 9467 e06844 RtlAllocateHeap 9465->9467 9468 e07066 9465->9468 9466->9465 9467->9468 9469 e07099 9468->9469 9470 e06844 RtlAllocateHeap 9468->9470 9472 e06844 RtlAllocateHeap 9469->9472 9473 e070cc 9469->9473 9470->9469 9471 e07132 9477 e07169 9471->9477 9478 e06844 RtlAllocateHeap 9471->9478 9472->9473 9474 e070ff 9473->9474 9475 e06844 RtlAllocateHeap 9473->9475 9474->9471 9476 e06844 RtlAllocateHeap 9474->9476 9475->9474 9476->9471 9479 e06844 RtlAllocateHeap 9477->9479 9477->9486 9478->9477 9480 e071a4 9479->9480 9480->9486 9587 e06ee4 9480->9587 9482 e071cc 9483 e06844 RtlAllocateHeap 9482->9483 9484 e071eb 9483->9484 9485 e0686c RtlFreeHeap 9484->9485 9484->9486 9485->9486 9486->9461 9487->9417 9489 e06844 RtlAllocateHeap 9488->9489 9490 e06d55 9489->9490 9490->9416 9492 e06844 RtlAllocateHeap 9491->9492 9493 e0bb81 9492->9493 9493->9421 9495 e0b715 9494->9495 9496 e09a0a 9495->9496 9497 e0b71c RtlAdjustPrivilege 9495->9497 9498 e0b674 9496->9498 9497->9495 9497->9496 9499 e0b68b 9498->9499 9500 e0b68f NtQueryInformationToken 9499->9500 9501 e09a0f 9499->9501 9500->9501 9501->9431 9502 e0b388 9501->9502 9596 e097d8 9502->9596 9504 e0b3a5 9505 e09a29 9504->9505 9606 e09880 9504->9606 9505->9431 9535 e0b4dc CheckTokenMembership 9505->9535 9508 e0c418 9507->9508 9509 e09af3 9507->9509 9510 e06de8 RtlAllocateHeap 9508->9510 9517 e0e2b8 9509->9517 9511 e0c429 9510->9511 9511->9509 9512 e06844 RtlAllocateHeap 9511->9512 9516 e0c445 9512->9516 9513 e0c645 9514 e0686c RtlFreeHeap 9513->9514 9514->9509 9515 e0686c RtlFreeHeap 9515->9513 9516->9513 9516->9515 9518 e0e2d4 9517->9518 9613 e0e350 9518->9613 9520 e0e32a 9521 e09af8 9520->9521 9522 e0686c RtlFreeHeap 9520->9522 9522->9521 9524 e0b511 9523->9524 9525 e06844 RtlAllocateHeap 9524->9525 9526 e099ce 9524->9526 9527 e0b54a 9525->9527 9526->9414 9529 e0babc 9526->9529 9527->9526 9528 e0686c RtlFreeHeap 9527->9528 9528->9526 9531 e0bad1 9529->9531 9530 e0bb66 9530->9414 9531->9530 9617 e09740 9531->9617 9534 e0686c RtlFreeHeap 9534->9530 9535->9433 9537 e0aebf 9536->9537 9552 e0b074 9537->9552 9621 e0ac28 9537->9621 9539 e0aecd 9540 e0afbb 9539->9540 9541 e0b0cf 9539->9541 9539->9552 9543 e06de8 RtlAllocateHeap 9540->9543 9540->9552 9542 e06de8 RtlAllocateHeap 9541->9542 9541->9552 9544 e0b0fe 9542->9544 9545 e0afee 9543->9545 9547 e0686c RtlFreeHeap 9544->9547 9544->9552 9546 e0686c RtlFreeHeap 9545->9546 9545->9552 9548 e0b010 9546->9548 9547->9552 9549 e06de8 RtlAllocateHeap 9548->9549 9548->9552 9550 e0b056 9549->9550 9551 e0686c RtlFreeHeap 9550->9551 9550->9552 9551->9552 9552->9431 9554 e0b1ca 9553->9554 9555 e06844 RtlAllocateHeap 9554->9555 9557 e0b1d5 9555->9557 9556 e09a58 9556->9432 9567 e0b5b8 9556->9567 9557->9556 9558 e0686c RtlFreeHeap 9557->9558 9561 e0b1f6 9558->9561 9559 e0b350 9560 e0686c RtlFreeHeap 9559->9560 9560->9556 9561->9559 9630 e06e18 9561->9630 9563 e0b306 9564 e06e18 RtlAllocateHeap 9563->9564 9565 e0b32b 9564->9565 9566 e06e18 RtlAllocateHeap 9565->9566 9566->9559 9569 e0b5cd 9567->9569 9568 e09a71 9568->9432 9573 e0b4dc CheckTokenMembership 9568->9573 9569->9568 9570 e06844 RtlAllocateHeap 9569->9570 9572 e0b606 9570->9572 9571 e0686c RtlFreeHeap 9571->9568 9572->9568 9572->9571 9573->9447 9575 e06874 9574->9575 9576 e06882 RtlFreeHeap 9575->9576 9576->9450 9579 e131f8 9577->9579 9578 e13256 9578->9435 9579->9578 9633 e12f58 9579->9633 9582 e06844 RtlAllocateHeap 9581->9582 9583 e06df9 9582->9583 9583->9456 9585 e0684c 9584->9585 9586 e0685a RtlAllocateHeap 9585->9586 9586->9462 9588 e06f0b 9587->9588 9593 e06e8c 9588->9593 9590 e06f2b 9591 e0686c RtlFreeHeap 9590->9591 9592 e06f3f 9591->9592 9592->9482 9594 e06844 RtlAllocateHeap 9593->9594 9595 e06eaf 9594->9595 9595->9590 9597 e06844 RtlAllocateHeap 9596->9597 9599 e097f6 9597->9599 9598 e097f9 NtQuerySystemInformation 9598->9599 9603 e0980f 9598->9603 9599->9598 9600 e0982c 9599->9600 9610 e06894 9599->9610 9602 e0686c RtlFreeHeap 9600->9602 9602->9603 9603->9504 9604 e0686c RtlFreeHeap 9603->9604 9605 e09872 9604->9605 9605->9504 9609 e098a5 9606->9609 9607 e09977 9607->9505 9608 e0996e NtClose 9608->9607 9609->9607 9609->9608 9611 e0689c 9610->9611 9612 e068aa RtlReAllocateHeap 9611->9612 9612->9599 9614 e0e369 9613->9614 9615 e0e35c 9613->9615 9614->9520 9615->9614 9616 e06844 RtlAllocateHeap 9615->9616 9616->9614 9618 e09752 9617->9618 9620 e0977a 9617->9620 9619 e06844 RtlAllocateHeap 9618->9619 9619->9620 9620->9534 9622 e06844 RtlAllocateHeap 9621->9622 9623 e0ac4d 9622->9623 9624 e0ac83 9623->9624 9625 e06894 RtlReAllocateHeap 9623->9625 9629 e0ac66 9623->9629 9626 e0686c RtlFreeHeap 9624->9626 9625->9623 9626->9629 9627 e0686c RtlFreeHeap 9628 e0adb0 9627->9628 9628->9539 9629->9539 9629->9627 9631 e06844 RtlAllocateHeap 9630->9631 9632 e06e2a 9631->9632 9632->9563 9634 e12f69 9633->9634 9636 e130f7 9634->9636 9637 e0b3c0 9634->9637 9636->9578 9638 e0b3d2 9637->9638 9640 e0b3cf 9637->9640 9639 e0b419 NtSetInformationThread 9638->9639 9638->9640 9639->9640 9640->9636 11545 e09811 11547 e09813 11545->11547 11546 e097f9 NtQuerySystemInformation 11546->11547 11551 e0980f 11546->11551 11547->11546 11548 e0982c 11547->11548 11549 e06894 RtlReAllocateHeap 11547->11549 11550 e0686c RtlFreeHeap 11548->11550 11549->11547 11550->11551 11552 e0686c RtlFreeHeap 11551->11552 11553 e09872 11552->11553 11658 e0df94 11663 e0de8f 11658->11663 11659 e0dee2 11660 e0def1 ReadFile 11660->11663 11661 e0e0aa WriteFile 11661->11663 11662 e0e150 NtClose 11662->11663 11663->11659 11663->11660 11663->11661 11663->11662 11664 e0686c RtlFreeHeap 11663->11664 11665 e0e031 WriteFile 11663->11665 11664->11663 11665->11663 11702 e17556 11712 e1752b 11702->11712 11703 e17631 11706 e17637 11703->11706 11707 e17646 11703->11707 11704 e17624 11705 e1205c 15 API calls 11704->11705 11741 e1762c 11705->11741 11708 e09bb0 14 API calls 11706->11708 11709 e17656 11707->11709 11710 e1764c 11707->11710 11711 e1763c 11708->11711 11714 e17675 11709->11714 11715 e1765c 11709->11715 11713 e173ac 15 API calls 11710->11713 11718 e11ef4 126 API calls 11711->11718 11712->11703 11712->11704 11713->11741 11716 e17685 11714->11716 11717 e1767b 11714->11717 11719 e16fa0 6 API calls 11715->11719 11722 e176d8 11716->11722 11723 e1768b 11716->11723 11721 e1390c 6 API calls 11717->11721 11718->11741 11720 e17661 11719->11720 11724 e16bbc 2 API calls 11720->11724 11721->11741 11725 e176e7 11722->11725 11726 e176de 11722->11726 11727 e176ba 11723->11727 11731 e16da8 2 API calls 11723->11731 11724->11741 11729 e0a338 NtSetInformationThread 11725->11729 11728 e16bbc 2 API calls 11726->11728 11732 e104b4 13 API calls 11727->11732 11727->11741 11728->11741 11730 e176f8 11729->11730 11733 e1771c 11730->11733 11735 e0a338 NtSetInformationThread 11730->11735 11731->11727 11732->11741 11734 e12428 11 API calls 11733->11734 11734->11741 11736 e1770b 11735->11736 11736->11733 11737 e17710 11736->11737 11738 e09bb0 14 API calls 11737->11738 11739 e17715 11738->11739 11740 e17034 126 API calls 11739->11740 11740->11741 9641 e17458 9643 e17482 9641->9643 9642 e17498 9643->9642 9644 e174a3 9643->9644 9654 e174b2 9643->9654 9686 e09bb0 9644->9686 9648 e17631 9651 e17637 9648->9651 9652 e17646 9648->9652 9649 e17624 9755 e1205c 9649->9755 9653 e09bb0 14 API calls 9651->9653 9655 e17656 9652->9655 9656 e1764c 9652->9656 9657 e1763c 9653->9657 9654->9648 9654->9649 9659 e17675 9655->9659 9660 e1765c 9655->9660 9837 e173ac 9656->9837 9806 e11ef4 9657->9806 9661 e17685 9659->9661 9662 e1767b 9659->9662 9848 e16fa0 9660->9848 9667 e176d8 9661->9667 9668 e1768b 9661->9668 9875 e1390c 9662->9875 9670 e176e7 9667->9670 9671 e176de 9667->9671 9672 e176ba 9668->9672 9882 e16da8 9668->9882 9927 e0a338 9670->9927 9673 e16bbc 2 API calls 9671->9673 9672->9642 9896 e104b4 9672->9896 9673->9642 9678 e1771c 9931 e12428 9678->9931 9680 e0a338 NtSetInformationThread 9681 e1770b 9680->9681 9681->9678 9682 e17710 9681->9682 9683 e09bb0 14 API calls 9682->9683 9684 e17715 9683->9684 9685 e17034 126 API calls 9684->9685 9685->9642 9687 e09bc3 9686->9687 9688 e09c5e 9686->9688 9968 e07fbc 9687->9968 9695 e17034 KiUserCallbackDispatcher 9688->9695 9691 e09c11 9692 e09c31 CreateMutexW 9691->9692 9972 e068ec 9692->9972 9693 e104b4 13 API calls 9693->9691 9700 e17059 9695->9700 9708 e170ff 9695->9708 9696 e17145 CreateThread CreateThread 9698 e17183 9696->9698 9699 e1717e 9696->9699 10486 e07468 GetLogicalDriveStringsW 9696->10486 10491 e0782c CoInitialize 9696->10491 9697 e1711a CreateThread 9697->9696 9705 e17135 9697->9705 10471 e08f68 RtlAdjustPrivilege 9697->10471 9702 e171a4 9698->9702 9703 e1718c CreateThread 9698->9703 9978 e07ca4 OpenSCManagerW 9699->9978 9706 e170bc 9700->9706 10083 e09c64 9700->10083 9714 e17221 9702->9714 9986 e0b734 9702->9986 9703->9702 10458 e07e58 9703->10458 9705->9696 9707 e09c64 3 API calls 9706->9707 9706->9708 9707->9708 9708->9696 9708->9697 9711 e1726b NtTerminateThread 9712 e1727f 9711->9712 9715 e172a3 9712->9715 9716 e17288 CreateThread 9712->9716 9714->9711 9714->9712 9718 e172c3 9715->9718 9719 e17392 9715->9719 9716->9715 10466 e09628 9716->10466 9722 e172cc CreateThread 9718->9722 9738 e172e7 9718->9738 10126 e11934 9719->10126 9720 e17201 9721 e17214 9720->9721 9725 e0e2b8 2 API calls 9720->9725 9736 e0e2b8 2 API calls 9721->9736 9722->9738 10429 e0c064 9722->10429 9729 e1720f 9725->9729 9727 e17339 9730 e0b674 NtQueryInformationToken 9727->9730 10040 e0fc88 9729->10040 9734 e1733e 9730->9734 9732 e0e2b8 2 API calls 9737 e171f2 9732->9737 9739 e17342 9734->9739 9740 e17349 9734->9740 9736->9714 10009 e10a38 9737->10009 9738->9727 10062 e0da00 9738->10062 10104 e08960 9739->10104 10108 e08230 9740->10108 9744 e17390 9744->9642 9746 e171f7 9747 e0e2b8 2 API calls 9746->9747 9748 e171fc 9747->9748 10016 e10be4 9748->10016 9752 e17347 9752->9744 10077 e09640 9752->10077 9754 e104b4 13 API calls 9754->9744 9756 e06934 RtlAllocateHeap 9755->9756 9757 e12074 9756->9757 9758 e120a5 9757->9758 9759 e12096 9757->9759 9803 e1210d 9757->9803 10657 e07428 9758->10657 10631 e10000 9759->10631 9763 e12105 9765 e0686c RtlFreeHeap 9763->9765 9764 e0a280 NtSetInformationThread 9799 e120ea 9764->9799 9765->9803 9766 e06844 RtlAllocateHeap 9766->9799 9767 e12122 9768 e0686c RtlFreeHeap 9767->9768 9768->9803 9769 e12196 9771 e0686c RtlFreeHeap 9769->9771 9770 e0a338 NtSetInformationThread 9770->9799 9771->9803 9772 e1236f 9774 e0686c RtlFreeHeap 9772->9774 9773 e1228e 9775 e0686c RtlFreeHeap 9773->9775 9774->9803 9775->9803 9776 e122a1 10669 e0a3dc 9776->10669 9777 e12271 9783 e0686c RtlFreeHeap 9777->9783 9778 e123a1 9781 e06984 RtlAllocateHeap 9778->9781 9779 e122c5 9788 e12323 9779->9788 9789 e1232d 9779->9789 9780 e12382 9780->9778 9784 e12397 9780->9784 9785 e123fa 9781->9785 9783->9803 9791 e0686c RtlFreeHeap 9784->9791 9792 e0686c RtlFreeHeap 9785->9792 9794 e06984 RtlAllocateHeap 9788->9794 10673 e06a74 9789->10673 9791->9803 9796 e12403 9792->9796 9793 e122b8 9797 e0686c RtlFreeHeap 9793->9797 9795 e1232b 9794->9795 9800 e0686c RtlFreeHeap 9795->9800 9802 e1096c 10 API calls 9796->9802 9796->9803 9797->9803 9798 e0686c RtlFreeHeap 9798->9799 9799->9763 9799->9764 9799->9766 9799->9767 9799->9769 9799->9770 9799->9772 9799->9773 9799->9776 9799->9777 9799->9778 9799->9779 9799->9780 9799->9798 9801 e0ab68 NtSetInformationThread 9799->9801 9799->9803 10663 e0a958 9799->10663 9804 e1233e 9800->9804 9801->9799 9802->9803 9803->9642 9804->9803 10677 e1096c 9804->10677 9807 e11d28 2 API calls 9806->9807 9808 e11f02 9807->9808 9809 e11f27 9808->9809 9810 e11f06 9808->9810 9812 e09640 2 API calls 9809->9812 9811 e11f22 9810->9811 9813 e104b4 13 API calls 9810->9813 9811->9642 9814 e11f2c 9812->9814 9813->9811 9815 e11f30 9814->9815 9816 e11f3a 9814->9816 9818 e17034 126 API calls 9815->9818 10686 e0b4dc CheckTokenMembership 9816->10686 9819 e11f35 9818->9819 9819->9642 9820 e12056 9820->9642 9821 e11fb5 9825 e09c64 3 API calls 9821->9825 9828 e11ffe 9821->9828 9822 e11f3f 9822->9820 9822->9821 9824 e09c64 3 API calls 9822->9824 9824->9821 9825->9828 10687 e10e30 9828->10687 9831 e1202b 9831->9820 10735 e11170 9831->10735 9834 e08230 2 API calls 9835 e1204f 9834->9835 9836 e116ac 2 API calls 9835->9836 9836->9820 10774 e11be8 9837->10774 9840 e08230 2 API calls 9841 e173bf 9840->9841 9842 e0b674 NtQueryInformationToken 9841->9842 9845 e173d8 9842->9845 9843 e17450 9843->9642 9844 e09640 2 API calls 9846 e17430 9844->9846 9845->9843 9845->9844 9847 e104b4 13 API calls 9846->9847 9847->9843 9849 e13954 RtlAllocateHeap 9848->9849 9853 e16fb2 9849->9853 9850 e17021 9851 e1702f 9850->9851 9852 e0686c RtlFreeHeap 9850->9852 9863 e16bbc 9851->9863 9852->9851 9853->9850 9854 e16ff6 9853->9854 10787 e16490 9853->10787 10805 e13ea0 9854->10805 9860 e17017 9862 e13ea0 2 API calls 9860->9862 9862->9850 9864 e16bd0 9863->9864 9865 e16d9f 9863->9865 9866 e13954 RtlAllocateHeap 9864->9866 9865->9642 9871 e16be0 9866->9871 9867 e16d91 9867->9865 9870 e0686c RtlFreeHeap 9867->9870 9868 e16c86 9868->9867 9869 e0686c RtlFreeHeap 9868->9869 9869->9867 9870->9865 9871->9868 9872 e06844 RtlAllocateHeap 9871->9872 9873 e16ca8 9872->9873 9873->9868 11113 e16688 9873->11113 9876 e13954 RtlAllocateHeap 9875->9876 9879 e1391e 9876->9879 9877 e13950 9877->9642 9878 e13942 9878->9877 9880 e0686c RtlFreeHeap 9878->9880 9879->9878 11123 e13784 9879->11123 9880->9877 9883 e16dc4 9882->9883 9884 e06de8 RtlAllocateHeap 9883->9884 9885 e16ed5 9884->9885 9886 e06de8 RtlAllocateHeap 9885->9886 9895 e16ede 9885->9895 9887 e16eef 9886->9887 9892 e06de8 RtlAllocateHeap 9887->9892 9887->9895 9888 e16f7b 9890 e16f89 9888->9890 9893 e0686c RtlFreeHeap 9888->9893 9889 e0686c RtlFreeHeap 9889->9888 9891 e16f97 9890->9891 9894 e0686c RtlFreeHeap 9890->9894 9891->9672 9892->9895 9893->9890 9894->9891 9895->9888 9895->9889 9897 e104e9 9896->9897 9898 e06de8 RtlAllocateHeap 9897->9898 9899 e10562 9898->9899 9900 e06844 RtlAllocateHeap 9899->9900 9926 e1056b 9899->9926 9903 e10582 9900->9903 9901 e10930 9902 e1093e 9901->9902 9905 e0686c RtlFreeHeap 9901->9905 9906 e1094c 9902->9906 9908 e0686c RtlFreeHeap 9902->9908 9903->9926 11141 e10338 9903->11141 9904 e0686c RtlFreeHeap 9904->9901 9905->9902 9909 e1095a 9906->9909 9911 e0686c RtlFreeHeap 9906->9911 9908->9906 9909->9642 9910 e105b3 9912 e105d4 GetTempFileNameW CreateFileW 9910->9912 9910->9926 9911->9909 9913 e10619 WriteFile 9912->9913 9912->9926 9914 e10635 CreateProcessW 9913->9914 9913->9926 9916 e1069f NtQueryInformationProcess 9914->9916 9914->9926 9917 e106c3 NtReadVirtualMemory 9916->9917 9916->9926 9918 e106ea 9917->9918 9917->9926 9919 e06de8 RtlAllocateHeap 9918->9919 9920 e106f4 9919->9920 9921 e10758 NtProtectVirtualMemory 9920->9921 9920->9926 9922 e10784 NtWriteVirtualMemory 9921->9922 9921->9926 9923 e1079e 9922->9923 9922->9926 9924 e10829 CreateNamedPipeW 9923->9924 9923->9926 9925 e10895 ResumeThread ConnectNamedPipe 9924->9925 9924->9926 9925->9926 9926->9901 9926->9904 9928 e0a35b 9927->9928 9929 e0b3c0 NtSetInformationThread 9928->9929 9930 e0a375 9928->9930 9929->9930 9930->9678 9930->9680 9932 e06934 RtlAllocateHeap 9931->9932 9960 e12440 9932->9960 9933 e0a280 NtSetInformationThread 9933->9960 9934 e0a338 NtSetInformationThread 9934->9960 9935 e125bc 9936 e0686c RtlFreeHeap 9935->9936 9940 e124c6 9936->9940 9937 e124db 9938 e0686c RtlFreeHeap 9937->9938 9938->9940 9939 e125cf 9943 e125ee 9939->9943 9950 e125e4 9939->9950 9940->9642 9941 e124ee 9947 e0a3dc NtSetInformationThread 9941->9947 9942 e124be 9944 e0686c RtlFreeHeap 9942->9944 9946 e06984 RtlAllocateHeap 9943->9946 9944->9940 9945 e12512 9948 e12570 9945->9948 9949 e1257a 9945->9949 9951 e12647 9946->9951 9952 e12501 9947->9952 9953 e06984 RtlAllocateHeap 9948->9953 9954 e06a74 RtlAllocateHeap 9949->9954 9955 e0686c RtlFreeHeap 9950->9955 9956 e0686c RtlFreeHeap 9951->9956 9952->9945 9957 e12505 9952->9957 9958 e12578 9953->9958 9954->9958 9955->9940 9961 e12650 9956->9961 9962 e0686c RtlFreeHeap 9957->9962 9963 e0686c RtlFreeHeap 9958->9963 9959 e0ab68 NtSetInformationThread 9959->9960 9960->9933 9960->9934 9960->9935 9960->9937 9960->9939 9960->9940 9960->9941 9960->9942 9960->9943 9960->9945 9960->9959 9965 e0686c RtlFreeHeap 9960->9965 9961->9940 9964 e1096c 10 API calls 9961->9964 9962->9940 9966 e1258b 9963->9966 9964->9940 9965->9960 9966->9940 9967 e1096c 10 API calls 9966->9967 9967->9940 9970 e07fd5 9968->9970 9969 e0808e 9969->9691 9969->9693 9970->9969 9975 e068c0 9970->9975 9973 e0686c RtlFreeHeap 9972->9973 9974 e068fb 9973->9974 9974->9688 9976 e06844 RtlAllocateHeap 9975->9976 9977 e068d6 9976->9977 9977->9969 9979 e07cd2 9978->9979 9980 e07dda 9978->9980 9982 e06844 RtlAllocateHeap 9979->9982 9981 e07df7 9980->9981 9983 e0686c RtlFreeHeap 9980->9983 9981->9698 9984 e07d01 9982->9984 9983->9981 9984->9980 10155 e0dc60 9984->10155 9987 e068c0 RtlAllocateHeap 9986->9987 9988 e0b73c 9987->9988 9989 e0b742 NtSetInformationProcess NtSetInformationProcess NtSetInformationProcess 9988->9989 9990 e0b784 9988->9990 9991 e068ec RtlFreeHeap 9989->9991 9992 e0e1e8 9990->9992 9991->9990 9995 e0e1f5 9992->9995 9993 e0e25a 9993->9714 9993->9720 9998 e0a68c 9993->9998 9994 e0e22a CreateThread 9994->9995 10162 e0de78 SetThreadPriority 9994->10162 9995->9993 9995->9994 10159 e0b444 9995->10159 9997 e0e24b NtClose 9997->9995 9999 e0a6b3 GetVolumeNameForVolumeMountPointW 9998->9999 10001 e0a6f6 FindFirstVolumeW 9999->10001 10002 e0a947 10001->10002 10007 e0a712 10001->10007 10002->9732 10003 e0a72b GetVolumePathNamesForVolumeNameW 10003->10007 10004 e0a75c GetDriveTypeW 10004->10007 10005 e0a7fd CreateFileW 10006 e0a823 DeviceIoControl 10005->10006 10005->10007 10006->10007 10007->10002 10007->10003 10007->10004 10007->10005 10008 e0a600 GetLogicalDriveStringsW CreateThread ResumeThread GetExitCodeThread NtSetInformationThread 10007->10008 10008->10007 10010 e10a92 10009->10010 10013 e10b08 10010->10013 10015 e10b63 10010->10015 10170 e0b4dc CheckTokenMembership 10010->10170 10012 e10b0c 10012->9746 10013->10012 10171 e06984 10013->10171 10015->9746 10017 e10bf9 10016->10017 10175 e0a488 CreateThread 10017->10175 10019 e10c0b 10020 e06844 RtlAllocateHeap 10019->10020 10038 e10c11 10019->10038 10022 e10c23 10020->10022 10021 e10e0a 10024 e10e18 10021->10024 10026 e0686c RtlFreeHeap 10021->10026 10025 e0a488 5 API calls 10022->10025 10022->10038 10023 e0686c RtlFreeHeap 10023->10021 10027 e10e26 10024->10027 10028 e0686c RtlFreeHeap 10024->10028 10029 e10c40 10025->10029 10026->10024 10027->9720 10028->10027 10030 e06844 RtlAllocateHeap 10029->10030 10029->10038 10031 e10c5b 10030->10031 10032 e06844 RtlAllocateHeap 10031->10032 10031->10038 10039 e10c76 10032->10039 10034 e06984 RtlAllocateHeap 10035 e10cd2 CreateThread 10034->10035 10035->10039 10193 e0f308 GetFileAttributesW 10035->10193 10036 e06984 RtlAllocateHeap 10036->10039 10037 e0b3c0 NtSetInformationThread 10037->10039 10038->10021 10038->10023 10039->10034 10039->10036 10039->10037 10039->10038 10183 e0a1c0 CreateThread 10039->10183 10041 e0fcb4 10040->10041 10042 e06844 RtlAllocateHeap 10041->10042 10043 e0fcc1 10042->10043 10058 e0fcca 10043->10058 10355 e0f82c CoInitialize 10043->10355 10046 e0ffdb 10048 e0ffe9 10046->10048 10049 e0686c RtlFreeHeap 10046->10049 10047 e0686c RtlFreeHeap 10047->10046 10050 e0fff7 10048->10050 10052 e0686c RtlFreeHeap 10048->10052 10049->10048 10050->9721 10051 e06844 RtlAllocateHeap 10053 e0fcf7 10051->10053 10052->10050 10054 e06844 RtlAllocateHeap 10053->10054 10053->10058 10056 e0fd12 10054->10056 10055 e0f59c NtSetInformationThread 10055->10056 10056->10055 10056->10058 10059 e0686c RtlFreeHeap 10056->10059 10060 e0f6d8 NtSetInformationThread 10056->10060 10061 e0b3c0 NtSetInformationThread 10056->10061 10363 e069e0 10056->10363 10058->10046 10058->10047 10059->10056 10060->10056 10061->10056 10367 e0cedc 10062->10367 10064 e0da39 10071 e06de8 RtlAllocateHeap 10064->10071 10072 e0da42 10064->10072 10065 e0db6a 10067 e0db78 10065->10067 10068 e0686c RtlFreeHeap 10065->10068 10066 e0686c RtlFreeHeap 10066->10065 10069 e0db86 10067->10069 10070 e0686c RtlFreeHeap 10067->10070 10068->10067 10069->9727 10070->10069 10073 e0da8f 10071->10073 10072->10065 10072->10066 10073->10072 10074 e06844 RtlAllocateHeap 10073->10074 10075 e0dac5 10074->10075 10075->10072 10371 e0cfcc 10075->10371 10080 e09669 10077->10080 10078 e09735 10078->9754 10079 e0686c RtlFreeHeap 10079->10078 10082 e09698 10080->10082 10410 e0c8c4 10080->10410 10082->10078 10082->10079 10085 e09c96 10083->10085 10084 e09c9a 10084->9706 10085->10084 10416 e13954 10085->10416 10087 e0a04a 10088 e0a05e 10087->10088 10091 e0686c RtlFreeHeap 10087->10091 10092 e0a072 10088->10092 10093 e0686c RtlFreeHeap 10088->10093 10089 e09e11 10096 e0b674 NtQueryInformationToken 10089->10096 10103 e09e20 10089->10103 10090 e0686c RtlFreeHeap 10090->10087 10091->10088 10094 e0a086 10092->10094 10095 e0686c RtlFreeHeap 10092->10095 10093->10092 10094->9706 10095->10094 10097 e09ee2 10096->10097 10098 e06de8 RtlAllocateHeap 10097->10098 10097->10103 10099 e09f25 10098->10099 10100 e06de8 RtlAllocateHeap 10099->10100 10099->10103 10101 e09f45 10100->10101 10102 e06de8 RtlAllocateHeap 10101->10102 10101->10103 10102->10103 10103->10087 10103->10090 10105 e08971 10104->10105 10106 e0b3c0 NtSetInformationThread 10105->10106 10107 e08b6c 10105->10107 10106->10107 10107->9752 10109 e0828b 10108->10109 10113 e08290 10108->10113 10110 e08909 10109->10110 10111 e0686c RtlFreeHeap 10109->10111 10112 e0686c RtlFreeHeap 10110->10112 10114 e08917 10110->10114 10111->10110 10112->10114 10113->10109 10115 e06844 RtlAllocateHeap 10113->10115 10114->9752 10116 e083cf 10115->10116 10116->10109 10117 e08401 10116->10117 10118 e083e7 10116->10118 10119 e06de8 RtlAllocateHeap 10117->10119 10120 e06de8 RtlAllocateHeap 10118->10120 10121 e083f1 10119->10121 10120->10121 10121->10109 10122 e08434 10121->10122 10124 e08448 10121->10124 10123 e0686c RtlFreeHeap 10122->10123 10123->10109 10124->10109 10419 e06c98 10124->10419 10127 e06de8 RtlAllocateHeap 10126->10127 10129 e11967 10127->10129 10128 e11aa8 10131 e11ab6 10128->10131 10133 e0686c RtlFreeHeap 10128->10133 10140 e11970 10129->10140 10423 e118b8 10129->10423 10130 e0686c RtlFreeHeap 10130->10128 10134 e11ac4 10131->10134 10135 e0686c RtlFreeHeap 10131->10135 10133->10131 10143 e11d28 10134->10143 10135->10134 10136 e119a4 10137 e06934 RtlAllocateHeap 10136->10137 10136->10140 10138 e119bf 10137->10138 10139 e06de8 RtlAllocateHeap 10138->10139 10138->10140 10141 e11a25 10139->10141 10140->10128 10140->10130 10142 e0686c RtlFreeHeap 10141->10142 10142->10140 10144 e11e2c 10143->10144 10147 e11e5a 10144->10147 10426 e11c34 10144->10426 10146 e11eeb 10149 e116ac 10146->10149 10147->10146 10148 e0686c RtlFreeHeap 10147->10148 10148->10146 10150 e116c4 10149->10150 10151 e06de8 RtlAllocateHeap 10150->10151 10152 e116fe 10151->10152 10153 e11707 10152->10153 10154 e0686c RtlFreeHeap 10152->10154 10153->9744 10154->10153 10156 e0dcba 10155->10156 10157 e0dcd2 10156->10157 10158 e0dcbe NtTerminateProcess 10156->10158 10157->9984 10158->10157 10160 e0b458 NtSetInformationThread 10159->10160 10160->9997 10169 e0de8f 10162->10169 10163 e0def1 ReadFile 10163->10169 10164 e0e0aa WriteFile 10164->10169 10165 e0e150 NtClose 10165->10169 10166 e0dee2 10167 e0686c RtlFreeHeap 10167->10169 10168 e0e031 WriteFile 10168->10169 10169->10163 10169->10164 10169->10165 10169->10166 10169->10167 10169->10168 10170->10013 10172 e0699c 10171->10172 10173 e069b2 10172->10173 10174 e06844 RtlAllocateHeap 10172->10174 10173->10015 10174->10173 10176 e0a524 10175->10176 10177 e0a4c8 10175->10177 10191 e0a470 GetLogicalDriveStringsW 10175->10191 10176->10019 10178 e0a4fa ResumeThread 10177->10178 10179 e0b3c0 NtSetInformationThread 10177->10179 10180 e0a50e GetExitCodeThread 10178->10180 10181 e0a4d9 10179->10181 10180->10176 10181->10178 10182 e0a4dd 10181->10182 10182->10019 10184 e0a24f 10183->10184 10186 e0a1f3 10183->10186 10192 e0a1b0 GetDriveTypeW 10183->10192 10184->10039 10185 e0a225 ResumeThread 10189 e0a239 GetExitCodeThread 10185->10189 10186->10185 10187 e0b3c0 NtSetInformationThread 10186->10187 10188 e0a204 10187->10188 10188->10185 10190 e0a208 10188->10190 10189->10184 10190->10039 10194 e0f37f SetThreadPriority 10193->10194 10196 e0f321 10193->10196 10197 e0f38e 10194->10197 10195 e0f371 10198 e0686c RtlFreeHeap 10195->10198 10196->10195 10275 e0a094 FindFirstFileExW 10196->10275 10200 e06844 RtlAllocateHeap 10197->10200 10201 e0f379 10198->10201 10208 e0f3ad 10200->10208 10203 e0f34b 10204 e0c19c 10 API calls 10203->10204 10206 e0f355 10204->10206 10209 e0ef6c 14 API calls 10206->10209 10210 e0686c RtlFreeHeap 10208->10210 10213 e0686c RtlFreeHeap 10208->10213 10214 e0f54c 10208->10214 10215 e0f514 FindNextFileW 10208->10215 10219 e0f1c8 RtlAllocateHeap 10208->10219 10221 e0c19c 10208->10221 10240 e0f164 10208->10240 10244 e0ef6c 10208->10244 10211 e0f36b 10209->10211 10212 e0f3dd FindFirstFileExW 10210->10212 10212->10208 10213->10208 10216 e0686c RtlFreeHeap 10214->10216 10215->10208 10217 e0f52c FindClose 10215->10217 10218 e0f56f 10216->10218 10217->10208 10219->10208 10222 e0c1b8 10221->10222 10226 e0c1b3 10221->10226 10278 e06934 10222->10278 10225 e0c1d0 GetFileAttributesW 10227 e0c1e0 10225->10227 10226->10208 10228 e0c225 10227->10228 10229 e0c23e 10227->10229 10230 e0c28c 5 API calls 10228->10230 10231 e0c255 GetFileAttributesW 10229->10231 10232 e0c246 10229->10232 10235 e0c22d 10230->10235 10233 e0c262 10231->10233 10234 e0c26e CopyFileW 10231->10234 10282 e0c28c CreateFileW 10232->10282 10237 e0686c RtlFreeHeap 10233->10237 10238 e0686c RtlFreeHeap 10234->10238 10239 e0686c RtlFreeHeap 10235->10239 10237->10232 10238->10226 10239->10226 10241 e0f17c 10240->10241 10242 e06844 RtlAllocateHeap 10241->10242 10243 e0f192 10241->10243 10242->10243 10243->10208 10245 e0f155 10244->10245 10246 e0ef8d 10244->10246 10245->10208 10293 e0e3ac 10246->10293 10249 e0f14d 10250 e0686c RtlFreeHeap 10249->10250 10250->10245 10252 e0efa5 10252->10249 10253 e0efb9 10252->10253 10254 e0efcc 10252->10254 10330 e0ec00 10253->10330 10306 e0ece4 10254->10306 10257 e0efe7 MoveFileExW 10258 e0eff9 10257->10258 10263 e0efc7 10257->10263 10262 e0f051 CreateFileW 10258->10262 10271 e0f075 10258->10271 10259 e0f034 10261 e0686c RtlFreeHeap 10259->10261 10260 e0686c RtlFreeHeap 10260->10263 10261->10258 10264 e0f07a 10262->10264 10262->10271 10263->10249 10263->10257 10263->10258 10263->10259 10263->10260 10265 e0ece4 RtlAllocateHeap 10263->10265 10310 e0ed30 10264->10310 10265->10263 10266 e0686c RtlFreeHeap 10266->10249 10269 e0f0a3 CreateIoCompletionPort 10270 e0f0ba 10269->10270 10273 e0f0dc 10269->10273 10272 e0686c RtlFreeHeap 10270->10272 10271->10249 10271->10266 10272->10271 10273->10271 10274 e0686c RtlFreeHeap 10273->10274 10274->10271 10276 e0a0e5 10275->10276 10277 e0a0c5 FindClose 10275->10277 10276->10195 10276->10203 10277->10276 10279 e0694a 10278->10279 10280 e06961 10279->10280 10281 e06844 RtlAllocateHeap 10279->10281 10280->10225 10280->10226 10281->10280 10283 e0c3ed 10282->10283 10284 e0c2bd 10282->10284 10283->10226 10285 e0c2f5 WriteFile 10284->10285 10286 e0c31a 10285->10286 10287 e0c32c WriteFile 10285->10287 10286->10226 10288 e0c365 WriteFile 10287->10288 10291 e0c353 10287->10291 10289 e0c39c WriteFile 10288->10289 10292 e0c38a 10288->10292 10289->10284 10290 e0c3c3 10289->10290 10290->10226 10291->10226 10292->10226 10294 e0e3c5 SetFileAttributesW CreateFileW 10293->10294 10296 e0e40b 10294->10296 10297 e0e3f3 10294->10297 10296->10249 10298 e0e45c SetFileAttributesW CreateFileW 10296->10298 10297->10294 10297->10296 10334 e0de48 10297->10334 10299 e0e49c SetFilePointerEx 10298->10299 10300 e0e508 10298->10300 10299->10300 10301 e0e4bb ReadFile 10299->10301 10300->10252 10301->10300 10302 e0e4da 10301->10302 10303 e0e350 RtlAllocateHeap 10302->10303 10304 e0e4eb 10303->10304 10304->10300 10305 e0686c RtlFreeHeap 10304->10305 10305->10300 10307 e0ecf2 10306->10307 10308 e06934 RtlAllocateHeap 10307->10308 10309 e0ed01 10308->10309 10309->10263 10312 e0ed60 10310->10312 10311 e0ed91 10314 e06844 RtlAllocateHeap 10311->10314 10312->10311 10313 e0e2b8 2 API calls 10312->10313 10313->10311 10321 e0ed9d 10314->10321 10315 e0ef39 10317 e0ef47 10315->10317 10318 e0686c RtlFreeHeap 10315->10318 10316 e0686c RtlFreeHeap 10316->10315 10319 e0ef55 10317->10319 10320 e0686c RtlFreeHeap 10317->10320 10318->10317 10319->10269 10319->10271 10320->10319 10322 e06844 RtlAllocateHeap 10321->10322 10329 e0eee4 10321->10329 10323 e0edfa 10322->10323 10324 e06844 RtlAllocateHeap 10323->10324 10323->10329 10325 e0ee29 10324->10325 10326 e06844 RtlAllocateHeap 10325->10326 10325->10329 10327 e0eedb 10326->10327 10328 e0686c RtlFreeHeap 10327->10328 10327->10329 10328->10329 10329->10315 10329->10316 10331 e0ec0d 10330->10331 10332 e06934 RtlAllocateHeap 10331->10332 10333 e0ec19 10332->10333 10333->10263 10335 e0de53 10334->10335 10336 e0de60 10335->10336 10340 e0dce4 10335->10340 10338 e0de71 10336->10338 10339 e0de66 Sleep 10336->10339 10338->10297 10339->10338 10343 e0dd1b 10340->10343 10341 e0ddf0 10342 e0de3d 10341->10342 10344 e0686c RtlFreeHeap 10341->10344 10342->10336 10343->10341 10345 e06844 RtlAllocateHeap 10343->10345 10344->10342 10347 e0dd74 10345->10347 10346 e06894 RtlReAllocateHeap 10346->10347 10347->10341 10347->10346 10348 e0dd9d 10347->10348 10348->10341 10350 e0dc60 NtTerminateProcess 10348->10350 10351 e0db90 10348->10351 10350->10348 10353 e0dbb0 10351->10353 10352 e0dc2d 10352->10348 10353->10352 10354 e0dc60 NtTerminateProcess 10353->10354 10354->10352 10356 e0fc77 10355->10356 10360 e0f869 10355->10360 10356->10051 10356->10058 10357 e0fa12 CoUninitialize 10357->10356 10359 e0f8ee 10359->10357 10362 e06844 RtlAllocateHeap 10359->10362 10360->10359 10361 e06844 RtlAllocateHeap 10360->10361 10361->10360 10362->10359 10364 e069f9 10363->10364 10365 e06844 RtlAllocateHeap 10364->10365 10366 e06a19 10365->10366 10366->10056 10368 e0cef8 10367->10368 10369 e06844 RtlAllocateHeap 10368->10369 10370 e0cf7d 10368->10370 10369->10370 10370->10064 10372 e0d01f 10371->10372 10373 e0d024 10371->10373 10375 e0d45e 10372->10375 10376 e0686c RtlFreeHeap 10372->10376 10373->10372 10374 e06844 RtlAllocateHeap 10373->10374 10383 e0d065 10374->10383 10377 e0d46c 10375->10377 10378 e0686c RtlFreeHeap 10375->10378 10376->10375 10379 e0d47a 10377->10379 10381 e0686c RtlFreeHeap 10377->10381 10378->10377 10380 e0d488 10379->10380 10382 e0686c RtlFreeHeap 10379->10382 10384 e0686c RtlFreeHeap 10380->10384 10386 e0d496 10380->10386 10381->10379 10382->10380 10383->10372 10398 e0d67c 10383->10398 10384->10386 10385 e0d4a4 10385->10072 10386->10385 10388 e0686c RtlFreeHeap 10386->10388 10388->10385 10389 e0d08e 10389->10372 10402 e0d4b0 10389->10402 10391 e0d0a1 10391->10372 10406 e0d638 10391->10406 10394 e06de8 RtlAllocateHeap 10395 e0d0cc 10394->10395 10395->10372 10396 e06844 RtlAllocateHeap 10395->10396 10397 e0686c RtlFreeHeap 10395->10397 10396->10395 10397->10395 10399 e0d6a7 10398->10399 10400 e06844 RtlAllocateHeap 10399->10400 10401 e0d7a4 10400->10401 10401->10389 10403 e0d540 10402->10403 10404 e06844 RtlAllocateHeap 10403->10404 10405 e0d57e 10404->10405 10405->10391 10407 e0d657 10406->10407 10408 e06de8 RtlAllocateHeap 10407->10408 10409 e0d0b4 10408->10409 10409->10372 10409->10394 10411 e0c8e5 10410->10411 10412 e06844 RtlAllocateHeap 10411->10412 10414 e0c8f5 10412->10414 10413 e0c917 10413->10082 10414->10413 10415 e0686c RtlFreeHeap 10414->10415 10415->10413 10417 e06844 RtlAllocateHeap 10416->10417 10418 e1396b 10417->10418 10418->10089 10421 e06cbb 10419->10421 10420 e06d24 10420->10109 10421->10420 10422 e0686c RtlFreeHeap 10421->10422 10422->10420 10424 e06844 RtlAllocateHeap 10423->10424 10425 e118ce 10424->10425 10425->10136 10427 e06844 RtlAllocateHeap 10426->10427 10428 e11c4e 10427->10428 10428->10147 10430 e06de8 RtlAllocateHeap 10429->10430 10431 e0c080 10430->10431 10432 e0c16b 10431->10432 10434 e06844 RtlAllocateHeap 10431->10434 10433 e0c179 10432->10433 10436 e0686c RtlFreeHeap 10432->10436 10435 e0c187 10433->10435 10437 e0686c RtlFreeHeap 10433->10437 10440 e0c097 10434->10440 10438 e0c195 10435->10438 10439 e0686c RtlFreeHeap 10435->10439 10436->10433 10437->10435 10439->10438 10440->10432 10441 e0686c RtlFreeHeap 10440->10441 10442 e0c0c5 10441->10442 10443 e06844 RtlAllocateHeap 10442->10443 10444 e0c0d5 10443->10444 10444->10432 10445 e06ee4 2 API calls 10444->10445 10446 e0c0eb 10445->10446 10447 e0686c RtlFreeHeap 10446->10447 10448 e0c108 10447->10448 10497 e0bf94 10448->10497 10450 e0c14a 10453 e0bf94 8 API calls 10450->10453 10452 e0b3c0 NtSetInformationThread 10452->10450 10454 e0c155 10453->10454 10455 e0bf94 8 API calls 10454->10455 10456 e0c160 10455->10456 10457 e0bf94 8 API calls 10456->10457 10457->10432 10465 e07e60 10458->10465 10459 e06844 RtlAllocateHeap 10459->10465 10460 e07e72 NtQuerySystemInformation 10460->10465 10461 e06894 RtlReAllocateHeap 10461->10465 10462 e0686c RtlFreeHeap 10462->10465 10463 e0686c RtlFreeHeap 10464 e07f40 Sleep 10463->10464 10464->10465 10465->10459 10465->10460 10465->10461 10465->10462 10465->10463 10528 e091c8 10466->10528 10468 e0962d 10469 e0963c 10468->10469 10545 e090bc 10468->10545 10472 e097d8 4 API calls 10471->10472 10473 e08fa0 10472->10473 10474 e09010 10473->10474 10475 e09880 NtClose 10473->10475 10477 e09035 10474->10477 10570 e08ecc 10474->10570 10476 e08fae 10475->10476 10476->10474 10478 e08fb7 NtSetInformationThread 10476->10478 10478->10474 10480 e08fcb 10478->10480 10557 e08da8 10480->10557 10483 e09880 NtClose 10484 e08fee 10483->10484 10484->10474 10564 e08be0 10484->10564 10487 e074b3 10486->10487 10488 e0748b 10486->10488 10488->10487 10489 e07494 GetDriveTypeW 10488->10489 10573 e074bc 10488->10573 10489->10488 10492 e07c9f 10491->10492 10494 e07861 10491->10494 10495 e07b6a CoSetProxyBlanket 10494->10495 10496 e07ac6 CoUninitialize 10494->10496 10495->10496 10496->10492 10498 e0bfb9 10497->10498 10499 e0c04f 10498->10499 10500 e06844 RtlAllocateHeap 10498->10500 10501 e0c05d 10499->10501 10503 e0686c RtlFreeHeap 10499->10503 10502 e0bfcb 10500->10502 10501->10450 10501->10452 10502->10499 10506 e0bed0 10502->10506 10511 e0bc38 10502->10511 10503->10501 10507 e06934 RtlAllocateHeap 10506->10507 10510 e0beec 10507->10510 10508 e0bf8a 10508->10502 10509 e0686c RtlFreeHeap 10509->10508 10510->10508 10510->10509 10514 e0bc60 10511->10514 10512 e0bea1 DeleteDC 10513 e0beaa 10512->10513 10516 e0beb8 10513->10516 10517 e0686c RtlFreeHeap 10513->10517 10515 e06844 RtlAllocateHeap 10514->10515 10525 e0bc64 10514->10525 10518 e0bc8d 10515->10518 10516->10502 10517->10516 10519 e0bce0 CreateDCW 10518->10519 10518->10525 10520 e0bcfd 10519->10520 10519->10525 10521 e0bd9e StartDocW 10520->10521 10524 e0bdce 10521->10524 10521->10525 10522 e0bdec 10523 e0be6c EndDoc 10522->10523 10523->10525 10524->10522 10526 e0be18 DrawTextA 10524->10526 10525->10512 10525->10513 10527 e0be5a EndPage 10526->10527 10527->10523 10527->10524 10529 e092a9 10528->10529 10530 e0946d RegCreateKeyExW 10529->10530 10531 e094a1 RegEnumKeyW 10530->10531 10532 e094c7 RegCreateKeyExW 10530->10532 10531->10532 10536 e094cc RegCreateKeyExW 10531->10536 10535 e095e2 10532->10535 10541 e095bc RegEnumKeyW 10532->10541 10535->10468 10536->10531 10538 e094fa RegSetValueExW 10536->10538 10538->10531 10540 e0951c RegSetValueExW 10538->10540 10539 e095e4 OpenEventLogW 10539->10541 10542 e095fc ClearEventLogW 10539->10542 10540->10531 10543 e0953a OpenEventLogW 10540->10543 10541->10535 10541->10539 10542->10541 10543->10531 10544 e09552 ClearEventLogW 10543->10544 10544->10531 10552 e0903c RtlAdjustPrivilege 10545->10552 10547 e091b5 10547->10469 10548 e091ac CloseServiceHandle 10548->10547 10549 e09194 10549->10547 10549->10548 10550 e090d5 10550->10549 10551 e0dc60 NtTerminateProcess 10550->10551 10551->10549 10553 e097d8 4 API calls 10552->10553 10554 e09074 10553->10554 10555 e09082 10554->10555 10556 e09880 NtClose 10554->10556 10555->10550 10556->10555 10558 e097d8 4 API calls 10557->10558 10559 e08dd3 10558->10559 10560 e08de0 OpenSCManagerW 10559->10560 10561 e08e83 10559->10561 10560->10561 10563 e08df9 10560->10563 10561->10474 10561->10483 10562 e08e63 QueryServiceStatusEx 10562->10561 10562->10563 10563->10561 10563->10562 10565 e08c11 10564->10565 10567 e06844 RtlAllocateHeap 10565->10567 10569 e08c4d 10565->10569 10566 e08d9c 10566->10474 10567->10569 10568 e0686c RtlFreeHeap 10568->10566 10569->10566 10569->10568 10571 e097d8 4 API calls 10570->10571 10572 e08ee5 10571->10572 10572->10477 10581 e07590 10573->10581 10575 e07580 10575->10488 10576 e074d4 10576->10575 10577 e07506 FindFirstFileExW 10576->10577 10577->10575 10579 e0752e 10577->10579 10578 e0756c FindNextFileW 10578->10575 10578->10579 10579->10578 10587 e0766c 10579->10587 10582 e075b0 FindFirstFileExW 10581->10582 10584 e07662 10582->10584 10586 e0760e FindClose 10582->10586 10584->10576 10586->10584 10588 e0768e 10587->10588 10589 e07822 10588->10589 10590 e06844 RtlAllocateHeap 10588->10590 10589->10578 10594 e076a6 10590->10594 10591 e07814 10591->10589 10593 e0686c RtlFreeHeap 10591->10593 10592 e0686c RtlFreeHeap 10592->10591 10593->10589 10595 e076de FindFirstFileExW 10594->10595 10597 e077fd 10594->10597 10595->10597 10603 e07706 10595->10603 10596 e077e5 FindNextFileW 10596->10597 10596->10603 10597->10591 10597->10592 10598 e06844 RtlAllocateHeap 10598->10603 10599 e07780 GetFileAttributesW 10599->10603 10601 e0766c 11 API calls 10601->10603 10602 e0686c RtlFreeHeap 10602->10603 10603->10596 10603->10598 10603->10599 10603->10601 10603->10602 10604 e06668 10603->10604 10605 e0667e 10604->10605 10605->10605 10606 e0a094 2 API calls 10605->10606 10607 e06695 10606->10607 10608 e066a5 CreateFileW 10607->10608 10609 e067a5 10607->10609 10608->10609 10612 e066cd 10608->10612 10611 e067d4 NtFreeVirtualMemory 10609->10611 10613 e067f9 10609->10613 10610 e066d2 NtAllocateVirtualMemory 10610->10612 10619 e06703 10610->10619 10611->10609 10612->10610 10612->10619 10622 e06550 10613->10622 10616 e06763 WriteFile 10616->10619 10620 e0677d SetFilePointerEx 10616->10620 10617 e06821 10618 e06836 10617->10618 10621 e0686c RtlFreeHeap 10617->10621 10618->10603 10619->10609 10619->10616 10620->10616 10620->10619 10621->10618 10623 e06934 RtlAllocateHeap 10622->10623 10624 e0656a 10623->10624 10625 e06573 10624->10625 10626 e06934 RtlAllocateHeap 10624->10626 10627 e0661e DeleteFileW 10625->10627 10628 e0686c RtlFreeHeap 10625->10628 10629 e06582 10626->10629 10627->10617 10628->10627 10629->10625 10630 e065df MoveFileExW 10629->10630 10630->10625 10630->10629 10682 e0f59c 10631->10682 10634 e100a8 10643 e06844 RtlAllocateHeap 10634->10643 10652 e100d1 10634->10652 10635 e0f59c NtSetInformationThread 10637 e10080 10635->10637 10636 e10313 10639 e0686c RtlFreeHeap 10636->10639 10641 e10321 10636->10641 10637->10634 10640 e0f59c NtSetInformationThread 10637->10640 10638 e0686c RtlFreeHeap 10638->10636 10639->10641 10640->10634 10642 e1032f 10641->10642 10644 e0686c RtlFreeHeap 10641->10644 10642->9642 10645 e100c8 10643->10645 10644->10642 10646 e06844 RtlAllocateHeap 10645->10646 10645->10652 10647 e100e3 10646->10647 10648 e0e1e8 9 API calls 10647->10648 10647->10652 10656 e100f6 10648->10656 10649 e069e0 RtlAllocateHeap 10649->10656 10650 e1028d 10651 e0686c RtlFreeHeap 10650->10651 10650->10652 10651->10652 10652->10636 10652->10638 10653 e0f6d8 NtSetInformationThread 10653->10656 10654 e0b3c0 NtSetInformationThread 10654->10656 10655 e0686c RtlFreeHeap 10655->10656 10656->10649 10656->10650 10656->10653 10656->10654 10656->10655 10658 e07433 10657->10658 10659 e06934 RtlAllocateHeap 10658->10659 10661 e07441 10659->10661 10660 e07464 10660->9799 10661->10660 10662 e0686c RtlFreeHeap 10661->10662 10662->10660 10664 e0a983 10663->10664 10665 e0a488 5 API calls 10664->10665 10667 e0a99a 10665->10667 10666 e0a9c9 10666->9799 10667->10666 10668 e06844 RtlAllocateHeap 10667->10668 10668->10666 10670 e0a3ff 10669->10670 10671 e0b3c0 NtSetInformationThread 10670->10671 10672 e0a419 10670->10672 10671->10672 10672->9779 10672->9793 10674 e06a8d 10673->10674 10675 e06844 RtlAllocateHeap 10674->10675 10676 e06aa3 10674->10676 10675->10676 10676->9795 10678 e0e1e8 9 API calls 10677->10678 10680 e10977 10678->10680 10679 e109c8 10679->9803 10680->10679 10681 e0b3c0 NtSetInformationThread 10680->10681 10681->10679 10683 e0f5f6 10682->10683 10684 e0b3c0 NtSetInformationThread 10683->10684 10685 e0f610 10683->10685 10684->10685 10685->10634 10685->10635 10686->9822 10688 e10e48 10687->10688 10689 e10e8d 10687->10689 10690 e0c8c4 2 API calls 10688->10690 10689->9820 10693 e11400 10689->10693 10692 e10e4d 10690->10692 10691 e0686c RtlFreeHeap 10691->10689 10692->10689 10692->10691 10745 e11240 10693->10745 10695 e11441 10696 e06de8 RtlAllocateHeap 10695->10696 10721 e11445 10695->10721 10704 e11454 10696->10704 10697 e115e0 10698 e115ee 10697->10698 10700 e0686c RtlFreeHeap 10697->10700 10701 e115fc 10698->10701 10702 e0686c RtlFreeHeap 10698->10702 10699 e0686c RtlFreeHeap 10699->10697 10700->10698 10703 e1160a 10701->10703 10705 e0686c RtlFreeHeap 10701->10705 10702->10701 10703->9820 10722 e11760 10703->10722 10704->10721 10767 e11611 10704->10767 10705->10703 10708 e06de8 RtlAllocateHeap 10709 e1149b 10708->10709 10710 e11611 RtlFreeHeap 10709->10710 10709->10721 10711 e114d4 10710->10711 10712 e06de8 RtlAllocateHeap 10711->10712 10713 e114de 10712->10713 10714 e11611 RtlFreeHeap 10713->10714 10713->10721 10715 e11521 10714->10715 10716 e06de8 RtlAllocateHeap 10715->10716 10717 e1152b 10716->10717 10718 e11611 RtlFreeHeap 10717->10718 10717->10721 10719 e1156b 10718->10719 10720 e06de8 RtlAllocateHeap 10719->10720 10720->10721 10721->10697 10721->10699 10723 e06de8 RtlAllocateHeap 10722->10723 10727 e11791 10723->10727 10724 e11890 10726 e1189e 10724->10726 10728 e0686c RtlFreeHeap 10724->10728 10725 e0686c RtlFreeHeap 10725->10724 10726->9831 10729 e118b8 RtlAllocateHeap 10727->10729 10732 e1179a 10727->10732 10728->10726 10730 e117ce 10729->10730 10731 e06de8 RtlAllocateHeap 10730->10731 10730->10732 10733 e11809 10731->10733 10732->10724 10732->10725 10734 e0686c RtlFreeHeap 10733->10734 10734->10732 10736 e11190 10735->10736 10737 e06de8 RtlAllocateHeap 10736->10737 10744 e11195 10736->10744 10742 e111a1 10737->10742 10738 e11219 10740 e11227 10738->10740 10741 e0686c RtlFreeHeap 10738->10741 10739 e0686c RtlFreeHeap 10739->10738 10740->9834 10741->10740 10743 e06de8 RtlAllocateHeap 10742->10743 10742->10744 10743->10744 10744->10738 10744->10739 10746 e1126f 10745->10746 10748 e11282 10745->10748 10747 e06de8 RtlAllocateHeap 10746->10747 10746->10748 10749 e1128d 10747->10749 10759 e1130f 10748->10759 10771 e110cc 10748->10771 10749->10748 10750 e06de8 RtlAllocateHeap 10749->10750 10752 e112a5 10750->10752 10752->10748 10754 e112b4 10752->10754 10753 e11336 10755 e06934 RtlAllocateHeap 10753->10755 10756 e06de8 RtlAllocateHeap 10754->10756 10757 e11345 10755->10757 10758 e112bd 10756->10758 10757->10759 10760 e06934 RtlAllocateHeap 10757->10760 10758->10695 10759->10695 10761 e11377 10760->10761 10761->10759 10762 e113bd 10761->10762 10763 e0686c RtlFreeHeap 10761->10763 10764 e113cb 10762->10764 10765 e0686c RtlFreeHeap 10762->10765 10763->10762 10764->10759 10766 e0686c RtlFreeHeap 10764->10766 10765->10764 10766->10759 10768 e11617 10767->10768 10769 e11491 10767->10769 10770 e0686c RtlFreeHeap 10768->10770 10769->10708 10770->10769 10772 e06844 RtlAllocateHeap 10771->10772 10773 e110e2 10772->10773 10773->10753 10775 e11bef 10774->10775 10778 e11b50 10775->10778 10777 e11c07 10777->9840 10779 e06844 RtlAllocateHeap 10778->10779 10780 e11b67 10779->10780 10781 e11b9d 10780->10781 10782 e06894 RtlReAllocateHeap 10780->10782 10784 e11b80 10780->10784 10783 e0686c RtlFreeHeap 10781->10783 10782->10780 10783->10784 10784->10777 10785 e0686c RtlFreeHeap 10784->10785 10786 e11be0 10785->10786 10786->10777 10790 e164b6 10787->10790 10788 e165f0 10788->9854 10789 e0686c RtlFreeHeap 10789->10788 10804 e164ce 10790->10804 10839 e16124 10790->10839 10804->10788 10804->10789 10806 e13fa4 10805->10806 10809 e13fd5 10806->10809 11100 e13d98 10806->11100 10808 e14066 10808->9850 10811 e14508 10808->10811 10809->10808 10810 e0686c RtlFreeHeap 10809->10810 10810->10808 10812 e1452e 10811->10812 10830 e14532 10812->10830 11103 e12af8 10812->11103 10814 e14684 10818 e14692 10814->10818 10821 e0686c RtlFreeHeap 10814->10821 10816 e06844 RtlAllocateHeap 10819 e14553 10816->10819 10817 e0686c RtlFreeHeap 10817->10814 10820 e146a0 10818->10820 10822 e0686c RtlFreeHeap 10818->10822 10823 e09640 2 API calls 10819->10823 10819->10830 10820->9860 10831 e146a8 10820->10831 10821->10818 10822->10820 10824 e14566 10823->10824 10825 e0f82c 3 API calls 10824->10825 10826 e1457f 10825->10826 10827 e06844 RtlAllocateHeap 10826->10827 10826->10830 10828 e1459d 10827->10828 10829 e06844 RtlAllocateHeap 10828->10829 10828->10830 10829->10830 10830->10814 10830->10817 10832 e146b9 10831->10832 10833 e148ba 10832->10833 10834 e09640 2 API calls 10832->10834 10833->9860 10835 e146c7 10834->10835 10835->10833 10836 e06de8 RtlAllocateHeap 10835->10836 10838 e146e1 10836->10838 10837 e0686c RtlFreeHeap 10837->10833 10838->10833 10838->10837 11071 e160a8 10839->11071 10841 e1616c 10842 e16450 10841->10842 10843 e0686c RtlFreeHeap 10841->10843 10844 e1645e 10842->10844 10845 e0686c RtlFreeHeap 10842->10845 10843->10842 10846 e1646c 10844->10846 10848 e0686c RtlFreeHeap 10844->10848 10845->10844 10849 e1647a 10846->10849 10850 e0686c RtlFreeHeap 10846->10850 10848->10846 10851 e16488 10849->10851 10853 e0686c RtlFreeHeap 10849->10853 10850->10849 10851->10804 10862 e15d28 10851->10862 10852 e06844 RtlAllocateHeap 10854 e161a8 10852->10854 10853->10851 10854->10841 10855 e06844 RtlAllocateHeap 10854->10855 10856 e16249 10855->10856 10856->10841 10857 e06844 RtlAllocateHeap 10856->10857 10858 e16299 10857->10858 10858->10841 10859 e06844 RtlAllocateHeap 10858->10859 10860 e16344 10859->10860 10860->10841 10861 e0686c RtlFreeHeap 10860->10861 10861->10841 10863 e15d8f 10862->10863 10864 e06de8 RtlAllocateHeap 10863->10864 10871 e15da4 10863->10871 10869 e15e1b 10864->10869 10865 e1608f 10867 e1609d 10865->10867 10868 e0686c RtlFreeHeap 10865->10868 10866 e0686c RtlFreeHeap 10866->10865 10867->10804 10872 e14c60 10867->10872 10868->10867 10870 e06de8 RtlAllocateHeap 10869->10870 10869->10871 10870->10871 10871->10865 10871->10866 10873 e06844 RtlAllocateHeap 10872->10873 10878 e14c93 10873->10878 10874 e14c9c 10875 e14e1b 10874->10875 10876 e0686c RtlFreeHeap 10874->10876 10877 e14e29 10875->10877 10880 e0686c RtlFreeHeap 10875->10880 10876->10875 10881 e14e37 10877->10881 10882 e0686c RtlFreeHeap 10877->10882 10878->10874 10879 e06844 RtlAllocateHeap 10878->10879 10883 e14cc6 10879->10883 10880->10877 10881->10804 10885 e15a84 10881->10885 10882->10881 10883->10874 10884 e06844 RtlAllocateHeap 10883->10884 10884->10874 10886 e06844 RtlAllocateHeap 10885->10886 10888 e15add 10886->10888 10887 e15caa 10890 e15cb8 10887->10890 10892 e0686c RtlFreeHeap 10887->10892 10921 e15ae6 10888->10921 11077 e1497c 10888->11077 10889 e0686c RtlFreeHeap 10889->10887 10893 e15cc6 10890->10893 10894 e0686c RtlFreeHeap 10890->10894 10892->10890 10895 e15cd4 10893->10895 10897 e0686c RtlFreeHeap 10893->10897 10894->10893 10896 e15ce2 10895->10896 10898 e0686c RtlFreeHeap 10895->10898 10899 e15cf0 10896->10899 10900 e0686c RtlFreeHeap 10896->10900 10897->10895 10898->10896 10901 e15cfe 10899->10901 10902 e0686c RtlFreeHeap 10899->10902 10900->10899 10903 e15d0c 10901->10903 10905 e0686c RtlFreeHeap 10901->10905 10902->10901 10903->10804 10924 e157b4 10903->10924 10904 e15b0e 10904->10921 11080 e14a30 10904->11080 10905->10903 10907 e15b3a 10908 e0686c RtlFreeHeap 10907->10908 10907->10921 10909 e15b5c 10908->10909 10910 e14a30 RtlAllocateHeap 10909->10910 10911 e15b75 10910->10911 10911->10921 11083 e14aa8 10911->11083 10913 e15bbd 10913->10921 11086 e14c08 10913->11086 10916 e06844 RtlAllocateHeap 10917 e15bf2 10916->10917 10918 e06de8 RtlAllocateHeap 10917->10918 10917->10921 10919 e15c0a 10918->10919 10920 e06844 RtlAllocateHeap 10919->10920 10919->10921 10922 e15c33 10920->10922 10921->10887 10921->10889 10922->10921 10923 e0686c RtlFreeHeap 10922->10923 10923->10922 10925 e06844 RtlAllocateHeap 10924->10925 10926 e157fc 10925->10926 10927 e06844 RtlAllocateHeap 10926->10927 10948 e15805 10926->10948 10938 e15814 10927->10938 10928 e15a22 10930 e15a30 10928->10930 10931 e0686c RtlFreeHeap 10928->10931 10929 e0686c RtlFreeHeap 10929->10928 10932 e15a3e 10930->10932 10933 e0686c RtlFreeHeap 10930->10933 10931->10930 10934 e15a4c 10932->10934 10935 e0686c RtlFreeHeap 10932->10935 10933->10932 10936 e15a5a 10934->10936 10937 e0686c RtlFreeHeap 10934->10937 10935->10934 10936->10804 10949 e14e50 10936->10949 10937->10936 10939 e06844 RtlAllocateHeap 10938->10939 10938->10948 10940 e15943 10939->10940 10941 e06de8 RtlAllocateHeap 10940->10941 10940->10948 10942 e1595b 10941->10942 10943 e0686c RtlFreeHeap 10942->10943 10942->10948 10944 e159a4 10943->10944 10945 e06844 RtlAllocateHeap 10944->10945 10946 e159bd 10945->10946 10947 e06de8 RtlAllocateHeap 10946->10947 10946->10948 10947->10948 10948->10928 10948->10929 10950 e06844 RtlAllocateHeap 10949->10950 10954 e14e98 10950->10954 10951 e15065 10953 e15073 10951->10953 10955 e0686c RtlFreeHeap 10951->10955 10952 e0686c RtlFreeHeap 10952->10951 10956 e15081 10953->10956 10958 e0686c RtlFreeHeap 10953->10958 10957 e1497c RtlAllocateHeap 10954->10957 10985 e14ea1 10954->10985 10955->10953 10959 e1508f 10956->10959 10960 e0686c RtlFreeHeap 10956->10960 10968 e14ec9 10957->10968 10958->10956 10961 e1509d 10959->10961 10962 e0686c RtlFreeHeap 10959->10962 10960->10959 10963 e150ab 10961->10963 10964 e0686c RtlFreeHeap 10961->10964 10962->10961 10965 e150b9 10963->10965 10966 e0686c RtlFreeHeap 10963->10966 10964->10963 10967 e150c7 10965->10967 10969 e0686c RtlFreeHeap 10965->10969 10966->10965 10967->10804 10988 e150e0 10967->10988 10968->10985 11091 e14920 10968->11091 10969->10967 10971 e14ef5 10972 e0686c RtlFreeHeap 10971->10972 10971->10985 10973 e14f17 10972->10973 10974 e14920 RtlAllocateHeap 10973->10974 10975 e14f30 10974->10975 10976 e14aa8 RtlAllocateHeap 10975->10976 10975->10985 10977 e14f78 10976->10977 10978 e14c08 RtlAllocateHeap 10977->10978 10977->10985 10979 e14f8d 10978->10979 10980 e06844 RtlAllocateHeap 10979->10980 10979->10985 10981 e14fad 10980->10981 10982 e06de8 RtlAllocateHeap 10981->10982 10981->10985 10983 e14fc5 10982->10983 10984 e06844 RtlAllocateHeap 10983->10984 10983->10985 10986 e14fee 10984->10986 10985->10951 10985->10952 10986->10985 10987 e0686c RtlFreeHeap 10986->10987 10987->10986 10989 e06844 RtlAllocateHeap 10988->10989 11011 e15143 10989->11011 10990 e1514c 10991 e1571b 10990->10991 10992 e0686c RtlFreeHeap 10990->10992 10993 e15729 10991->10993 10994 e0686c RtlFreeHeap 10991->10994 10992->10991 10995 e15737 10993->10995 10997 e0686c RtlFreeHeap 10993->10997 10994->10993 10996 e15745 10995->10996 10998 e0686c RtlFreeHeap 10995->10998 10999 e15753 10996->10999 11000 e0686c RtlFreeHeap 10996->11000 10997->10995 10998->10996 11001 e15761 10999->11001 11002 e0686c RtlFreeHeap 10999->11002 11000->10999 11003 e1576f 11001->11003 11004 e0686c RtlFreeHeap 11001->11004 11002->11001 11005 e1577d 11003->11005 11006 e0686c RtlFreeHeap 11003->11006 11004->11003 11007 e1578b 11005->11007 11008 e0686c RtlFreeHeap 11005->11008 11006->11005 11009 e15799 11007->11009 11010 e0686c RtlFreeHeap 11007->11010 11008->11007 11009->10804 11010->11009 11011->10990 11012 e06844 RtlAllocateHeap 11011->11012 11013 e151ff 11012->11013 11013->10990 11014 e1497c RtlAllocateHeap 11013->11014 11015 e15230 11014->11015 11015->10990 11094 e148c4 11015->11094 11017 e1525c 11017->10990 11018 e0686c RtlFreeHeap 11017->11018 11019 e1527e 11018->11019 11020 e148c4 RtlAllocateHeap 11019->11020 11021 e15297 11020->11021 11021->10990 11022 e14aa8 RtlAllocateHeap 11021->11022 11023 e152df 11022->11023 11023->10990 11024 e14c08 RtlAllocateHeap 11023->11024 11025 e152f4 11024->11025 11025->10990 11026 e06844 RtlAllocateHeap 11025->11026 11027 e1533d 11026->11027 11027->10990 11028 e06de8 RtlAllocateHeap 11027->11028 11029 e15355 11028->11029 11029->10990 11030 e06844 RtlAllocateHeap 11029->11030 11031 e15381 11030->11031 11031->10990 11032 e0686c RtlFreeHeap 11031->11032 11033 e15427 11032->11033 11034 e15435 11033->11034 11035 e0686c RtlFreeHeap 11033->11035 11036 e1544a 11034->11036 11037 e0686c RtlFreeHeap 11034->11037 11035->11034 11038 e1545f 11036->11038 11040 e0686c RtlFreeHeap 11036->11040 11037->11036 11039 e15474 11038->11039 11041 e0686c RtlFreeHeap 11038->11041 11042 e15489 11039->11042 11043 e0686c RtlFreeHeap 11039->11043 11040->11038 11041->11039 11044 e1549e 11042->11044 11045 e0686c RtlFreeHeap 11042->11045 11043->11042 11046 e154b3 11044->11046 11048 e0686c RtlFreeHeap 11044->11048 11045->11044 11047 e154c8 11046->11047 11049 e0686c RtlFreeHeap 11046->11049 11050 e06844 RtlAllocateHeap 11047->11050 11048->11046 11049->11047 11051 e154ef 11050->11051 11051->10990 11052 e1497c RtlAllocateHeap 11051->11052 11053 e15520 11052->11053 11053->10990 11097 e149c0 11053->11097 11055 e1554c 11055->10990 11056 e0686c RtlFreeHeap 11055->11056 11057 e15579 11056->11057 11058 e149c0 RtlAllocateHeap 11057->11058 11059 e15587 11058->11059 11059->10990 11060 e14aa8 RtlAllocateHeap 11059->11060 11061 e155cf 11060->11061 11061->10990 11062 e14c08 RtlAllocateHeap 11061->11062 11063 e155e4 11062->11063 11063->10990 11064 e06844 RtlAllocateHeap 11063->11064 11065 e1565b 11064->11065 11065->10990 11066 e06de8 RtlAllocateHeap 11065->11066 11067 e15673 11066->11067 11067->10990 11068 e06844 RtlAllocateHeap 11067->11068 11069 e1569c 11068->11069 11069->10990 11070 e0686c RtlFreeHeap 11069->11070 11070->10990 11072 e160c8 11071->11072 11073 e16108 11072->11073 11074 e06934 RtlAllocateHeap 11072->11074 11073->10841 11073->10852 11075 e160f1 11074->11075 11075->11073 11076 e06934 RtlAllocateHeap 11075->11076 11076->11073 11078 e06844 RtlAllocateHeap 11077->11078 11079 e14985 11078->11079 11079->10904 11081 e06844 RtlAllocateHeap 11080->11081 11082 e14a3c 11081->11082 11082->10907 11084 e06844 RtlAllocateHeap 11083->11084 11085 e14ab8 11084->11085 11085->10913 11087 e06844 RtlAllocateHeap 11086->11087 11088 e14c27 11087->11088 11089 e06844 RtlAllocateHeap 11088->11089 11090 e14c54 11088->11090 11089->11088 11090->10916 11090->10921 11092 e06844 RtlAllocateHeap 11091->11092 11093 e1492c 11092->11093 11093->10971 11095 e06844 RtlAllocateHeap 11094->11095 11096 e148d0 11095->11096 11096->11017 11098 e06844 RtlAllocateHeap 11097->11098 11099 e149cc 11098->11099 11099->11055 11101 e06844 RtlAllocateHeap 11100->11101 11102 e13db2 11101->11102 11102->10809 11106 e12b21 11103->11106 11104 e12b25 11104->10816 11106->11104 11107 e12954 11106->11107 11108 e1297b 11107->11108 11109 e097d8 4 API calls 11108->11109 11110 e1298b 11109->11110 11111 e097d8 4 API calls 11110->11111 11112 e1299f 11110->11112 11111->11112 11112->11104 11118 e166b6 11113->11118 11114 e16ba4 11115 e16bb2 11114->11115 11117 e0686c RtlFreeHeap 11114->11117 11115->9868 11116 e0686c RtlFreeHeap 11116->11114 11117->11115 11119 e06de8 RtlAllocateHeap 11118->11119 11122 e16714 11118->11122 11120 e167ec 11119->11120 11121 e06844 RtlAllocateHeap 11120->11121 11120->11122 11121->11122 11122->11114 11122->11116 11124 e137a7 11123->11124 11125 e12af8 4 API calls 11124->11125 11140 e137ab 11124->11140 11127 e137c2 11125->11127 11126 e138e9 11129 e138f7 11126->11129 11131 e0686c RtlFreeHeap 11126->11131 11130 e06844 RtlAllocateHeap 11127->11130 11128 e0686c RtlFreeHeap 11128->11126 11132 e13905 11129->11132 11134 e0686c RtlFreeHeap 11129->11134 11133 e137cc 11130->11133 11131->11129 11132->9878 11135 e0f82c 3 API calls 11133->11135 11133->11140 11134->11132 11136 e137e4 11135->11136 11137 e06844 RtlAllocateHeap 11136->11137 11136->11140 11138 e13802 11137->11138 11139 e06844 RtlAllocateHeap 11138->11139 11138->11140 11139->11140 11140->11126 11140->11128 11142 e10350 11141->11142 11143 e06844 RtlAllocateHeap 11142->11143 11144 e10371 11143->11144 11144->9910 11294 e0fedb 11305 e0fd52 11294->11305 11295 e069e0 RtlAllocateHeap 11295->11305 11296 e0686c RtlFreeHeap 11296->11305 11297 e0f59c NtSetInformationThread 11297->11305 11298 e0ff71 11299 e0ffdb 11298->11299 11300 e0686c RtlFreeHeap 11298->11300 11301 e0ffe9 11299->11301 11302 e0686c RtlFreeHeap 11299->11302 11300->11299 11303 e0fff7 11301->11303 11304 e0686c RtlFreeHeap 11301->11304 11302->11301 11304->11303 11305->11295 11305->11296 11305->11297 11305->11298 11306 e0f6d8 NtSetInformationThread 11305->11306 11307 e0b3c0 NtSetInformationThread 11305->11307 11306->11305 11307->11305 11145 e0639c 11196 e05aec 11145->11196 11148 e063b6 RtlCreateHeap 11149 e0654d 11148->11149 11150 e063d1 11148->11150 11151 e05aec 3 API calls 11150->11151 11152 e063ed 11151->11152 11152->11149 11204 e05da0 11152->11204 11155 e05da0 8 API calls 11156 e06419 11155->11156 11157 e05da0 8 API calls 11156->11157 11158 e0642a 11157->11158 11159 e05da0 8 API calls 11158->11159 11160 e0643b 11159->11160 11161 e05da0 8 API calls 11160->11161 11162 e0644c 11161->11162 11163 e05da0 8 API calls 11162->11163 11164 e0645d 11163->11164 11165 e05da0 8 API calls 11164->11165 11166 e0646e 11165->11166 11167 e05da0 8 API calls 11166->11167 11168 e0647f 11167->11168 11169 e05da0 8 API calls 11168->11169 11170 e06490 11169->11170 11171 e05da0 8 API calls 11170->11171 11172 e064a1 11171->11172 11173 e05da0 8 API calls 11172->11173 11174 e064b2 11173->11174 11175 e05da0 8 API calls 11174->11175 11176 e064c3 11175->11176 11177 e05da0 8 API calls 11176->11177 11178 e064d4 11177->11178 11179 e05da0 8 API calls 11178->11179 11180 e064e5 11179->11180 11181 e05da0 8 API calls 11180->11181 11182 e064f6 11181->11182 11183 e05da0 8 API calls 11182->11183 11184 e06507 11183->11184 11185 e05da0 8 API calls 11184->11185 11186 e06518 11185->11186 11187 e05da0 8 API calls 11186->11187 11188 e06529 11187->11188 11189 e05da0 8 API calls 11188->11189 11190 e0653a 11189->11190 11191 e0b444 NtSetInformationThread 11190->11191 11192 e06541 11191->11192 11210 e17738 11192->11210 11197 e05b18 11196->11197 11198 e05afe 11196->11198 11200 e05b40 11197->11200 11201 e05aec 3 API calls 11197->11201 11199 e05aec 3 API calls 11198->11199 11199->11197 11202 e05c0a 11200->11202 11221 e05a84 11200->11221 11201->11200 11202->11148 11202->11149 11236 e05c24 11204->11236 11206 e05dcb 11206->11155 11207 e05aec 3 API calls 11208 e05ddb RtlAllocateHeap 11207->11208 11209 e05db5 11208->11209 11209->11206 11209->11207 11211 e17754 11210->11211 11212 e06844 RtlAllocateHeap 11211->11212 11214 e17764 11212->11214 11213 e06548 11216 e0b470 11213->11216 11214->11213 11215 e0686c RtlFreeHeap 11214->11215 11215->11213 11217 e05aec 3 API calls 11216->11217 11218 e0b495 11217->11218 11219 e0b4bb 11218->11219 11220 e0b49e NtProtectVirtualMemory 11218->11220 11219->11149 11220->11219 11222 e05ab0 11221->11222 11223 e05ae2 11221->11223 11222->11223 11228 e05a20 11222->11228 11223->11200 11225 e05ac4 11225->11223 11226 e05ad8 11225->11226 11231 e059d4 11226->11231 11229 e05a37 11228->11229 11230 e05a65 LdrLoadDll 11229->11230 11230->11225 11232 e059e3 11231->11232 11233 e05a04 LdrGetProcedureAddress 11231->11233 11235 e059ef LdrGetProcedureAddress 11232->11235 11234 e05a16 11233->11234 11234->11223 11235->11234 11237 e05c51 11236->11237 11238 e05c37 11236->11238 11240 e05c79 11237->11240 11241 e05aec 3 API calls 11237->11241 11239 e05aec 3 API calls 11238->11239 11239->11237 11242 e05aec 3 API calls 11240->11242 11245 e05ca1 11240->11245 11241->11240 11242->11245 11243 e05ce9 FindFirstFileW 11243->11245 11244 e05d5a 11244->11209 11245->11243 11245->11244 11246 e05d37 FindNextFileW 11245->11246 11247 e05d19 FindClose 11245->11247 11246->11245 11249 e05d4b FindClose 11246->11249 11248 e05a20 LdrLoadDll 11247->11248 11250 e05d30 11248->11250 11249->11245 11250->11209

                                        Executed Functions

                                        Function 00E104B4 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 342COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 0 e104b4-e10569 call e0164c call e06de8 9 e10570-e10589 call e06844 0->9 10 e1056b 0->10 18 e10590-e105a3 call e18c34 9->18 19 e1058b 9->19 11 e108e9-e108f0 10->11 13 e108f2 11->13 14 e108fe-e10905 11->14 13->14 16 e10913-e10917 14->16 17 e10907 14->17 21 e10922-e10926 16->21 22 e10919 16->22 17->16 28 e105a5 18->28 29 e105aa-e105ba call e10338 18->29 19->11 24 e10930-e10934 21->24 25 e10928-e1092b call e0686c 21->25 22->21 26 e10936-e10939 call e0686c 24->26 27 e1093e-e10942 24->27 25->24 26->27 32 e10944-e10947 call e0686c 27->32 33 e1094c-e10950 27->33 28->11 39 e105c1-e10612 GetTempFileNameW CreateFileW 29->39 40 e105bc 29->40 32->33 36 e10952-e10955 call e0686c 33->36 37 e1095a-e10960 33->37 36->37 43 e10614 39->43 44 e10619-e1062e WriteFile 39->44 40->11 43->11 45 e10630 44->45 46 e10635-e1064e 44->46 45->11 48 e10650-e10655 46->48 49 e10657-e10698 CreateProcessW 48->49 50 e10659-e1065b 48->50 52 e1069a 49->52 53 e1069f-e106bc NtQueryInformationProcess 49->53 50->48 52->11 54 e106c3-e106e3 NtReadVirtualMemory 53->54 55 e106be 53->55 56 e106e5 54->56 57 e106ea-e106fb call e06de8 54->57 55->11 56->11 60 e10702-e1077d call e192f4 call e19348 call e1941c NtProtectVirtualMemory 57->60 61 e106fd 57->61 68 e10784-e10797 NtWriteVirtualMemory 60->68 69 e1077f 60->69 61->11 70 e10799 68->70 71 e1079e-e107fa 68->71 69->11 70->11 73 e10801-e10822 71->73 74 e107fc 71->74 76 e10824 73->76 77 e10829-e10891 CreateNamedPipeW 73->77 74->11 76->11 78 e10893 77->78 79 e10895-e108ae ResumeThread ConnectNamedPipe 77->79 78->11 80 e108b0-e108bb 79->80 81 e108bf-e108dc 79->81 80->81 82 e108bd 80->82 84 e108e0 81->84 85 e108de 81->85 82->11 84->11 85->11
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID: D
                                        • API String ID: 0-2746444292
                                        • Opcode ID: a965d21caa7c8b60b10976586f15f4b44e73e864190c5e4c5ab47269cf2c9394
                                        • Instruction ID: 4af5fa65678556a4233de796b0fdca67edc3284d93934e468bc992a65572ed6d
                                        • Opcode Fuzzy Hash: a965d21caa7c8b60b10976586f15f4b44e73e864190c5e4c5ab47269cf2c9394
                                        • Instruction Fuzzy Hash: 0FE15B71900218EFEF209F90DC49BEEBBB9FB08314F1050A5E209B60A1D7B55AC9DF91
                                        Function 00E091C8 Relevance: 16.7, APIs: 11, Instructions: 241registryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 86 e091c8-e0949b call e01240 * 5 RegCreateKeyExW 97 e094a1 86->97 98 e0957d-e09581 86->98 101 e094a8-e094c5 RegEnumKeyW 97->101 99 e09583 98->99 100 e0958c-e095ba RegCreateKeyExW 98->100 99->100 102 e09615-e09619 100->102 103 e095bc 100->103 104 e094c7 101->104 105 e094cc-e094f8 RegCreateKeyExW 101->105 106 e09624-e09627 102->106 107 e0961b 102->107 108 e095c3-e095e0 RegEnumKeyW 103->108 104->98 109 e09575-e09578 105->109 110 e094fa-e0951a RegSetValueExW 105->110 107->106 111 e095e2 108->111 112 e095e4-e095fa OpenEventLogW 108->112 109->101 113 e09566-e0956a 110->113 114 e0951c-e09538 RegSetValueExW 110->114 111->102 116 e09610-e09613 112->116 117 e095fc-e09607 ClearEventLogW 112->117 113->109 115 e0956c 113->115 114->113 118 e0953a-e09550 OpenEventLogW 114->118 115->109 116->108 117->116 118->113 119 e09552-e0955d ClearEventLogW 118->119 119->113
                                        APIs
                                        • RegCreateKeyExW.KERNELBASE(80000002,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000,?,00000007,?,00000004,?,00000019,?), ref: 00E09493
                                        • RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000104), ref: 00E094BA
                                        • RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000), ref: 00E094F0
                                        • RegSetValueExW.KERNELBASE(00000000,?,00000000,00000004,00000000,00000004), ref: 00E09512
                                        • RegSetValueExW.KERNELBASE(00000000,?,00000000,00000001,?,00000064), ref: 00E09530
                                        • OpenEventLogW.ADVAPI32(00000000,?), ref: 00E09543
                                        • ClearEventLogW.ADVAPI32(00000000,00000000), ref: 00E09557
                                        • RegCreateKeyExW.KERNELBASE(80000002,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000), ref: 00E095B2
                                        • RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000104), ref: 00E095D5
                                        • OpenEventLogW.ADVAPI32(00000000,?), ref: 00E095ED
                                        • ClearEventLogW.ADVAPI32(00000000,00000000), ref: 00E09601
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Event$Create$ClearEnumOpenValue
                                        • String ID:
                                        • API String ID: 1260815474-0
                                        • Opcode ID: bf724be3838b537ea375355800edd89707a87bfd5e7f78b526b7138ee63d3150
                                        • Instruction ID: d0bed629e9705717c859bd24f990e41f80348e1f744a222069583c36521e76f7
                                        • Opcode Fuzzy Hash: bf724be3838b537ea375355800edd89707a87bfd5e7f78b526b7138ee63d3150
                                        • Instruction Fuzzy Hash: 45C117B880030AEFDB208F51D944F997B78FF04744F529088E6156F2B2D77A9A88CF56
                                        Function 00E0A68C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 190fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 120 e0a68c-e0a70c GetVolumeNameForVolumeMountPointW FindFirstVolumeW 124 e0a950-e0a955 120->124 125 e0a712-e0a718 120->125 126 e0a71e-e0a725 125->126 127 e0a91f-e0a941 125->127 126->127 128 e0a72b-e0a742 GetVolumePathNamesForVolumeNameW 126->128 127->125 136 e0a947 127->136 128->127 129 e0a748-e0a74c 128->129 129->127 131 e0a752-e0a756 129->131 131->127 132 e0a75c-e0a766 GetDriveTypeW 131->132 134 e0a771-e0a779 call e01564 132->134 135 e0a768-e0a76b 132->135 139 e0a7f7-e0a81d call e016f0 CreateFileW 134->139 140 e0a77b-e0a7c3 134->140 135->127 135->134 136->124 144 e0a823-e0a849 DeviceIoControl 139->144 145 e0a916 139->145 150 e0a7e3-e0a7e7 140->150 151 e0a7c5-e0a7de call e0a600 140->151 144->145 146 e0a84f-e0a856 144->146 145->127 148 e0a858-e0a864 146->148 149 e0a8bc-e0a8c3 146->149 155 e0a883-e0a889 148->155 156 e0a866-e0a86d 148->156 149->145 154 e0a8c5-e0a8cc 149->154 152 e0a7f2 150->152 153 e0a7e9 150->153 151->150 152->127 153->152 154->145 159 e0a8ce-e0a8d5 154->159 157 e0a8a8-e0a8b5 call e016c0 call e0a600 155->157 158 e0a88b-e0a892 155->158 156->155 160 e0a86f-e0a876 156->160 174 e0a8ba 157->174 158->157 163 e0a894-e0a89b 158->163 159->145 165 e0a8d7-e0a8f1 call e016c0 159->165 160->155 166 e0a878-e0a87f 160->166 163->157 167 e0a89d-e0a8a4 163->167 176 e0a8f3-e0a8fa 165->176 177 e0a90a-e0a911 call e0a600 165->177 166->155 170 e0a881 166->170 167->157 171 e0a8a6 167->171 170->174 171->174 174->145 178 e0a908 176->178 179 e0a8fc-e0a903 call e0a600 176->179 177->145 178->145 179->178
                                        APIs
                                        • GetVolumeNameForVolumeMountPointW.KERNELBASE(?,?,00000104), ref: 00E0A6D6
                                        • FindFirstVolumeW.KERNELBASE(?,00000104), ref: 00E0A6FF
                                        • GetVolumePathNamesForVolumeNameW.KERNELBASE(?,?,00000040,00000000), ref: 00E0A73A
                                        • GetDriveTypeW.KERNELBASE(?), ref: 00E0A75D
                                        • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00E0A810
                                        • DeviceIoControl.KERNELBASE(000000FF,00070048,00000000,00000000,?,00000090,00000001,00000000), ref: 00E0A841
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Volume$Name$ControlCreateDeviceDriveFileFindFirstMountNamesPathPointType
                                        • String ID: '
                                        • API String ID: 754975672-1997036262
                                        • Opcode ID: 5393614e7e3116cae69a604d76664518398c0c0e8cf99ed1307d4c2729607275
                                        • Instruction ID: dd615052e37e6238a0b3537f9fb1a4fc1ed0063547b475dc3c4b93514fd27205
                                        • Opcode Fuzzy Hash: 5393614e7e3116cae69a604d76664518398c0c0e8cf99ed1307d4c2729607275
                                        • Instruction Fuzzy Hash: A571A131940718EEDB309B50ED0DF9ABB78EF01319F5890A6E205B60E1D7745ACACF66
                                        Function 00E06668 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 161filenativememoryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 182 e06668-e0667b 183 e0667e-e06683 182->183 183->183 184 e06685-e06699 call e0a094 183->184 187 e066a5-e066c7 CreateFileW 184->187 188 e0669b-e0669f 184->188 189 e067ca-e067cc 187->189 190 e066cd-e066cf 187->190 188->187 188->189 191 e067cf-e067d2 189->191 192 e066d2-e066fb NtAllocateVirtualMemory 190->192 193 e067f3-e067f7 191->193 194 e067d4-e067ed NtFreeVirtualMemory 191->194 195 e06703 192->195 196 e066fd-e06708 192->196 193->191 199 e067f9-e067fd 193->199 194->193 198 e06733-e06738 195->198 200 e0670a-e06719 196->200 201 e0671b-e0671e 196->201 202 e0673b-e06746 198->202 203 e06808-e0681f call e06550 DeleteFileW 199->203 204 e067ff 199->204 205 e0672d-e06731 200->205 201->205 206 e06720-e06728 call e06628 201->206 207 e06754 202->207 208 e06748-e06752 202->208 214 e06821 203->214 215 e06828-e0682c 203->215 204->203 205->192 205->198 206->205 211 e06759-e06760 207->211 208->211 213 e06763-e06779 WriteFile 211->213 218 e0677b 213->218 219 e0677d-e0679a SetFilePointerEx 213->219 214->215 216 e06836-e0683f 215->216 217 e0682e-e06831 call e0686c 215->217 217->216 221 e0679c-e067a3 218->221 219->213 219->221 222 e067a5 221->222 223 e067a7-e067c5 221->223 222->189 223->202
                                        APIs
                                        • CreateFileW.KERNELBASE(00E077D6,40000000,00000003,00000000,00000003,80000000,00000000,00E077D6,?,?,00000000,?), ref: 00E066BA
                                        • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00010000,00001000,00000004,?,00000000,?), ref: 00E066F3
                                        • WriteFile.KERNELBASE(000000FF,00000000,00010000,00010000,00000000,?,00000000,?), ref: 00E06771
                                        • SetFilePointerEx.KERNELBASE(000000FF,00010000,?,00000000,00000001,?,00000000,?), ref: 00E0678D
                                        • NtFreeVirtualMemory.NTDLL(000000FF,?,00010000,00008000,?,00000000,?), ref: 00E067ED
                                        • DeleteFileW.KERNELBASE(?,000000FF,?,?,00000000,?), ref: 00E06817
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$MemoryVirtual$AllocateCreateDeleteFreePointerWrite
                                        • String ID: lu
                                        • API String ID: 69945773-2989676324
                                        • Opcode ID: a8d90b110834cc21c267f6f2ece4d3979ae26e4951b6bc13c372b36f8890a6ec
                                        • Instruction ID: 834db3ae9f96cfec9e765e9b6ed1ae599e5330e8217d50bde4fba058ef3d56c8
                                        • Opcode Fuzzy Hash: a8d90b110834cc21c267f6f2ece4d3979ae26e4951b6bc13c372b36f8890a6ec
                                        • Instruction Fuzzy Hash: 39514C71900209AFDF21CFA4DD44BEEBBB9EB04329F241226F511B60D0D7B55AE9CB61
                                        Function 00E17034 Relevance: 12.2, APIs: 8, Instructions: 248threadnativeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 225 e17034-e17053 KiUserCallbackDispatcher 226 e17111-e17118 225->226 227 e17059-e17060 225->227 228 e17145-e1717c CreateThread * 2 226->228 229 e1711a-e17133 CreateThread 226->229 230 e17062-e17088 call e06ae8 227->230 231 e1708b-e17092 227->231 235 e17183-e1718a 228->235 236 e1717e call e07ca4 228->236 229->228 234 e17135-e1713e 229->234 230->231 232 e17094-e1709b 231->232 233 e170ce-e170d5 231->233 232->233 237 e1709d-e170c7 call e09c64 232->237 233->226 239 e170d7-e170de 233->239 234->228 240 e171a4-e171ab 235->240 241 e1718c-e171a1 CreateThread 235->241 236->235 237->233 239->226 245 e170e0-e1710a call e09c64 239->245 246 e171b6-e171dd call e0b734 call e0e1e8 240->246 247 e171ad-e171b4 240->247 241->240 245->226 274 e17221-e17225 246->274 275 e171df-e171e6 246->275 247->246 248 e1722e-e17232 247->248 254 e17234-e1723f 248->254 255 e17248-e1724c 248->255 254->255 259 e17262-e17269 255->259 260 e1724e-e17259 255->260 265 e1726b-e17276 NtTerminateThread 259->265 266 e1727f-e17286 259->266 260->259 265->266 269 e172b3-e172bd 266->269 270 e17288-e172a1 CreateThread 266->270 276 e172c3-e172ca 269->276 277 e17392-e173a0 call e11934 call e11d28 call e116ac 269->277 270->269 272 e172a3-e172ac 270->272 272->269 274->248 278 e17201-e17208 275->278 279 e171e8-e171fc call e0a68c call e0e2b8 call e10a38 call e0e2b8 call e10be4 275->279 283 e172f7-e172fe 276->283 284 e172cc-e172e5 CreateThread 276->284 315 e173a5-e173a9 277->315 281 e17214-e1721c call e0e270 call e0e2b8 278->281 282 e1720a-e1720f call e0e2b8 call e0fc88 278->282 279->278 281->274 282->281 291 e17300-e17304 283->291 292 e17339-e17340 call e0b674 283->292 284->283 288 e172e7-e172f0 284->288 288->283 298 e17306-e17311 291->298 299 e1731a-e17334 call e06ae8 call e0da00 291->299 308 e17342-e17347 call e08960 292->308 309 e17349-e1734b call e08230 292->309 298->299 299->292 320 e17350-e17357 308->320 309->320 324 e17359-e17360 320->324 325 e1736b-e1738b call e09640 call e104b4 320->325 324->325 328 e17362-e17369 324->328 329 e17390 325->329 328->325 328->329 329->315
                                        APIs
                                        • KiUserCallbackDispatcher.NTDLL(00000043), ref: 00E1704B
                                        • CreateThread.KERNELBASE(00000000,00000000,Function_00008F68,00000000,00000000,00000000), ref: 00E17129
                                        • CreateThread.KERNELBASE(00000000,00000000,Function_00007468,00000000,00000000,00000000), ref: 00E17154
                                        • CreateThread.KERNELBASE(00000000,00000000,Function_0000782C,00000000,00000000,00000000), ref: 00E1716C
                                        • CreateThread.KERNELBASE(00000000,00000000,Function_00007E58,00000000,00000000,00000000), ref: 00E1719B
                                        • NtTerminateThread.NTDLL(?,00000000), ref: 00E17270
                                        • CreateThread.KERNELBASE(00000000,00000000,Function_00009628,00000000,00000000,00000000), ref: 00E17297
                                        • CreateThread.KERNELBASE(00000000,00000000,Function_0000C064,00000000,00000000,00000000), ref: 00E172DB
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Thread$Create$CallbackDispatcherTerminateUser
                                        • String ID:
                                        • API String ID: 1743520491-0
                                        • Opcode ID: 51d6ac1ad8c198d14472909ddda4627ae1f8091fef6d743f489ce9d776b20039
                                        • Instruction ID: 14be2d47ef8aa067efe7b0d7af8bfedead31587892e9420ca75f3324fe0d3769
                                        • Opcode Fuzzy Hash: 51d6ac1ad8c198d14472909ddda4627ae1f8091fef6d743f489ce9d776b20039
                                        • Instruction Fuzzy Hash: 0B91E772649B40BEEB316BB19E4EBAD7FB5AB04B05F241110F251B41F2CBB408DACB14
                                        Function 00E0DE78 Relevance: 7.8, APIs: 5, Instructions: 256filethreadCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 383 e0de78-e0de89 SetThreadPriority 384 e0de8f-e0deae 383->384 386 e0deb0-e0deb8 384->386 387 e0dede-e0dee0 384->387 386->387 390 e0deba 386->390 388 e0dee2-e0dee5 387->388 389 e0dee6-e0deeb 387->389 391 e0dfa0-e0dfa3 389->391 392 e0def1-e0df23 ReadFile 389->392 393 e0dec1-e0ded6 390->393 394 e0e0a1-e0e0a4 391->394 395 e0dfa9-e0dfee call e020ac 391->395 396 e0df25-e0df30 392->396 397 e0df96 392->397 409 e0ded8-e0dedc 393->409 410 e0deda 393->410 400 e0e131-e0e134 394->400 401 e0e0aa-e0e0e9 WriteFile 394->401 439 e0dff0-e0e005 395->439 440 e0e007-e0e00f 395->440 396->397 399 e0df32-e0df3a 396->399 398 e0e180-e0e19f 397->398 417 e0e1a1 398->417 418 e0e1a3-e0e1ab 398->418 404 e0df58-e0df7f 399->404 405 e0df3c-e0df56 399->405 400->398 406 e0e136-e0e13a 400->406 407 e0e0eb-e0e0f6 401->407 408 e0e12d 401->408 441 e0df81-e0df8c 404->441 442 e0df92 404->442 405->397 412 e0e150-e0e16e NtClose call e01074 call e0686c 406->412 413 e0e13c-e0e142 406->413 407->408 414 e0e0f8-e0e116 407->414 408->398 409->384 410->393 437 e0e173-e0e17e 412->437 421 e0e144 413->421 422 e0e146-e0e14e 413->422 444 e0e118-e0e123 414->444 445 e0e129 414->445 425 e0e1d3-e0e1d5 417->425 426 e0e1d1 418->426 427 e0e1ad 418->427 421->412 422->413 430 e0e1d7-e0e1da 425->430 431 e0e1db 425->431 426->398 426->425 432 e0e1b4-e0e1c9 427->432 431->389 454 e0e1cb-e0e1cf 432->454 455 e0e1cd 432->455 437->398 460 e0e1e0 437->460 446 e0e031-e0e04d WriteFile 439->446 447 e0e011-e0e013 440->447 448 e0e01e-e0e02a 440->448 449 e0df90 441->449 450 e0df8e 441->450 442->397 456 e0e125 444->456 457 e0e127 444->457 445->408 451 e0e097 446->451 452 e0e04f-e0e05a 446->452 447->448 458 e0e015-e0e01c 447->458 448->446 449->404 450->397 451->398 452->451 459 e0e05c-e0e080 452->459 454->398 455->432 456->408 457->414 458->446 464 e0e082-e0e08d 459->464 465 e0e093 459->465 460->384 466 e0e091 464->466 467 e0e08f 464->467 465->451 466->459 467->451
                                        APIs
                                        • SetThreadPriority.KERNELBASE(000000FE,00000002), ref: 00E0DE89
                                        • ReadFile.KERNELBASE(?,?,?,?,?), ref: 00E0DF1B
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: FilePriorityReadThread
                                        • String ID:
                                        • API String ID: 3643687941-0
                                        • Opcode ID: 10fe8920aa84a18e7ca9d8c80bfd3f0ddee74dbfd1d511b805f6447294bc72e1
                                        • Instruction ID: be9f9c08d9d6fe0335fe11eefc30e1c41fb14f76ec4e5e67c9014f9a47df0ec0
                                        • Opcode Fuzzy Hash: 10fe8920aa84a18e7ca9d8c80bfd3f0ddee74dbfd1d511b805f6447294bc72e1
                                        • Instruction Fuzzy Hash: F2A1BF72505608EFDF218F90CDC8BAA77BDFB08308F206676E905E92D5D7709A89CB51
                                        Function 00E0F308 Relevance: 7.7, APIs: 5, Instructions: 175filethreadCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 468 e0f308-e0f31f GetFileAttributesW 469 e0f321-e0f32d call e0bbf4 468->469 470 e0f37f-e0f391 SetThreadPriority call e01564 468->470 475 e0f371-e0f37c call e0686c 469->475 476 e0f32f-e0f33d call e0a094 469->476 477 e0f393-e0f39a 470->477 478 e0f39c 470->478 476->475 485 e0f33f-e0f343 476->485 479 e0f3a3-e0f3b6 call e06844 477->479 478->479 489 e0f3bd-e0f3fd call e0c19c call e0f164 call e0686c FindFirstFileExW 479->489 487 e0f345-e0f349 485->487 488 e0f34b-e0f36e call e0c19c call e07290 call e0ef6c 485->488 487->475 487->488 502 e0f403-e0f411 489->502 503 e0f535-e0f54a call e0686c 489->503 509 e0f416-e0f41f 502->509 507 e0f54c-e0f56a call e0686c 503->507 508 e0f54e-e0f562 503->508 519 e0f56f-e0f572 507->519 508->489 511 e0f421-e0f427 509->511 512 e0f429 509->512 511->512 513 e0f42e-e0f438 511->513 514 e0f514-e0f526 FindNextFileW 512->514 516 e0f43a 513->516 517 e0f43f-e0f446 513->517 514->509 518 e0f52c-e0f52f FindClose 514->518 516->514 520 e0f453-e0f457 517->520 521 e0f448-e0f44c 517->521 518->503 523 e0f481-e0f489 call e0f21c 520->523 524 e0f459-e0f461 call e0f2b4 520->524 521->520 522 e0f44e 521->522 522->514 529 e0f490-e0f497 523->529 530 e0f48b 523->530 531 e0f463-e0f47a call e0f1c8 524->531 532 e0f47c 524->532 533 e0f4a4-e0f4ae call e0bbf4 529->533 534 e0f499-e0f4a0 529->534 530->514 531->532 532->514 540 e0f4b0 533->540 541 e0f4b2-e0f4d0 call e0f1c8 call e07290 call e0ef6c 533->541 534->533 536 e0f4a2 534->536 536->514 540->514 547 e0f4d5-e0f4dc 541->547 547->514 548 e0f4de-e0f4e0 547->548 549 e0f4e2-e0f507 548->549 550 e0f509 548->550 549->514 550->514
                                        APIs
                                        • GetFileAttributesW.KERNELBASE(?), ref: 00E0F314
                                        • SetThreadPriority.KERNELBASE(000000FE,00000002), ref: 00E0F383
                                        • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000,?,?,?,00E25180,003D0900), ref: 00E0F3F0
                                        • FindNextFileW.KERNELBASE(000000FF,?), ref: 00E0F51E
                                        • FindClose.KERNELBASE(000000FF), ref: 00E0F52F
                                          • Part of subcall function 00E0A094: FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 00E0A0B6
                                          • Part of subcall function 00E0A094: FindClose.KERNELBASE(000000FF), ref: 00E0A0DC
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Find$File$CloseFirst$AttributesNextPriorityThread
                                        • String ID:
                                        • API String ID: 3755735135-0
                                        • Opcode ID: bb1843c65708cd2bd5f5a628aae42664ddfdbee3a9b2991f38df50a1cf7d7256
                                        • Instruction ID: 1a7a2fc82bcd9466f710e8700318be65290bed22a4eb91db8a3763834dfb8a9a
                                        • Opcode Fuzzy Hash: bb1843c65708cd2bd5f5a628aae42664ddfdbee3a9b2991f38df50a1cf7d7256
                                        • Instruction Fuzzy Hash: 1261873080020AAFDF30AF60DC45BAEBBB5BF00318F106171E810B65E2C7759EE69B91
                                        Function 00E0766C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 636 e0766c-e07693 638 e07822-e07827 636->638 639 e07699-e076ad call e06844 636->639 642 e076b3-e07700 call e016c0 FindFirstFileExW 639->642 643 e07806-e0780a 639->643 642->643 653 e07706-e0770f 642->653 644 e07814-e07818 643->644 645 e0780c-e0780f call e0686c 643->645 644->638 647 e0781a-e0781d call e0686c 644->647 645->644 647->638 654 e077e5-e077f7 FindNextFileW 653->654 655 e07715-e0771b 653->655 654->653 657 e077fd 654->657 655->654 656 e07721-e0774f call e06844 655->656 656->654 662 e07755-e07791 GetFileAttributesW 656->662 657->643 666 e07793-e0779e 662->666 667 e077ce-e077d1 call e06668 662->667 672 e077a0 666->672 673 e077a2-e077ad 666->673 669 e077d6-e077de call e0686c 667->669 669->654 675 e077bd-e077cc call e0686c 672->675 676 e077b9 673->676 677 e077af-e077bb call e0766c 673->677 675->654 676->675 677->666
                                        APIs
                                          • Part of subcall function 00E06844: RtlAllocateHeap.NTDLL(?,00000008,00E1B8B2,?,00E06DF9,00000166,?,?,?,?,00E0C080,00E1B8B2), ref: 00E06860
                                        • FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 00E076F3
                                        • GetFileAttributesW.KERNELBASE(00000000), ref: 00E07786
                                        • FindNextFileW.KERNELBASE(000000FF,?), ref: 00E077EF
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$Find$AllocateAttributesFirstHeapNext
                                        • String ID: lu
                                        • API String ID: 2400493143-2989676324
                                        • Opcode ID: 22afe213cda9ef35934a339a2230d4945a6a942abd7132019f2a1efc670984c7
                                        • Instruction ID: 052ea10a23dcf5fcf8e58a365e26bd62cc3811a889055e4932ac75db1a0571dc
                                        • Opcode Fuzzy Hash: 22afe213cda9ef35934a339a2230d4945a6a942abd7132019f2a1efc670984c7
                                        • Instruction Fuzzy Hash: D6416B71C04219EFDF216FA1ED49BADBB75FF0034AF044461E452B10E0E7762AA8DB51
                                        Function 00E05C24 Relevance: 6.1, APIs: 4, Instructions: 99fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 683 e05c24-e05c35 684 e05c56-e05c5d 683->684 685 e05c37-e05c51 call e05aec 683->685 687 e05c7e-e05c85 684->687 688 e05c5f-e05c79 call e05aec 684->688 685->684 691 e05ca6-e05cad call e01658 687->691 692 e05c87-e05ca1 call e05aec 687->692 688->687 696 e05cb2-e05cb6 691->696 692->691 698 e05cb8-e05ce2 call e01240 696->698 699 e05cdd-e05ce0 696->699 703 e05ce9-e05d04 FindFirstFileW 698->703 699->696 704 e05d54-e05d58 703->704 705 e05d06-e05d17 call e011c4 703->705 706 e05d5a-e05d9c 704->706 707 e05d5c-e05d66 704->707 715 e05d37-e05d49 FindNextFileW 705->715 716 e05d19-e05d2b FindClose call e05a20 705->716 710 e05d68-e05d6d 707->710 711 e05d8b-e05d8e 707->711 713 e05d86-e05d89 710->713 714 e05d6f-e05d84 call e01240 710->714 711->703 713->710 714->711 715->705 719 e05d4b-e05d4e FindClose 715->719 721 e05d30-e05d34 716->721 719->704
                                        APIs
                                        • FindFirstFileW.KERNELBASE(?,?,?,00000004), ref: 00E05CF7
                                        • FindClose.KERNELBASE(000000FF,?,00000000), ref: 00E05D1C
                                        • FindNextFileW.KERNELBASE(000000FF,?,?,00000000), ref: 00E05D41
                                        • FindClose.KERNELBASE(000000FF), ref: 00E05D4E
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Find$CloseFile$FirstNext
                                        • String ID:
                                        • API String ID: 1164774033-0
                                        • Opcode ID: f561e1017d2e66f58883d6cec403e2bdecbf1cfe5873505046dc9d759f461a07
                                        • Instruction ID: 169aa5267e2a0d14eb019280f9eecc88182e63313582b8c3d6eab3ed3c8a3b6a
                                        • Opcode Fuzzy Hash: f561e1017d2e66f58883d6cec403e2bdecbf1cfe5873505046dc9d759f461a07
                                        • Instruction Fuzzy Hash: A7419672800B04DFDB30AF61DE897AAB778EB00315F609192E516BA1E1D7754DCACF51
                                        Function 00E0B734 Relevance: 4.5, APIs: 3, Instructions: 31nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtSetInformationProcess.NTDLL(000000FF,00000021,00000000,00000004,?,00E171D1), ref: 00E0B751
                                        • NtSetInformationProcess.NTDLL(000000FF,00000012,00000000,00000002,?,00E171D1), ref: 00E0B763
                                        • NtSetInformationProcess.NTDLL(000000FF,0000000C,00000000,00000004,?,00E171D1), ref: 00E0B778
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationProcess
                                        • String ID:
                                        • API String ID: 1801817001-0
                                        • Opcode ID: 8ff84c255b780ff00004645b20857a4d331da6314f0af9fb2b8cff79c50e02d1
                                        • Instruction ID: 4c7795204748748bac6c362cd108ea2a1fe89cb0e57b7277323e166ffe40bfa6
                                        • Opcode Fuzzy Hash: 8ff84c255b780ff00004645b20857a4d331da6314f0af9fb2b8cff79c50e02d1
                                        • Instruction Fuzzy Hash: 2EF030B1240614AFFB21AB94DDCAF11379CAB05725F500360B331ED1D6D7B08488C762
                                        Function 00E0B470 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtProtectVirtualMemory.NTDLL(000000FF,00000000,00000020,00000040,?), ref: 00E0B4B1
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MemoryProtectVirtual
                                        • String ID:
                                        • API String ID: 2706961497-3916222277
                                        • Opcode ID: 07df318ebc8c498d23ff84fb88c2a8be96bc385e03b226ee9c665d1a46d94531
                                        • Instruction ID: fb692c43e65d1b8986602d600181e3e462a78e1b5514c0e616389ec54da1b696
                                        • Opcode Fuzzy Hash: 07df318ebc8c498d23ff84fb88c2a8be96bc385e03b226ee9c665d1a46d94531
                                        • Instruction Fuzzy Hash: F6F09A71900208BBDB10CFA4CD88B9EB7BCEB04329F604294A529B71C1E7755B448B60
                                        Function 00E07E58 Relevance: 3.1, APIs: 2, Instructions: 73sleepnativeCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00E06844: RtlAllocateHeap.NTDLL(?,00000008,00E1B8B2,?,00E06DF9,00000166,?,?,?,?,00E0C080,00E1B8B2), ref: 00E06860
                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E07E7E
                                        • Sleep.KERNELBASE(000007D0,?), ref: 00E07F45
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AllocateHeapInformationQuerySleepSystem
                                        • String ID:
                                        • API String ID: 3184523392-0
                                        • Opcode ID: 13ba2309f56d9bc6711be6b3b2a385ecf1032e9976a312bcd835221cdd6016bd
                                        • Instruction ID: 07a9b4e59b591effb5b501cd45c23ca6892e008cc9ba05872b1ca34951875524
                                        • Opcode Fuzzy Hash: 13ba2309f56d9bc6711be6b3b2a385ecf1032e9976a312bcd835221cdd6016bd
                                        • Instruction Fuzzy Hash: CC215E71D04108AFDF109F90DC44BDEBBB8EF04308F209099E915BA191D772AA96DFA0
                                        Function 00E08F66 Relevance: 3.1, APIs: 2, Instructions: 70nativethreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00E08F8A
                                          • Part of subcall function 00E097D8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E09805
                                          • Part of subcall function 00E09880: NtClose.NTDLL(00000000), ref: 00E09971
                                        • NtSetInformationThread.NTDLL(000000FE,00000005,00000000,00000004,00000000,00000002,00000002,D1F935A5), ref: 00E08FC1
                                          • Part of subcall function 00E08DA8: OpenSCManagerW.ADVAPI32(00000000,00000000,00000001,7DDDCD9C), ref: 00E08DE6
                                          • Part of subcall function 00E08DA8: QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00E08E79
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationQuery$AdjustCloseManagerOpenPrivilegeServiceStatusSystemThread
                                        • String ID:
                                        • API String ID: 3300512565-0
                                        • Opcode ID: 4d29eeb4418db3ca44551eb5de213ffe5800475d1ad39a3b0bbebecf8002d2f6
                                        • Instruction ID: e5896cf29503af04fed25656467ecb0ca6d420920df8a15cde48302813c00af9
                                        • Opcode Fuzzy Hash: 4d29eeb4418db3ca44551eb5de213ffe5800475d1ad39a3b0bbebecf8002d2f6
                                        • Instruction Fuzzy Hash: 50218170A00308BEEB20AFA0CD4EB9EBAB8AF04315F105154B515B61D7EBB48AC4DB61
                                        Function 00E08F68 Relevance: 3.1, APIs: 2, Instructions: 69nativethreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00E08F8A
                                          • Part of subcall function 00E097D8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E09805
                                          • Part of subcall function 00E09880: NtClose.NTDLL(00000000), ref: 00E09971
                                        • NtSetInformationThread.NTDLL(000000FE,00000005,00000000,00000004,00000000,00000002,00000002,D1F935A5), ref: 00E08FC1
                                          • Part of subcall function 00E08DA8: OpenSCManagerW.ADVAPI32(00000000,00000000,00000001,7DDDCD9C), ref: 00E08DE6
                                          • Part of subcall function 00E08DA8: QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00E08E79
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationQuery$AdjustCloseManagerOpenPrivilegeServiceStatusSystemThread
                                        • String ID:
                                        • API String ID: 3300512565-0
                                        • Opcode ID: 1558a24d4f1831d5737557d7ed56e2f06217e206af87e2c221b08140fc198e61
                                        • Instruction ID: e81e5fc428bb6cabf0a54066d75f8049c53ee0b56a104d38b581af2a85d37bdf
                                        • Opcode Fuzzy Hash: 1558a24d4f1831d5737557d7ed56e2f06217e206af87e2c221b08140fc198e61
                                        • Instruction Fuzzy Hash: 34216370A00308BEEF20AFA4CD4EBDEBAB8AF04715F105554B515B61D7EBB48AC4DB61
                                        Function 00E074BC Relevance: 3.1, APIs: 2, Instructions: 60fileCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00E07590: FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 00E075FF
                                          • Part of subcall function 00E07590: FindClose.KERNELBASE(000000FF), ref: 00E0765C
                                        • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 00E0751F
                                        • FindNextFileW.KERNELBASE(000000FF,?), ref: 00E07576
                                          • Part of subcall function 00E0766C: FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 00E076F3
                                          • Part of subcall function 00E0766C: GetFileAttributesW.KERNELBASE(00000000), ref: 00E07786
                                          • Part of subcall function 00E0766C: FindNextFileW.KERNELBASE(000000FF,?), ref: 00E077EF
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: FileFind$First$Next$AttributesClose
                                        • String ID:
                                        • API String ID: 95010735-0
                                        • Opcode ID: 8fdd6e185b492a78419334e544bcad60fc04be80c029551f452f9ef3181334e3
                                        • Instruction ID: fef82f1980db05bbdc9eae7cfd286d31b84123970abcc4ecf2da9ef542f96226
                                        • Opcode Fuzzy Hash: 8fdd6e185b492a78419334e544bcad60fc04be80c029551f452f9ef3181334e3
                                        • Instruction Fuzzy Hash: AD211FB194020DAFDB20EB90DE49FD9B77CAB14305F4004A1B519F6191E771AB998F61
                                        Function 00E07590 Relevance: 3.1, APIs: 2, Instructions: 58COMMON
                                        Download Yara Rule
                                        APIs
                                        • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 00E075FF
                                        • FindClose.KERNELBASE(000000FF), ref: 00E0765C
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Find$CloseFileFirst
                                        • String ID:
                                        • API String ID: 2295610775-0
                                        • Opcode ID: fcde12ad56e49b0c35dfbada3b3ca1bf207365793babdb6d0bc8ad0d1544bd57
                                        • Instruction ID: 0cbd7518bd054b17b4724f60eeb1b822f3cb4209bd26ab1b641d96fe1686bf70
                                        • Opcode Fuzzy Hash: fcde12ad56e49b0c35dfbada3b3ca1bf207365793babdb6d0bc8ad0d1544bd57
                                        • Instruction Fuzzy Hash: 782162B1800208EFDB20DF94ED0CBACBBB9FF04305F004190E949A61A1D771AA99CF55
                                        Function 00E07EA3 Relevance: 3.1, APIs: 2, Instructions: 56sleepnativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E07E7E
                                        • Sleep.KERNELBASE(000007D0,?), ref: 00E07F45
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationQuerySleepSystem
                                        • String ID:
                                        • API String ID: 3518162127-0
                                        • Opcode ID: 97de4ee4631b4ef1c7bbacdf708e64254d945ba4b788cbc90d4ea025ab311c10
                                        • Instruction ID: c47534141868c7ad9d27134e80063e28f7b9632143d1f9dcae1b80877dda156c
                                        • Opcode Fuzzy Hash: 97de4ee4631b4ef1c7bbacdf708e64254d945ba4b788cbc90d4ea025ab311c10
                                        • Instruction Fuzzy Hash: B1212971D04209EFDF109F90C944BDEBBB8FF04308F209099E951BA191D772AA86DFA0
                                        Function 00E07E8A Relevance: 3.1, APIs: 2, Instructions: 56sleepnativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E07E7E
                                        • Sleep.KERNELBASE(000007D0,?), ref: 00E07F45
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationQuerySleepSystem
                                        • String ID:
                                        • API String ID: 3518162127-0
                                        • Opcode ID: 08d2ea5a7025806a6ee644b5c18fdfe046fcef64180234e394fdbb892e1d686f
                                        • Instruction ID: c47534141868c7ad9d27134e80063e28f7b9632143d1f9dcae1b80877dda156c
                                        • Opcode Fuzzy Hash: 08d2ea5a7025806a6ee644b5c18fdfe046fcef64180234e394fdbb892e1d686f
                                        • Instruction Fuzzy Hash: B1212971D04209EFDF109F90C944BDEBBB8FF04308F209099E951BA191D772AA86DFA0
                                        Function 00E0E1E8 Relevance: 3.0, APIs: 2, Instructions: 46nativethreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateThread.KERNELBASE(00000000,00000000,Function_0000DE78,00000000,00000000,00000000), ref: 00E0E239
                                          • Part of subcall function 00E0B444: NtSetInformationThread.NTDLL(00000000,?,00000000,00000000), ref: 00E0B465
                                        • NtClose.NTDLL(00000000), ref: 00E0E24C
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Thread$CloseCreateInformation
                                        • String ID:
                                        • API String ID: 3895992022-0
                                        • Opcode ID: e707a33123e84139813bdbd9052f63b09493b4a37bc9dd1a1bf320dfadec7536
                                        • Instruction ID: f21a97a1a32fa0156cb5c80cb47f6964f8e38ed25ff5822d492e88bb09a17c27
                                        • Opcode Fuzzy Hash: e707a33123e84139813bdbd9052f63b09493b4a37bc9dd1a1bf320dfadec7536
                                        • Instruction Fuzzy Hash: B501DB72740B14EFE3346B55AD89B9D7368EB04715F200320FA15B62E1EBB05E498555
                                        Function 00E07468 Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                        Download Yara Rule
                                        APIs
                                        • GetLogicalDriveStringsW.KERNELBASE(00000104,?), ref: 00E0747F
                                        • GetDriveTypeW.KERNELBASE(?), ref: 00E07495
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Drive$LogicalStringsType
                                        • String ID:
                                        • API String ID: 1630765265-0
                                        • Opcode ID: 636490cbc17b4318ab5088c54a3ade313a6a4e63195fbcdd5505224ed5d83254
                                        • Instruction ID: 7faa99f74999d5311112ced1822dfd5ebc8026ec5e672514e75dfbc1c7fccb4c
                                        • Opcode Fuzzy Hash: 636490cbc17b4318ab5088c54a3ade313a6a4e63195fbcdd5505224ed5d83254
                                        • Instruction Fuzzy Hash: 24E0E5329047296BDB30AAD59CC59AB7B5CCB01314F000151EAA4F2041CA64BDC686A1
                                        Function 00E0A094 Relevance: 3.0, APIs: 2, Instructions: 27COMMON
                                        Download Yara Rule
                                        APIs
                                        • FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 00E0A0B6
                                        • FindClose.KERNELBASE(000000FF), ref: 00E0A0DC
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Find$CloseFileFirst
                                        • String ID:
                                        • API String ID: 2295610775-0
                                        • Opcode ID: 10f0134c02612088f62e8e19d4ca80872240aaeedde5794ea5690f811a0fe809
                                        • Instruction ID: 5989ec1309c235f7f72a6d8847315d46cb08b7bf8945497f0d5f9536cddf1e44
                                        • Opcode Fuzzy Hash: 10f0134c02612088f62e8e19d4ca80872240aaeedde5794ea5690f811a0fe809
                                        • Instruction Fuzzy Hash: 8CF0177494130CEFDB20DF94CD49B9CBBB5EB48310F2082A5A818BB2A0D7716A96DB44
                                        Function 00E09880 Relevance: 1.6, APIs: 1, Instructions: 68nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Close
                                        • String ID:
                                        • API String ID: 3535843008-0
                                        • Opcode ID: ff62fd5896d40fb817e0ccc99745ca2b119392e30d2a5fd4541c3b87fcf8a816
                                        • Instruction ID: e1bf5f992a44fe9045e1b8baea0a830d17d439dabd3fa0ca1751a96f6318102a
                                        • Opcode Fuzzy Hash: ff62fd5896d40fb817e0ccc99745ca2b119392e30d2a5fd4541c3b87fcf8a816
                                        • Instruction Fuzzy Hash: 2231BA71800208EFEB10CF95D948BEEBBB8FB04319F608159E415BA291D7769A49DF91
                                        Function 00E097D8 Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00E06844: RtlAllocateHeap.NTDLL(?,00000008,00E1B8B2,?,00E06DF9,00000166,?,?,?,?,00E0C080,00E1B8B2), ref: 00E06860
                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E09805
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AllocateHeapInformationQuerySystem
                                        • String ID:
                                        • API String ID: 3114120137-0
                                        • Opcode ID: fa1a33089f3cd6acce4a62f57d59b889575216bd5b9565659922b78974be36f7
                                        • Instruction ID: f3bcefa9fa6a3fb67a949d64cfee350b92aef32ee2ff7f37c864c0467395060e
                                        • Opcode Fuzzy Hash: fa1a33089f3cd6acce4a62f57d59b889575216bd5b9565659922b78974be36f7
                                        • Instruction Fuzzy Hash: 2E113D71D00108FBCF15DF95E880BDDBBB8EF05314F2091A2EA10BA292D7325A909B60
                                        Function 00E0B3C0 Relevance: 1.5, APIs: 1, Instructions: 43nativethreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtSetInformationThread.NTDLL(00000000,00000005,00000000,00000004), ref: 00E0B424
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationThread
                                        • String ID:
                                        • API String ID: 4046476035-0
                                        • Opcode ID: 2749253254a6f7731a6a4344eda315d6e41c99ca1ec379e87980dfa111be3eb9
                                        • Instruction ID: b7694fe893db19814e05a43d93a23102166fff306a5c48b79e957c690785127c
                                        • Opcode Fuzzy Hash: 2749253254a6f7731a6a4344eda315d6e41c99ca1ec379e87980dfa111be3eb9
                                        • Instruction Fuzzy Hash: 49018F71500208EFE710DF50DC89FAABBB8FB00719F508164E925AB1E1E3B58A48DBA0
                                        Function 00E05A20 Relevance: 1.5, APIs: 1, Instructions: 40libraryloaderCOMMON
                                        Download Yara Rule
                                        APIs
                                        • LdrLoadDll.NTDLL(00000000,00000000,00000000,?), ref: 00E05A71
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Load
                                        • String ID:
                                        • API String ID: 2234796835-0
                                        • Opcode ID: 6dac70d06b41c5d41105c67f67ca10985c0f3a97d06080ed69595b311fbb7b7e
                                        • Instruction ID: a98edafeb1b909ca6569d240d9c9e3ee5b879bc5fea4ec636f87ab3f02f91bff
                                        • Opcode Fuzzy Hash: 6dac70d06b41c5d41105c67f67ca10985c0f3a97d06080ed69595b311fbb7b7e
                                        • Instruction Fuzzy Hash: FEF03C36D0010DFECF10EE95D848FDEB7BCEB04324F5051A2A919B7080D230AB498FA0
                                        Function 00E0DC60 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtTerminateProcess.NTDLL(00E0DE18,00000000), ref: 00E0DCC3
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: ProcessTerminate
                                        • String ID:
                                        • API String ID: 560597551-0
                                        • Opcode ID: 0734c0f1c48e8eeaf409f20f46fa28f0e5c7a94ab4b8e202e2b05126dac28e67
                                        • Instruction ID: 897effb8894a2f79d4e2626613aaca688ab3c0c3bdc3a2d50c9bdd1558468a45
                                        • Opcode Fuzzy Hash: 0734c0f1c48e8eeaf409f20f46fa28f0e5c7a94ab4b8e202e2b05126dac28e67
                                        • Instruction Fuzzy Hash: 1001EC71900208EFDB10CF90CD48BDEBBB8FB04319F508198E515AB291D7B7964ACF91
                                        Function 00E0B674 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtQueryInformationToken.NTDLL(00E09EE2,00000001,?,0000002C,?), ref: 00E0B69E
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationQueryToken
                                        • String ID:
                                        • API String ID: 4239771691-0
                                        • Opcode ID: c61b85940564b22575245f0e41d8fead757eed7116dba2b9fbf8016df59e5c06
                                        • Instruction ID: ced767df2f957289a255ad139ca49845e9ce77ef9a7a2bcd702eb73d9928bad7
                                        • Opcode Fuzzy Hash: c61b85940564b22575245f0e41d8fead757eed7116dba2b9fbf8016df59e5c06
                                        • Instruction Fuzzy Hash: F4F03032601108AFEB20DB95ED85EADB77DFB05315FA00165F915F31E0E772AE948740
                                        Function 00E0982A Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E09805
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationQuerySystem
                                        • String ID:
                                        • API String ID: 3562636166-0
                                        • Opcode ID: ccccc190803f1cd7f40bab092970e3a97e33ff5863bd485330191cebd83db23b
                                        • Instruction ID: db58163bb4461a4db04a8dff1a6c43a8e7e3a5e64d0871dcec4267bd093fbc10
                                        • Opcode Fuzzy Hash: ccccc190803f1cd7f40bab092970e3a97e33ff5863bd485330191cebd83db23b
                                        • Instruction Fuzzy Hash: AAF0D035D04109EBDF19DF85E884BDCB7B8EF15311F20A092EA11BA293D3719AD0EB61
                                        Function 00E09811 Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E09805
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationQuerySystem
                                        • String ID:
                                        • API String ID: 3562636166-0
                                        • Opcode ID: e106ede51f8b5fd1766c63247da6b6d36e520dddf51cc0a91b5a8b496cff52b0
                                        • Instruction ID: db58163bb4461a4db04a8dff1a6c43a8e7e3a5e64d0871dcec4267bd093fbc10
                                        • Opcode Fuzzy Hash: e106ede51f8b5fd1766c63247da6b6d36e520dddf51cc0a91b5a8b496cff52b0
                                        • Instruction Fuzzy Hash: AAF0D035D04109EBDF19DF85E884BDCB7B8EF15311F20A092EA11BA293D3719AD0EB61
                                        Function 00E0B444 Relevance: 1.5, APIs: 1, Instructions: 18nativethreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtSetInformationThread.NTDLL(00000000,?,00000000,00000000), ref: 00E0B465
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InformationThread
                                        • String ID:
                                        • API String ID: 4046476035-0
                                        • Opcode ID: 3dfc8a2341b076ac77bc272e0013613ecd02fd2435d422418320dc368edfd4a2
                                        • Instruction ID: 8aa2db60c9284c4a1f342d2a22a5f7f5bdca2b32f227458eab6b756626a6b1f6
                                        • Opcode Fuzzy Hash: 3dfc8a2341b076ac77bc272e0013613ecd02fd2435d422418320dc368edfd4a2
                                        • Instruction Fuzzy Hash: 11D0A7325A020CEED710AF54DC45FF7335CE311316F104124B227D60D2E7B0A5D4C664
                                        Function 00E0BC38 Relevance: 9.2, APIs: 6, Instructions: 190COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 332 e0bc38-e0bc62 334 e0bc64 332->334 335 e0bc69-e0bc80 332->335 336 e0be8c-e0be90 334->336 342 e0bc82 335->342 343 e0bc87-e0bc94 call e06844 335->343 337 e0be92 336->337 338 e0be9b-e0be9f 336->338 337->338 340 e0bea1-e0bea4 DeleteDC 338->340 341 e0beaa-e0beae 338->341 340->341 345 e0beb0-e0beb3 call e0686c 341->345 346 e0beb8-e0bebc 341->346 342->336 351 e0bc96 343->351 352 e0bc9b-e0bcf6 call e01240 CreateDCW 343->352 345->346 349 e0bec7-e0becc 346->349 350 e0bebe 346->350 350->349 351->336 356 e0bcf8 352->356 357 e0bcfd-e0bdc7 call e01240 StartDocW 352->357 356->336 368 e0bdc9 357->368 369 e0bdce-e0bdd9 call e01720 357->369 368->336 372 e0bdde-e0bdea 369->372 374 e0bdec 372->374 375 e0bdee-e0be66 DrawTextA EndPage 372->375 376 e0be6c-e0be7b EndDoc call e01720 374->376 375->372 375->376 379 e0be80-e0be83 376->379 379->336
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Delete
                                        • String ID:
                                        • API String ID: 1035893169-0
                                        • Opcode ID: c7675cb77346cbd909f26bcbc1caab5ff60ec7b0729659b595acec20e8a929be
                                        • Instruction ID: 0d159785c89d67f29c9115a5f4635ef42385425e1251483bdf94f8c21b0b505a
                                        • Opcode Fuzzy Hash: c7675cb77346cbd909f26bcbc1caab5ff60ec7b0729659b595acec20e8a929be
                                        • Instruction Fuzzy Hash: 04812472840609EFDF219FA0DD49BEEBB75FB04305F204065F605BA1A0C7764A96EF50
                                        Function 00E0C28C Relevance: 7.6, APIs: 5, Instructions: 134fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 552 e0c28c-e0c2b7 CreateFileW 553 e0c3ed-e0c3f3 552->553 554 e0c2bd-e0c2d6 552->554 555 e0c2dc-e0c2ee call e017ac 554->555 558 e0c2f5-e0c318 WriteFile 555->558 559 e0c31a-e0c329 558->559 560 e0c32c-e0c351 WriteFile 558->560 561 e0c353-e0c362 560->561 562 e0c365-e0c388 WriteFile 560->562 564 e0c38a-e0c399 562->564 565 e0c39c-e0c3c1 WriteFile 562->565 566 e0c3c3-e0c3d2 565->566 567 e0c3d5-e0c3e2 565->567 567->558 570 e0c3e8 567->570 570->555
                                        APIs
                                        • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000), ref: 00E0C2AA
                                        • WriteFile.KERNELBASE(000000FF,?,00000001,00000000,00000000,00E26000,?,?,?,00000000), ref: 00E0C30B
                                        • WriteFile.KERNELBASE(000000FF,?,00000001,00000000,00000000,?,?,00000000), ref: 00E0C344
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$Write$Create
                                        • String ID:
                                        • API String ID: 1602526932-0
                                        • Opcode ID: 4f588fd7e1ca29211bfed29a84989ebf602294cae81ed5804d141eef494d7a49
                                        • Instruction ID: 35d69dd0a043a784fc2ba729446821b6b9e64ff0ce2de654738e38027223ae95
                                        • Opcode Fuzzy Hash: 4f588fd7e1ca29211bfed29a84989ebf602294cae81ed5804d141eef494d7a49
                                        • Instruction Fuzzy Hash: 53414A32A4020CEFDB10DBD5ED05BEEFBBAEB54322F6081A6E604F2191D3710A55DB91
                                        Function 00E0782C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 295COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 572 e0782c-e0785b CoInitialize 573 e07861-e07ac4 call e01240 * 10 572->573 574 e07c9f-e07ca2 572->574 596 e07ac6 573->596 597 e07acb-e07ae3 573->597 598 e07c55-e07c59 596->598 604 e07ae5 597->604 605 e07aea-e07af9 call e06e54 597->605 600 e07c66-e07c6a 598->600 601 e07c5b-e07c60 598->601 602 e07c77-e07c7b 600->602 603 e07c6c-e07c71 600->603 601->600 606 e07c88-e07c8c 602->606 607 e07c7d-e07c82 602->607 603->602 604->598 612 e07afb-e07b25 605->612 613 e07b3e-e07b63 605->613 610 e07c99 CoUninitialize 606->610 611 e07c8e-e07c93 606->611 607->606 610->574 611->610 620 e07b2b-e07b2d 612->620 616 e07b65 613->616 617 e07b6a-e07b83 CoSetProxyBlanket 613->617 616->598 618 e07b85 617->618 619 e07b8a-e07bad 617->619 618->598 624 e07bb4-e07bd3 619->624 625 e07baf 619->625 621 e07b34-e07b37 620->621 622 e07b2f 620->622 621->613 622->598 626 e07bd9-e07bdb 624->626 625->598 627 e07bdd 626->627 628 e07bdf-e07c07 626->628 627->598 631 e07c45-e07c50 628->631 632 e07c09-e07c3e 628->632 631->598 631->624 632->631
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InitializeUninitialize
                                        • String ID: @
                                        • API String ID: 3442037557-2766056989
                                        • Opcode ID: da8b5bef5f7045bd431750750c54a1646a33a40cef576232f4e5aa4b0a91cbe4
                                        • Instruction ID: 42f6fecec84e0a44a7030679b959fe5d8d32ed9463d3dcabad8c63607bedc5d1
                                        • Opcode Fuzzy Hash: da8b5bef5f7045bd431750750c54a1646a33a40cef576232f4e5aa4b0a91cbe4
                                        • Instruction Fuzzy Hash: 4ED107B490020AEFDB10CF90C988F9ABB79FF04304F159195E514AF2A1D779EA85CF65
                                        Function 00E0E45C Relevance: 6.1, APIs: 4, Instructions: 61fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 722 e0e45c-e0e49a SetFileAttributesW CreateFileW 723 e0e511-e0e518 722->723 724 e0e49c-e0e4b9 SetFilePointerEx 722->724 725 e0e508 724->725 726 e0e4bb-e0e4d8 ReadFile 724->726 725->723 726->725 727 e0e4da-e0e4ef call e0e350 726->727 727->725 730 e0e4f1-e0e4f9 727->730 731 e0e502-e0e503 call e0686c 730->731 732 e0e4fb 730->732 731->725 732->731
                                        APIs
                                        • SetFileAttributesW.KERNELBASE(00000000,00000080,?), ref: 00E0E475
                                        • CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00E0E48D
                                        • SetFilePointerEx.KERNELBASE(000000FF,-00000084,00000000,00000000,00000002), ref: 00E0E4B1
                                        • ReadFile.KERNELBASE(000000FF,?,00000084,?,00000000), ref: 00E0E4D0
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$AttributesCreatePointerRead
                                        • String ID:
                                        • API String ID: 4170910816-0
                                        • Opcode ID: 2d7e275902c3a904450d8a167cc6cd1dacb4aa1e1219c4a7f0f3571768c32545
                                        • Instruction ID: 05eac2940ba8ece16b72bb40ae1fae43ee10222f9431fb52be8320bc18183ecc
                                        • Opcode Fuzzy Hash: 2d7e275902c3a904450d8a167cc6cd1dacb4aa1e1219c4a7f0f3571768c32545
                                        • Instruction Fuzzy Hash: 2E113D71A40308BFEB209FA1DD49FAD7AB9BB04704F5084A4B605B61E0EB71AA958B14
                                        Function 00E0EF6C Relevance: 4.6, APIs: 3, Instructions: 139fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 734 e0ef6c-e0ef87 735 e0f155-e0f15e 734->735 736 e0ef8d-e0ef97 call e0e3ac 734->736 739 e0f14d-e0f150 call e0686c 736->739 740 e0ef9d-e0efa7 call e0e45c 736->740 739->735 740->739 744 e0efad-e0efb7 call e0ebd8 740->744 747 e0efb9-e0efca call e0ec00 744->747 748 e0efcc-e0efd5 call e0ece4 744->748 753 e0efdd-e0efe1 747->753 752 e0efda 748->752 752->753 753->739 754 e0efe7-e0eff7 MoveFileExW 753->754 755 e0eff9 754->755 756 e0effb-e0f006 754->756 759 e0f047-e0f04b 755->759 757 e0f034-e0f043 call e0686c 756->757 758 e0f008-e0f02c call e0686c call e0ece4 756->758 757->759 774 e0f030 758->774 775 e0f02e 758->775 762 e0f051-e0f073 CreateFileW 759->762 763 e0f13f-e0f143 759->763 766 e0f075 762->766 767 e0f07a-e0f093 call e0ed30 762->767 763->739 768 e0f145-e0f148 call e0686c 763->768 766->763 777 e0f0a3-e0f0b8 CreateIoCompletionPort 767->777 778 e0f095-e0f09e 767->778 768->739 774->754 775->759 779 e0f0ba-e0f0da call e0686c 777->779 780 e0f0dc-e0f0fe 777->780 778->763 779->763 784 e0f100-e0f120 call e0686c 780->784 785 e0f122-e0f138 780->785 784->763 785->763
                                        APIs
                                          • Part of subcall function 00E0E3AC: SetFileAttributesW.KERNELBASE(00000000,00000080,?,00000000,?,?,?), ref: 00E0E3CD
                                          • Part of subcall function 00E0E3AC: CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 00E0E3E5
                                          • Part of subcall function 00E0E45C: SetFileAttributesW.KERNELBASE(00000000,00000080,?), ref: 00E0E475
                                          • Part of subcall function 00E0E45C: CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00E0E48D
                                          • Part of subcall function 00E0E45C: SetFilePointerEx.KERNELBASE(000000FF,-00000084,00000000,00000000,00000002), ref: 00E0E4B1
                                          • Part of subcall function 00E0E45C: ReadFile.KERNELBASE(000000FF,?,00000084,?,00000000), ref: 00E0E4D0
                                        • MoveFileExW.KERNELBASE(00000000,00000000,00000008,00000000,00000000,00000000,00000000,?,00000000,?), ref: 00E0EFEF
                                        • CreateIoCompletionPort.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 00E0F0B0
                                        • CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,40000000,00000000,00000000,?,00000000,?), ref: 00E0F066
                                          • Part of subcall function 00E0686C: RtlFreeHeap.NTDLL(?,00000000,00E1B8B2,?,00E0C195,00000000,00E1B8B2), ref: 00E06888
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$Create$Attributes$CompletionFreeHeapMovePointerPortRead
                                        • String ID:
                                        • API String ID: 97630321-0
                                        • Opcode ID: 9f5ef60c8aefc9a84230aa53db428c318a8df4e785f9232b64d4449173a86fd6
                                        • Instruction ID: 89a199e1d5f99c056e186843c554e73cf9fa17b2a967987c3995090613f95b0e
                                        • Opcode Fuzzy Hash: 9f5ef60c8aefc9a84230aa53db428c318a8df4e785f9232b64d4449173a86fd6
                                        • Instruction Fuzzy Hash: F0512631900608FFDF256FA1ED09BADBBB5AB00319F10A474F515B51E2C7765AA6DF00
                                        Function 00E0C19C Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 795 e0c19c-e0c1b1 796 e0c1b3 795->796 797 e0c1b8-e0c1c9 call e06934 795->797 798 e0c283-e0c287 796->798 801 e0c1d0-e0c1de GetFileAttributesW 797->801 802 e0c1cb 797->802 803 e0c1e0-e0c1fa call e016c0 801->803 804 e0c1fc-e0c21c call e016c0 801->804 802->798 811 e0c21f-e0c223 803->811 804->811 813 e0c225-e0c23c call e0c28c call e0686c 811->813 814 e0c23e-e0c244 811->814 813->798 816 e0c255-e0c260 GetFileAttributesW 814->816 817 e0c246-e0c249 call e0c28c 814->817 818 e0c262-e0c26c call e0686c 816->818 819 e0c26e-e0c27e CopyFileW call e0686c 816->819 825 e0c24e-e0c253 817->825 818->817 819->798 825->798
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: c2532f624c78c60949eefd82e9207201b84d3090d0ac085b98f649c9aa86a268
                                        • Instruction ID: a81eb1c1599116270efa20982a486defd576a430a0a52c8b6e4b589909130aee
                                        • Opcode Fuzzy Hash: c2532f624c78c60949eefd82e9207201b84d3090d0ac085b98f649c9aa86a268
                                        • Instruction Fuzzy Hash: 50210731801908EFDF21AFA5EE4679C7BB2AF05715F3062A0F411791F1C7720AA8BB11
                                        Function 00E0A488 Relevance: 4.6, APIs: 3, Instructions: 51threadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateThread.KERNELBASE(00000000,00000000,Function_0000A470,?,00000004,00000000), ref: 00E0A4B9
                                        • ResumeThread.KERNELBASE(00000000), ref: 00E0A4FD
                                        • GetExitCodeThread.KERNELBASE(00000000,00000000), ref: 00E0A515
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Thread$CodeCreateExitResume
                                        • String ID:
                                        • API String ID: 4070214711-0
                                        • Opcode ID: 86ae5ddb065137562fbc05c19508caa7d89ae92f9a41eb15b9ffe5a7a86472ae
                                        • Instruction ID: 623e40c83bc5aa022b55796411481fa6328e28c1ef0cfcfb54b1fd7f585104fe
                                        • Opcode Fuzzy Hash: 86ae5ddb065137562fbc05c19508caa7d89ae92f9a41eb15b9ffe5a7a86472ae
                                        • Instruction Fuzzy Hash: 9311023594020CFFDB20DF94DE09BADBBB5FB04316F2481A5F925B22A0D7715A94EB40
                                        Function 00E0A1C0 Relevance: 4.5, APIs: 3, Instructions: 46threadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateThread.KERNELBASE(00000000,00000000,Function_0000A1B0,?,00000004,00000000), ref: 00E0A1E4
                                        • ResumeThread.KERNELBASE(00000000), ref: 00E0A228
                                        • GetExitCodeThread.KERNELBASE(00000000,00000000), ref: 00E0A240
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Thread$CodeCreateExitResume
                                        • String ID:
                                        • API String ID: 4070214711-0
                                        • Opcode ID: 60d3f2e0b30df279b8d3256902f3a189690339cebcee9b8a2ed589cc299febe3
                                        • Instruction ID: a32d23992991b15380b543717713c181081361d5d1fb7aa6c6ab3066f62ddb71
                                        • Opcode Fuzzy Hash: 60d3f2e0b30df279b8d3256902f3a189690339cebcee9b8a2ed589cc299febe3
                                        • Instruction Fuzzy Hash: AF11D332940208FFDB219F90EE0AB9CBB72EB04316F2441A4B915B61F0D7725A95EB41
                                        Function 00E08DA8 Relevance: 3.1, APIs: 2, Instructions: 78COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00E097D8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E09805
                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000001,7DDDCD9C), ref: 00E08DE6
                                        • QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00E08E79
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Query$InformationManagerOpenServiceStatusSystem
                                        • String ID:
                                        • API String ID: 1704657127-0
                                        • Opcode ID: a81293d443e554d5e8515294c7db79f84e9f756731e5d10b715542b4cf7f942f
                                        • Instruction ID: f6f247aa03e205187591132cbe46f064c84f1f584bcf30c64b15bdb8a1ae7d24
                                        • Opcode Fuzzy Hash: a81293d443e554d5e8515294c7db79f84e9f756731e5d10b715542b4cf7f942f
                                        • Instruction Fuzzy Hash: 67310C70900608EFDB10CF90CE49BADBBB4EF04705F549095E542BB2E1DBB59A86CF51
                                        Function 00E0E3AC Relevance: 3.1, APIs: 2, Instructions: 58fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SetFileAttributesW.KERNELBASE(00000000,00000080,?,00000000,?,?,?), ref: 00E0E3CD
                                        • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 00E0E3E5
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$AttributesCreate
                                        • String ID:
                                        • API String ID: 415043291-0
                                        • Opcode ID: ad7a93c36d7b1d4374ac83baae67597290b5ad2e4fffc85a084cab6cbee9b93e
                                        • Instruction ID: dd9b4573f1f15ac169daba596292a158f9cf063597e1c4cb75d4b7631082518e
                                        • Opcode Fuzzy Hash: ad7a93c36d7b1d4374ac83baae67597290b5ad2e4fffc85a084cab6cbee9b93e
                                        • Instruction Fuzzy Hash: 19118C31905208FAEB214B90ED49BADBB74EB10725F60AA3AF521752E0C3B46AC59A45
                                        Function 00E0F032 Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • MoveFileExW.KERNELBASE(00000000,00000000,00000008,00000000,00000000,00000000,00000000,?,00000000,?), ref: 00E0EFEF
                                        • CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,40000000,00000000,00000000,?,00000000,?), ref: 00E0F066
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$CreateMove
                                        • String ID:
                                        • API String ID: 3198096935-0
                                        • Opcode ID: 13ac2dace97b9b213429995aeae53c124e5f3791a381b40236c78fb8020e46fd
                                        • Instruction ID: dd6055a0eba2a0cf8898319b3219fb336031efbf0d3b408d4fcf871ce6b1771b
                                        • Opcode Fuzzy Hash: 13ac2dace97b9b213429995aeae53c124e5f3791a381b40236c78fb8020e46fd
                                        • Instruction Fuzzy Hash: 3BF04431E40208FADF315B95EC05BECBB71EB00329F2091B2F611B41E1C7752AE1EA04
                                        Function 00E0E430 Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON
                                        Download Yara Rule
                                        APIs
                                        • SetFileAttributesW.KERNELBASE(00000000,00000080,?,00000000,?,?,?), ref: 00E0E3CD
                                        • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 00E0E3E5
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: File$AttributesCreate
                                        • String ID:
                                        • API String ID: 415043291-0
                                        • Opcode ID: f8564f249560f8ccaadf0eab9aeba2b66b98d3881769241497754ef94058e0c0
                                        • Instruction ID: 4d84ad46b56ca926c37fdbf28714df7ed034dd9da96f6860c6c625a080600f19
                                        • Opcode Fuzzy Hash: f8564f249560f8ccaadf0eab9aeba2b66b98d3881769241497754ef94058e0c0
                                        • Instruction Fuzzy Hash: 5BE04831584704FAEB311BA0DD06F683A21EB04764F606931F621B81E0C7B4AAC1DB05
                                        Function 00E0F82C Relevance: 2.8, APIs: 2, Instructions: 302COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InitializeUninitialize
                                        • String ID:
                                        • API String ID: 3442037557-0
                                        • Opcode ID: 3456aeb3e03a09533f09f90f1d0a471e6c0daffd4bb663efe19ac9805f739ddc
                                        • Instruction ID: fbc62c9302e1e1ce5612893cf3c7ebad8b83ee134c67b78d4c881c8c1f1ec9b9
                                        • Opcode Fuzzy Hash: 3456aeb3e03a09533f09f90f1d0a471e6c0daffd4bb663efe19ac9805f739ddc
                                        • Instruction Fuzzy Hash: DAC14B7594020AEFDB20DF90D949B9ABBBCFF00704F1180A5E504AF2A1D739DA99CF65
                                        Function 00E0782A Relevance: 2.7, APIs: 2, Instructions: 159COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: InitializeUninitialize
                                        • String ID:
                                        • API String ID: 3442037557-0
                                        • Opcode ID: 357892e48001de2fb664e5350697b633b679617b2b3f9abbff500ce97185670b
                                        • Instruction ID: 41795d61ba161d5bc181ebcb60a63c1866cc5b7d5c11b16ea2598be522e41d57
                                        • Opcode Fuzzy Hash: 357892e48001de2fb664e5350697b633b679617b2b3f9abbff500ce97185670b
                                        • Instruction Fuzzy Hash: 968104B8810306DFD720DF50D988F89BBB8FF05354F56919895186F2A2C37ADA84CF66
                                        Function 00E10BE4 Relevance: 1.7, APIs: 1, Instructions: 184COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CreateThread
                                        • String ID:
                                        • API String ID: 2422867632-0
                                        • Opcode ID: d911b90b0a3f8469a2c90f89f922206523cd05a488db5f1f130ae07fe62b2ee0
                                        • Instruction ID: 35b7ac7acc492f869e232d5d79de4ea818859778dca30a42d74554ddf18fd807
                                        • Opcode Fuzzy Hash: d911b90b0a3f8469a2c90f89f922206523cd05a488db5f1f130ae07fe62b2ee0
                                        • Instruction Fuzzy Hash: 2961773190060AEFDF24AFE1ED45BEEBBB0EB04308F206125E511761A0D7B56AD6DF90
                                        Function 00E0639C Relevance: 1.6, APIs: 1, Instructions: 134memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000), ref: 00E063C5
                                          • Part of subcall function 00E0B444: NtSetInformationThread.NTDLL(00000000,?,00000000,00000000), ref: 00E0B465
                                          • Part of subcall function 00E0B470: NtProtectVirtualMemory.NTDLL(000000FF,00000000,00000020,00000040,?), ref: 00E0B4B1
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CreateHeapInformationMemoryProtectThreadVirtual
                                        • String ID:
                                        • API String ID: 2986011945-0
                                        • Opcode ID: 57294bb2efeee6727aeb428b474000ebee4b7101bc3a29a860c2ddd6cca34c10
                                        • Instruction ID: 3474072230fbb1e6be02d4c0f2fe446b5426f47b05bb654c3654ee9fc83b229e
                                        • Opcode Fuzzy Hash: 57294bb2efeee6727aeb428b474000ebee4b7101bc3a29a860c2ddd6cca34c10
                                        • Instruction Fuzzy Hash: 0E3171323C2BB178C07432A6AD0FF9F1DAC8ED2FA57D03516B448B51D689F464D088B9
                                        Function 00E09AF9 Relevance: 1.6, APIs: 1, Instructions: 126synchronizationCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateMutexW.KERNELBASE(0000000C,00000001,?), ref: 00E09C4B
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CreateMutex
                                        • String ID:
                                        • API String ID: 1964310414-0
                                        • Opcode ID: 451aa8395fa156af1b5c82a2171f8dcd78a8d79003de9c2ac01041d163901405
                                        • Instruction ID: 232f3ac762d4d58ec847abe735373051585a69765822a7facb4f6cfc9e798045
                                        • Opcode Fuzzy Hash: 451aa8395fa156af1b5c82a2171f8dcd78a8d79003de9c2ac01041d163901405
                                        • Instruction Fuzzy Hash: 2851697584E7C49FE7135BB09D653947FB1AF0B224F1A00D7D480DE0B3E2A9099ACB22
                                        Function 00E07CA4 Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                        Download Yara Rule
                                        APIs
                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000004), ref: 00E07CBF
                                          • Part of subcall function 00E06844: RtlAllocateHeap.NTDLL(?,00000008,00E1B8B2,?,00E06DF9,00000166,?,?,?,?,00E0C080,00E1B8B2), ref: 00E06860
                                          • Part of subcall function 00E0DC60: NtTerminateProcess.NTDLL(00E0DE18,00000000), ref: 00E0DCC3
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AllocateHeapManagerOpenProcessTerminate
                                        • String ID:
                                        • API String ID: 3645570960-0
                                        • Opcode ID: 5c49ca0dab935fe7a80eb73aff7a69ba26a7974006bce19a13b0a9b8c1e52309
                                        • Instruction ID: 48c062e15b2fb223d71f959842a341253fb41c7f2dd9defb71906df6e0d150d2
                                        • Opcode Fuzzy Hash: 5c49ca0dab935fe7a80eb73aff7a69ba26a7974006bce19a13b0a9b8c1e52309
                                        • Instruction Fuzzy Hash: BB410231D40209FFEB219B91DD0ABEEBBB9AF08705F508065F641B60E0DBB16A94DB50
                                        Function 00E05DA0 Relevance: 1.6, APIs: 1, Instructions: 106memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00E05C24: FindFirstFileW.KERNELBASE(?,?,?,00000004), ref: 00E05CF7
                                          • Part of subcall function 00E05C24: FindClose.KERNELBASE(000000FF,?,00000000), ref: 00E05D1C
                                        • RtlAllocateHeap.NTDLL(?,00000000,00000010), ref: 00E05DE4
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Find$AllocateCloseFileFirstHeap
                                        • String ID:
                                        • API String ID: 1673784098-0
                                        • Opcode ID: 2ae33102ee66003cac4379c346f7f87c6499627a6f0d31f5b2793e57057bd50b
                                        • Instruction ID: ff8df160eca1ffdd99d4a25c4a2a438ac23c9049b796d2bebe3efe3bf894c4b9
                                        • Opcode Fuzzy Hash: 2ae33102ee66003cac4379c346f7f87c6499627a6f0d31f5b2793e57057bd50b
                                        • Instruction Fuzzy Hash: 4831C2366047029ED721CF68C880756FA94BF11311F18E7A9E149AF2D3EAA184C1CB96
                                        Function 00E090BC Relevance: 1.6, APIs: 1, Instructions: 78serviceCOMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00E0903C: RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00E0905E
                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 00E091AF
                                          • Part of subcall function 00E0DC60: NtTerminateProcess.NTDLL(00E0DE18,00000000), ref: 00E0DCC3
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AdjustCloseHandlePrivilegeProcessServiceTerminate
                                        • String ID:
                                        • API String ID: 3176663195-0
                                        • Opcode ID: 18abd503773dc17d949ac59982ca18aa8dcef1c9a2135dedf24881ab83456e0f
                                        • Instruction ID: 18d68e341e0ab1cf4032839768d05d78cfec8229cc6ff5d62923525a3309fa86
                                        • Opcode Fuzzy Hash: 18abd503773dc17d949ac59982ca18aa8dcef1c9a2135dedf24881ab83456e0f
                                        • Instruction Fuzzy Hash: CF314771940209EFEB209FA1DD0DB9DBBB9AF04705F4440A4F604BA1E2DB759A89CB10
                                        Function 00E06550 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: ac8e776c8261da6007c025114f85f2ea45f31ef69caf780022c39a93c3da0e75
                                        • Instruction ID: 5afe1e6cf9c1fea9af7d96e4f8c3c1eae7450896e119a6dc78231094fb3b99b5
                                        • Opcode Fuzzy Hash: ac8e776c8261da6007c025114f85f2ea45f31ef69caf780022c39a93c3da0e75
                                        • Instruction Fuzzy Hash: 17212731941208EFDF20AF94EC45BA9BBB1FF15305F5460B4E8047A2A1E7314AA4EB44
                                        Function 00E09BB0 Relevance: 1.5, APIs: 1, Instructions: 46synchronizationCOMMON
                                        Download Yara Rule
                                        APIs
                                        • CreateMutexW.KERNELBASE(0000000C,00000001,?), ref: 00E09C4B
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CreateMutex
                                        • String ID:
                                        • API String ID: 1964310414-0
                                        • Opcode ID: 0029959f0919e4fcb4b075d59a8642864baf9d44603fed3ebe9cff95e6a10fe4
                                        • Instruction ID: ae4581336dd694de3c0791d6ceb4588999572f3c1f88ca470457d157dc0b4351
                                        • Opcode Fuzzy Hash: 0029959f0919e4fcb4b075d59a8642864baf9d44603fed3ebe9cff95e6a10fe4
                                        • Instruction Fuzzy Hash: 8511E531C05B04EEF721EFA2EE0A7ACBBB4AB04300F140055F900B91E2D3B519D9DB08
                                        Function 00E0903C Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00E0905E
                                          • Part of subcall function 00E097D8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00E09805
                                          • Part of subcall function 00E09880: NtClose.NTDLL(00000000), ref: 00E09971
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AdjustCloseInformationPrivilegeQuerySystem
                                        • String ID:
                                        • API String ID: 327775174-0
                                        • Opcode ID: 4b081e02f8a83662b2b496fde1a79e750a19530f0ea4dfd937e25cc42db41196
                                        • Instruction ID: 67cb0f0cb7227c8afea26da4f64dc6313d312f344b96639233c571bba40ce706
                                        • Opcode Fuzzy Hash: 4b081e02f8a83662b2b496fde1a79e750a19530f0ea4dfd937e25cc42db41196
                                        • Instruction Fuzzy Hash: 6A01F471940308BFEB20AFA5CD4DFDDBAB8AB00715F144194B515BA2D2E7B64AC4C791
                                        Function 00E08EA2 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                        Download Yara Rule
                                        APIs
                                        • QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00E08E79
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: QueryServiceStatus
                                        • String ID:
                                        • API String ID: 3328863396-0
                                        • Opcode ID: 18c4ce9171662b02196de1a0816ce03b13918fb1441be1643450780fa646e91f
                                        • Instruction ID: ab3eaeb7ad9ad2315879939019545543d35faf1df10ee3d2da4e0b0a6f7d448f
                                        • Opcode Fuzzy Hash: 18c4ce9171662b02196de1a0816ce03b13918fb1441be1643450780fa646e91f
                                        • Instruction Fuzzy Hash: 69F01531900108EFEB20CB80DF08BFDBBB8EF00309F500095A900B11E0CB711E9ADA12
                                        Function 00E0B708 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlAdjustPrivilege.NTDLL(?,00000001,00000000,?), ref: 00E0B727
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AdjustPrivilege
                                        • String ID:
                                        • API String ID: 3260937286-0
                                        • Opcode ID: 7ef7b6e426ae182839f95ad1eafbcfd01452ee6a23601322fcd283b4658bbcc1
                                        • Instruction ID: f64ad0a82beb0c059d5df2ddde3c2a4fcce103ebe6e8b2c7dd662663d37979f9
                                        • Opcode Fuzzy Hash: 7ef7b6e426ae182839f95ad1eafbcfd01452ee6a23601322fcd283b4658bbcc1
                                        • Instruction Fuzzy Hash: 64D0C2221041156AC63016582C01BF2336CE780321F100312AD02FB0D0EB62598801E1
                                        Function 00E0B4CD Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                        Download Yara Rule
                                        APIs
                                        • CheckTokenMembership.KERNELBASE(00000000,00E0B4CC,?), ref: 00E0B4ED
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CheckMembershipToken
                                        • String ID:
                                        • API String ID: 1351025785-0
                                        • Opcode ID: 616ce8deb0dbb6fd5ac61db52eafa343a53e648ef0453b3bfb62b5d6802ff313
                                        • Instruction ID: 149f30170cceb17a55425dd201e6e650d6303aefe88d9ffed44834fb7883a70d
                                        • Opcode Fuzzy Hash: 616ce8deb0dbb6fd5ac61db52eafa343a53e648ef0453b3bfb62b5d6802ff313
                                        • Instruction Fuzzy Hash: A5E0122154D3C85FD30287A4DC557657F78DF07520F0802D2E898D72D3D6545E199392
                                        Function 00E06894 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlReAllocateHeap.NTDLL(?,00000008,?,00000400,?,00E09825,?,00000400), ref: 00E068B3
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AllocateHeap
                                        • String ID:
                                        • API String ID: 1279760036-0
                                        • Opcode ID: c5746a84b503bb377e6ce8a7648a6afc9a008abf39878b50fddf8a22928a95e1
                                        • Instruction ID: 6971651aabb7feaaf133f9732542de920a978c80501a8ccdcc37e493d8376bd1
                                        • Opcode Fuzzy Hash: c5746a84b503bb377e6ce8a7648a6afc9a008abf39878b50fddf8a22928a95e1
                                        • Instruction Fuzzy Hash: 2BD0A731040604AFDB546F549C05FCA7728BB10300F40C050FA845A0A1C771D5A4EB50
                                        Function 00E0686C Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlFreeHeap.NTDLL(?,00000000,00E1B8B2,?,00E0C195,00000000,00E1B8B2), ref: 00E06888
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: FreeHeap
                                        • String ID:
                                        • API String ID: 3298025750-0
                                        • Opcode ID: 9ea3e7f0064a1f242a33431c851832ffb86eb130a1bbd420cd0aef604d99fc61
                                        • Instruction ID: c4513d917cabe692b68275dc7bddbdbfad46a214ec434d60ddafa6fd462699e6
                                        • Opcode Fuzzy Hash: 9ea3e7f0064a1f242a33431c851832ffb86eb130a1bbd420cd0aef604d99fc61
                                        • Instruction Fuzzy Hash: 62D012311407049FD724AF58A905FDA7768AB14704F854451B7899B0E1C775E9E0DAA4
                                        Function 00E06844 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlAllocateHeap.NTDLL(?,00000008,00E1B8B2,?,00E06DF9,00000166,?,?,?,?,00E0C080,00E1B8B2), ref: 00E06860
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AllocateHeap
                                        • String ID:
                                        • API String ID: 1279760036-0
                                        • Opcode ID: 7c9bfd43ccf9dd7f002d31b02f70e801975286596ea346a33028d7549daaa122
                                        • Instruction ID: aece910156a65f14908ba56b03b907924c4d612b0f3ac3cb085135f586cd97d2
                                        • Opcode Fuzzy Hash: 7c9bfd43ccf9dd7f002d31b02f70e801975286596ea346a33028d7549daaa122
                                        • Instruction Fuzzy Hash: E0D022310407049FC314AF59A905FC63728AB10306F448010B3885B0A1CB71D8E0DBA0
                                        Function 00E0B4DC Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                        Download Yara Rule
                                        APIs
                                        • CheckTokenMembership.KERNELBASE(00000000,00E0B4CC,?), ref: 00E0B4ED
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CheckMembershipToken
                                        • String ID:
                                        • API String ID: 1351025785-0
                                        • Opcode ID: 07a7f35429eb2ea3a450f808dae155de8984b919eebba6602b5f0a705f54797f
                                        • Instruction ID: 87532da4b638f73fa616a4d26a236d7d9b92372413b21079e7997e956a51ea2b
                                        • Opcode Fuzzy Hash: 07a7f35429eb2ea3a450f808dae155de8984b919eebba6602b5f0a705f54797f
                                        • Instruction Fuzzy Hash: D1C0123554420CABD650D694AD46A69B36CD704621F500390AD1CA22C1E7615F1445D1
                                        Function 00E0A470 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                        Download Yara Rule
                                        APIs
                                        • GetLogicalDriveStringsW.KERNELBASE(?,?), ref: 00E0A47B
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: DriveLogicalStrings
                                        • String ID:
                                        • API String ID: 2022863570-0
                                        • Opcode ID: 81a670eace85fdb63518e0c24ba47731eef6990ed598d7aa1ee5d42fdabab44a
                                        • Instruction ID: e5126d2ee07c94c2eee27f250a12d392f11a1ebb20cdb9ae9f2bada58da708d6
                                        • Opcode Fuzzy Hash: 81a670eace85fdb63518e0c24ba47731eef6990ed598d7aa1ee5d42fdabab44a
                                        • Instruction Fuzzy Hash: 1DC09237040208EF8B019F89EE48C85BFEAEB187007048062F6084B131CB32E825EB95
                                        Function 00E0A1B0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                        Download Yara Rule
                                        APIs
                                        • GetDriveTypeW.KERNELBASE(?), ref: 00E0A1B6
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: DriveType
                                        • String ID:
                                        • API String ID: 338552980-0
                                        • Opcode ID: bccbe1b8703a3181a6e13669da82300e8f394a7c19baf355e50eddab89eb4826
                                        • Instruction ID: 080f0715a7a631578487bed42e2ca5ae45b50eb0a9b3cf4dca33bea00efa3e26
                                        • Opcode Fuzzy Hash: bccbe1b8703a3181a6e13669da82300e8f394a7c19baf355e50eddab89eb4826
                                        • Instruction Fuzzy Hash: 3EB0123204010CAB86005B42EC048857F5DD7102717004022F5040002087325462D994
                                        Function 00E0F8F0 Relevance: 1.4, APIs: 1, Instructions: 107COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00E06844: RtlAllocateHeap.NTDLL(?,00000008,00E1B8B2,?,00E06DF9,00000166,?,?,?,?,00E0C080,00E1B8B2), ref: 00E06860
                                        • CoUninitialize.COMBASE ref: 00E0FC71
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AllocateHeapUninitialize
                                        • String ID:
                                        • API String ID: 3904538627-0
                                        • Opcode ID: 441eb95f55b2ed677212d7bb709fa14780ebd72f1bebf17c5d0dd5e9e9949106
                                        • Instruction ID: b7227b54fe1cc2a27a7a74d54d689dff9f874c147ae69413156c45d13f53fbe0
                                        • Opcode Fuzzy Hash: 441eb95f55b2ed677212d7bb709fa14780ebd72f1bebf17c5d0dd5e9e9949106
                                        • Instruction Fuzzy Hash: 34416C75900209EFDB20DF50D989B9DBBB8FF00300F2090A5E601BF2A2D7359A99CF65
                                        Function 00E0F8FB Relevance: 1.4, APIs: 1, Instructions: 107COMMON
                                        Download Yara Rule
                                        APIs
                                          • Part of subcall function 00E06844: RtlAllocateHeap.NTDLL(?,00000008,00E1B8B2,?,00E06DF9,00000166,?,?,?,?,00E0C080,00E1B8B2), ref: 00E06860
                                        • CoUninitialize.COMBASE ref: 00E0FC71
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AllocateHeapUninitialize
                                        • String ID:
                                        • API String ID: 3904538627-0
                                        • Opcode ID: 94c944389b9cf950bb85e38798a7b1614d7850df3ed538e72a6d3b9c79a3612d
                                        • Instruction ID: b7227b54fe1cc2a27a7a74d54d689dff9f874c147ae69413156c45d13f53fbe0
                                        • Opcode Fuzzy Hash: 94c944389b9cf950bb85e38798a7b1614d7850df3ed538e72a6d3b9c79a3612d
                                        • Instruction Fuzzy Hash: 34416C75900209EFDB20DF50D989B9DBBB8FF00300F2090A5E601BF2A2D7359A99CF65
                                        Function 00E0DE48 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                        Download Yara Rule
                                        APIs
                                        • Sleep.KERNELBASE(000000C8,?,?,00E0E405,00000000,?,00000000,?,?,?), ref: 00E0DE6B
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Sleep
                                        • String ID:
                                        • API String ID: 3472027048-0
                                        • Opcode ID: 349e715ded6a2049339e7f01dfc37c2233abf61b960fcdd292e893775fdbc2be
                                        • Instruction ID: 68c0354fff4515341a220be396e60558b3b6de5d45427945bb12377aff3e17e6
                                        • Opcode Fuzzy Hash: 349e715ded6a2049339e7f01dfc37c2233abf61b960fcdd292e893775fdbc2be
                                        • Instruction Fuzzy Hash: 13D0A77270D3052BEB107AE59CC180EF64D6B10354B00A133F600AA181C9B1C8958354

                                        Non-executed Functions

                                        Function 00E04D08 Relevance: .3, Instructions: 328COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 0defda1497b6593fb04c76dde1f9be0542cb4af57cba6d44f36ffd8aff3e6251
                                        • Instruction ID: 0c2f0eaecd207f990f813e3f3f00efa1e8b4a2c7ff2c79d955cc4ac592d429ab
                                        • Opcode Fuzzy Hash: 0defda1497b6593fb04c76dde1f9be0542cb4af57cba6d44f36ffd8aff3e6251
                                        • Instruction Fuzzy Hash: 45E126BAA20D438FD724CF2AE8C0725B3A2FB89340F198539C71597B95C775F561CA80
                                        Function 00E020AC Relevance: .3, Instructions: 307COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5ae1b344ce7eabeca7d5a0e2004a9b7e15b356c338447e056007cc76e97bc746
                                        • Instruction ID: 1a2f67be418e2550ca1cd989d4494193c55b88cfc91fac4cc75770e140299584
                                        • Opcode Fuzzy Hash: 5ae1b344ce7eabeca7d5a0e2004a9b7e15b356c338447e056007cc76e97bc746
                                        • Instruction Fuzzy Hash: B7D1E6719083818FC790CF29C48465AF7E4FFD8348F149A1EE9D9E3211E770EA998B42
                                        Function 00E05218 Relevance: .3, Instructions: 287COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 58f9c9d46e0432846abe498ae6ab2c8e35926286def88d8951ad9e7b6ebe75b4
                                        • Instruction ID: 4470d025fe80daf3820c9621282b0481d9efdc10f5164ed1b707e4c94d464398
                                        • Opcode Fuzzy Hash: 58f9c9d46e0432846abe498ae6ab2c8e35926286def88d8951ad9e7b6ebe75b4
                                        • Instruction Fuzzy Hash: 5ED1327AE2094A8FDB14CF59ECD0B7AB3B2FB88340F058538C711A7759C675AA51CB50
                                        Function 00E080B8 Relevance: .1, Instructions: 136COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: cf4d3c7e22201862f9e0b16ced790056f81f2302f0ad7079e80f62ef85a12456
                                        • Instruction ID: 3056837d0ff4c61071e644567701bd4811aba7aaa752e265d378f8f092da316d
                                        • Opcode Fuzzy Hash: cf4d3c7e22201862f9e0b16ced790056f81f2302f0ad7079e80f62ef85a12456
                                        • Instruction Fuzzy Hash: E931D232BCB90646FF75E05097417F7A314AB607A8FED35A3C9DA336E25C180CC29656
                                        Function 00E04D03 Relevance: .1, Instructions: 77COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 7c8076fa3ac45841c26a9e8545b86168460dc2bf604afb8d5ef6c92b61946364
                                        • Instruction ID: 4cbc73e9b663d31fbdd9c17c7dce5f39b2cf62661a0a2152fadea839ea3472e3
                                        • Opcode Fuzzy Hash: 7c8076fa3ac45841c26a9e8545b86168460dc2bf604afb8d5ef6c92b61946364
                                        • Instruction Fuzzy Hash: FB312DB6A11A069FC328CF1AD884925F7B1FF9D310715CA29CA69D7B95C770F990CB80
                                        Function 00E010BC Relevance: .0, Instructions: 37COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.2851715521.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true
                                        • Associated: 00000000.00000002.2851664933.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851715521.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851828890.0000000000E29000.00000080.00000001.01000000.00000003.sdmpDownload File
                                        • Associated: 00000000.00000002.2851884529.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_e00000_zhbEGHo55P.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                                        • Instruction ID: 7fb6be1ca349678e736b234d545c47ce548eba237440befeec4174b8aace2690
                                        • Opcode Fuzzy Hash: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                                        • Instruction Fuzzy Hash: DEE01ABB20D3425AF928951174533A78287C380679E25849EE446EF1C0EB1BE8A52045

                                        Execution Graph

                                        Execution Coverage:32.4%
                                        Dynamic/Decrypted Code Coverage:0%
                                        Signature Coverage:1.3%
                                        Total number of Nodes:160
                                        Total number of Limit Nodes:1
                                        execution_graph 890 403983 893 40389c 890->893 902 402a78 893->902 897 403903 932 4022dc 897->932 938 4028ba 902->938 904 402a9e 904->897 907 4026c0 904->907 905 402af0 CreateMutexW 905->904 952 4024f8 907->952 909 402729 909->897 913 402f18 909->913 910 4026e7 CreateFileW 910->909 911 40270b ReadFile 910->911 911->909 914 402f2e 913->914 914->914 956 40227c FindFirstFileExW 914->956 915 402f67 CreateFileW 917 402f57 915->917 920 402faf 915->920 916 402faa 919 4030c5 NtFreeVirtualMemory 916->919 921 4030ed 916->921 917->915 917->916 918 402fb4 NtAllocateVirtualMemory 918->920 927 402fe8 918->927 919->916 920->918 920->927 922 4030f3 NtClose 921->922 923 4030ff 921->923 922->923 958 402e10 923->958 925 40311f 925->897 926 40304b WriteFile 926->927 928 403068 SetFilePointerEx 926->928 927->916 927->926 929 403095 SetFilePointerEx 927->929 928->926 928->927 929->927 933 402303 932->933 934 402335 GetShortPathNameW 933->934 935 402330 27 API calls 933->935 934->935 936 40235e 934->936 936->935 937 40246d ShellExecuteW 936->937 937->935 939 4028dd 938->939 942 402760 CreateFileW 939->942 943 4027da 942->943 944 402797 942->944 945 402802 943->945 946 4027f6 NtClose 943->946 944->943 950 4020bc 944->950 945->904 945->905 946->945 947 4027b7 947->943 948 4027c0 ReadFile 947->948 948->943 951 4020c8 RtlAllocateHeap 950->951 951->947 953 402512 952->953 955 402760 4 API calls 953->955 954 402522 954->909 954->910 955->954 957 4022af 956->957 957->917 960 402e2e 958->960 959 402e37 DeleteFileW 959->925 960->959 960->960 961 402e7c MoveFileExW 960->961 961->959 961->960 962 403956 963 403963 962->963 964 403976 962->964 971 4019d4 963->971 1009 4016b4 971->1009 974 4016b4 9 API calls 975 4019f4 974->975 976 4016b4 9 API calls 975->976 977 401a05 976->977 978 4016b4 9 API calls 977->978 979 401a16 978->979 980 4016b4 9 API calls 979->980 981 401a27 980->981 982 4016b4 9 API calls 981->982 983 401a38 982->983 984 401b70 RtlCreateHeap 983->984 985 401ba6 RtlCreateHeap 984->985 995 401ba1 984->995 986 401bcb 985->986 985->995 986->995 1057 401a40 986->1057 988 401c03 989 401a40 RtlAllocateHeap 988->989 988->995 990 401c59 989->990 991 401a40 RtlAllocateHeap 990->991 990->995 992 401caf 991->992 993 401a40 RtlAllocateHeap 992->993 992->995 994 401d05 993->994 994->995 996 401a40 RtlAllocateHeap 994->996 1001 402812 995->1001 1005 402836 995->1005 997 401d55 996->997 997->995 1062 401d94 997->1062 998 401d7a 1065 401dc2 998->1065 1002 402836 1001->1002 1003 402850 RtlAdjustPrivilege 1002->1003 1004 40284e 1002->1004 1003->1002 1003->1004 1004->964 1006 402849 1005->1006 1007 402850 RtlAdjustPrivilege 1006->1007 1008 40284e 1006->1008 1007->1006 1007->1008 1008->964 1010 40176f 1009->1010 1011 4016cf 1009->1011 1010->974 1012 4016f5 NtAllocateVirtualMemory 1011->1012 1035 401000 1011->1035 1012->1010 1014 40172f NtAllocateVirtualMemory 1012->1014 1014->1010 1016 401752 1014->1016 1020 40152c 1016->1020 1018 40175f 1018->1010 1019 401000 3 API calls 1018->1019 1019->1018 1021 401540 1020->1021 1022 401558 1020->1022 1023 401000 3 API calls 1021->1023 1024 401000 3 API calls 1022->1024 1025 40157e 1022->1025 1023->1022 1024->1025 1026 401000 3 API calls 1025->1026 1029 4015a4 1025->1029 1026->1029 1027 4015ed FindFirstFileExW 1027->1029 1028 40166c 1028->1018 1029->1027 1029->1028 1030 401649 FindNextFileW 1029->1030 1031 40162a FindClose 1029->1031 1030->1029 1033 40165d FindClose 1030->1033 1043 401474 1031->1043 1033->1029 1034 401641 1034->1018 1036 401012 1035->1036 1037 40102a 1035->1037 1038 401000 3 API calls 1036->1038 1039 401000 3 API calls 1037->1039 1040 401050 1037->1040 1038->1037 1039->1040 1041 4010fb 1040->1041 1046 401394 1040->1046 1041->1012 1044 40148a 1043->1044 1045 4014b8 LdrLoadDll 1044->1045 1045->1034 1047 4013ee 1046->1047 1048 4013be 1046->1048 1047->1041 1048->1047 1049 401474 LdrLoadDll 1048->1049 1050 4013d2 1049->1050 1050->1047 1050->1050 1052 4014d8 1050->1052 1053 4014ee 1052->1053 1054 40150f LdrGetProcedureAddress 1052->1054 1056 4014fa LdrGetProcedureAddress 1053->1056 1055 401521 1054->1055 1055->1047 1056->1055 1058 401a5d RtlAllocateHeap 1057->1058 1059 401a79 1058->1059 1060 401a85 1058->1060 1059->988 1060->1058 1061 401b5b 1060->1061 1061->988 1063 401da8 NtSetInformationThread 1062->1063 1063->998 1066 401de9 1065->1066 1067 401e12 1066->1067 1068 401df2 NtProtectVirtualMemory 1066->1068 1067->995 1068->1067 1083 402126 1084 402141 1083->1084 1085 4020bc RtlAllocateHeap 1084->1085 1086 402158 1084->1086 1085->1086 1069 4019b7 1070 4019e0 1069->1070 1071 4016b4 9 API calls 1069->1071 1072 4016b4 9 API calls 1070->1072 1071->1070 1073 4019f4 1072->1073 1074 4016b4 9 API calls 1073->1074 1075 401a05 1074->1075 1076 4016b4 9 API calls 1075->1076 1077 401a16 1076->1077 1078 4016b4 9 API calls 1077->1078 1079 401a27 1078->1079 1080 4016b4 9 API calls 1079->1080 1081 401a38 1080->1081 1082 40286c NtSetInformationProcess NtSetInformationProcess NtSetInformationProcess

                                        Callgraph

                                        • Executed
                                        • Not Executed
                                        • Opacity -> Relevance
                                        • Disassembly available
                                        callgraph 0 Function_004026C0 38 Function_004024F8 0->38 1 Function_00401A40 39 Function_00401E78 1->39 2 Function_00401DC2 3 Function_004024C2 4 Function_00402B44 5 Function_00403144 6 Function_00401FC8 7 Function_00401F4C 8 Function_0040204C 9 Function_00402B50 10 Function_00401350 71 Function_00401130 10->71 11 Function_00402ED0 12 Function_004024D4 13 Function_004019D4 76 Function_004016B4 13->76 14 Function_00403956 14->13 33 Function_00401B70 14->33 54 Function_00402812 14->54 78 Function_00402836 14->78 15 Function_00403258 16 Function_004014D8 81 Function_00401438 16->81 17 Function_00401FDB 18 Function_004022DC 19 Function_0040205C 20 Function_00401F5C 21 Function_004020DE 22 Function_00402760 83 Function_004020BC 22->83 23 Function_004031E0 24 Function_00402264 25 Function_00401EE4 26 Function_004032E4 27 Function_004032E8 28 Function_00401868 29 Function_0040286C 30 Function_00401F6C 31 Function_00401B6E 32 Function_00401FEF 33->1 33->2 55 Function_00401D94 33->55 34 Function_00401472 35 Function_00401474 41 Function_004013F8 35->41 36 Function_004013F6 37 Function_00402A78 82 Function_004028BA 37->82 38->22 62 Function_00401E28 39->62 40 Function_00403478 42 Function_0040227C 43 Function_0040217C 44 Function_00402BFC 45 Function_00401000 45->7 45->10 45->25 45->45 56 Function_00401394 45->56 73 Function_00401EB0 45->73 46 Function_00402D80 47 Function_00403983 60 Function_0040389C 47->60 48 Function_00402003 49 Function_00402104 50 Function_00402C88 51 Function_00402E10 52 Function_00401190 52->71 53 Function_00401911 56->16 56->35 57 Function_00402017 58 Function_00402F18 58->42 58->51 59 Function_00401F9A 60->0 60->18 60->37 60->58 61 Function_00402126 61->83 63 Function_00402DA8 64 Function_0040152A 65 Function_0040202A 66 Function_0040152C 66->19 66->25 66->35 66->45 67 Function_00401F2C 66->67 68 Function_004018AD 69 Function_0040362E 70 Function_00401EAE 72 Function_00403230 74 Function_00401FB1 75 Function_004016B2 76->39 76->45 76->66 77 Function_00402234 79 Function_00401436 80 Function_004019B7 80->76 82->22 84 Function_00401A3E

                                        Executed Functions

                                        Function 00403983 Relevance: 40.5, APIs: 27, Instructions: 32windowlibraryloaderCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: Text$Color$CreateWindow$Proc$CommandFontFreeHandleLibraryLineLoadMenuModule$AddressBitmapCharsetErrorExitInfoLastLocaleObjectProcessSelect
                                        • String ID:
                                        • API String ID: 3548022523-0
                                        • Opcode ID: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                                        • Instruction ID: 44f13d8dc4ada08d969f55db554330e9d88bd117b0c18836a0928b418f5903af
                                        • Opcode Fuzzy Hash: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                                        • Instruction Fuzzy Hash: 89F0B724B651416AC500BFFB9947A0D6E2C6E8472BB50657EB0C1344E74D3C87009EAF
                                        Function 00402F18 Relevance: 12.2, APIs: 8, Instructions: 184filenativememoryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 3 402f18-402f2b 4 402f2e-402f33 3->4 4->4 5 402f35-402f5b call 40227c 4->5 7 402f67-402f8c CreateFileW 5->7 8 402f5d-402f61 5->8 9 402f8e-402f96 7->9 10 402faf-402fb1 7->10 8->7 11 4030bb-4030bd 8->11 12 402f98-402fa6 9->12 13 402faa 9->13 14 402fb4-402fe0 NtAllocateVirtualMemory 10->14 15 4030c0-4030c3 11->15 12->13 27 402fa8 12->27 13->11 16 402fe2-402fed 14->16 17 402fe8 14->17 18 4030c5-4030e4 NtFreeVirtualMemory 15->18 19 4030e7-4030eb 15->19 28 403000-403003 16->28 29 402fef-402ffe 16->29 22 40301b-403020 17->22 18->19 19->15 23 4030ed-4030f1 19->23 26 403023-40302e 22->26 24 4030f3-4030fc NtClose 23->24 25 4030ff-40311d call 402e10 DeleteFileW 23->25 24->25 36 403126-40312a 25->36 37 40311f 25->37 30 403030-40303a 26->30 31 40303c 26->31 27->7 32 403015-403019 28->32 33 403005-403010 28->33 29->32 35 403041-403048 30->35 31->35 32->14 32->22 33->32 38 40304b-403064 WriteFile 35->38 39 403138-403141 36->39 40 40312c-403132 36->40 37->36 41 403066 38->41 42 403068-403088 SetFilePointerEx 38->42 40->39 43 40308a-403091 41->43 42->38 42->43 44 403093 43->44 45 403095-4030b6 SetFilePointerEx 43->45 44->11 45->26
                                        APIs
                                        • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,80000000,00000000), ref: 00402F82
                                        • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00010000,00001000,00000004), ref: 00402FDB
                                        • WriteFile.KERNELBASE(000000FF,00000000,00010000,00010000,00000000), ref: 0040305F
                                        • SetFilePointerEx.KERNELBASE(000000FF,00010000,?,00000000,00000001), ref: 0040307E
                                        • SetFilePointerEx.KERNELBASE(000000FF,00010000,00000000,00000000,00000000,?,00000000,00000001), ref: 004030B3
                                        • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00010000,00008000,?,00000000,00000001), ref: 004030E4
                                        • NtClose.NTDLL(000000FF,?,00000000,00000001), ref: 004030FC
                                        • DeleteFileW.KERNELBASE(?,?,00000000,00000001), ref: 00403118
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: File$MemoryPointerVirtual$AllocateCloseCreateDeleteFreeWrite
                                        • String ID:
                                        • API String ID: 590822095-0
                                        • Opcode ID: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                                        • Instruction ID: 1b8bdb635f3090c090aca30f1047892238d11e79f8ef36d2dcee79009cce4089
                                        • Opcode Fuzzy Hash: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                                        • Instruction Fuzzy Hash: ED714871901209AFDB11CF90DD48BEEBB79FB08311F204266E511B62D4D3759E85CF99
                                        Function 0040152C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 104fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • FindFirstFileExW.KERNELBASE(C:\Windows\System32\*.dll,00000000,?,00000000,00000000,00000000), ref: 00401601
                                        • FindClose.KERNELBASE(000000FF,?,00000000), ref: 0040162D
                                        • FindNextFileW.KERNELBASE(000000FF,?,?,00000000), ref: 00401653
                                        • FindClose.KERNEL32(000000FF), ref: 00401660
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: Find$CloseFile$FirstNext
                                        • String ID: C:\Windows\System32\*.dll
                                        • API String ID: 1164774033-1305136377
                                        • Opcode ID: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                                        • Instruction ID: b8f602421e8d3e3309feb9384621a56ef9d54da146c7d7394d3b11ea37959a12
                                        • Opcode Fuzzy Hash: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                                        • Instruction Fuzzy Hash: 30418C71900608EFDB20AFA4DD48BAA77B4FB44325F608276E521BE1F0D7794A85DF48
                                        Function 00402760 Relevance: 4.6, APIs: 3, Instructions: 62filenativeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 82 402760-402795 CreateFileW 83 4027f0-4027f4 82->83 84 402797-4027a9 82->84 85 402802-40280b 83->85 86 4027f6-4027ff NtClose 83->86 84->83 88 4027ab-4027be call 4020bc 84->88 86->85 88->83 90 4027c0-4027d8 ReadFile 88->90 91 4027e4-4027ea 90->91 92 4027da-4027e2 90->92 91->83 92->83
                                        APIs
                                        • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0040278B
                                        • ReadFile.KERNELBASE(000000FF,00000000,00000000,00000000,00000000), ref: 004027D3
                                        • NtClose.NTDLL(000000FF), ref: 004027FF
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: File$CloseCreateRead
                                        • String ID:
                                        • API String ID: 1419693385-0
                                        • Opcode ID: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                                        • Instruction ID: da411bd40fb0d6d878d2d447c4e829303a7e8bd202b0d35ae7576ead56d2946b
                                        • Opcode Fuzzy Hash: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                                        • Instruction Fuzzy Hash: CA211A35601209EBDB10CF94DD89B9EBB75FF08310F2082A5A510AB2E1D7719E51DF94
                                        Function 0040286C Relevance: 4.5, APIs: 3, Instructions: 28nativeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 94 40286c-4028b9 NtSetInformationProcess * 3
                                        APIs
                                        • NtSetInformationProcess.NTDLL(000000FF,00000021,?,00000004), ref: 00402888
                                        • NtSetInformationProcess.NTDLL(000000FF,00000012,00000000,00000002,?,00000004), ref: 0040289D
                                        • NtSetInformationProcess.NTDLL(000000FF,0000000C,00000000,00000004,?,00000004), ref: 004028B5
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: InformationProcess
                                        • String ID:
                                        • API String ID: 1801817001-0
                                        • Opcode ID: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                                        • Instruction ID: 48adbd17ca007e7691ff2066b81a5959555298f4bd9a539b6f325b5cfe831ef7
                                        • Opcode Fuzzy Hash: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                                        • Instruction Fuzzy Hash: 2BF0F871141610EBEB15DB84DDC9F9637A8FB09720F2403A1F2319E1E6D3B0A484CF96
                                        Function 00401DC2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38nativeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 95 401dc2-401df0 97 401e21-401e27 95->97 98 401df2-401e10 NtProtectVirtualMemory 95->98 98->97 99 401e12-401e1f 98->99 99->97
                                        APIs
                                        • NtProtectVirtualMemory.NTDLL(000000FF,00000000,00000020,00000040,?), ref: 00401E0B
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: MemoryProtectVirtual
                                        • String ID:
                                        • API String ID: 2706961497-3916222277
                                        • Opcode ID: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                                        • Instruction ID: 836d3446d31acb3b31e0b6cd8f4ee088cd02c28435d2c0c4ff934eaabbb3754d
                                        • Opcode Fuzzy Hash: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                                        • Instruction Fuzzy Hash: 72F03176500109ABDB00CF95D988BDFB7BCEB44324F2042A9EA14A72D1D7355E458B94
                                        Function 004016B4 Relevance: 3.1, APIs: 2, Instructions: 130memorynativeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 180 4016b4-4016c9 181 401859-401862 180->181 182 4016cf-4016d6 180->182 183 4016f5-401729 NtAllocateVirtualMemory 182->183 184 4016d8-4016f0 call 401000 182->184 183->181 186 40172f-40174c NtAllocateVirtualMemory 183->186 184->183 186->181 188 401752-40175a call 40152c 186->188 190 40175f-401761 188->190 190->181 191 401767-40176d 190->191 192 401774-401781 call 401000 191->192 193 40176f 191->193 196 401851-401854 192->196 197 401787-401798 call 401e78 192->197 193->181 196->191 200 4017c9-4017cc 197->200 201 40179a-4017c4 call 401e78 197->201 203 4017fa-4017fd 200->203 204 4017ce-4017f8 call 401e78 200->204 201->196 205 401815-401818 203->205 206 4017ff-401813 203->206 204->196 210 401830-401833 205->210 211 40181a-40182e 205->211 206->196 210->196 212 401835-40184b 210->212 211->196 212->196
                                        APIs
                                        • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00103000,00000040), ref: 0040171F
                                        • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000000,00103000,00000004), ref: 00401742
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: AllocateMemoryVirtual
                                        • String ID:
                                        • API String ID: 2167126740-0
                                        • Opcode ID: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                                        • Instruction ID: ad4b5e7ce53ce887a57ee0cc443bca07838dd3003dcb7b2c4dfa2ad75add82e8
                                        • Opcode Fuzzy Hash: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                                        • Instruction Fuzzy Hash: E3416031904204DADF10EF58C884B9AB7A4FF05314F14C1BAE919EF2E6D7788A41CB6A
                                        Function 0040227C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 288 40227c-4022ad FindFirstFileExW 289 4022d2-4022d8 288->289 290 4022af-4022cf 288->290 290->289
                                        APIs
                                        • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 004022A4
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: FileFindFirst
                                        • String ID:
                                        • API String ID: 1974802433-0
                                        • Opcode ID: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                                        • Instruction ID: 55f0629c3eadcc188d8749e42e063c0b49bca1bc4f8f265f590f61ae6da82bee
                                        • Opcode Fuzzy Hash: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                                        • Instruction Fuzzy Hash: BBF0C974902608EFDB10DF94CD49B9DFBB4EB48310F2082A5A918AB2A0D7715E91CF84
                                        Function 00401D94 Relevance: 1.5, APIs: 1, Instructions: 19nativethreadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtSetInformationThread.NTDLL(00000000,?,00000000,00000000), ref: 00401DBB
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: InformationThread
                                        • String ID:
                                        • API String ID: 4046476035-0
                                        • Opcode ID: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                                        • Instruction ID: 482b214da63c1bafeb7c1bb62a0bbbc62c262419b9af6fea3894fce228737229
                                        • Opcode Fuzzy Hash: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                                        • Instruction Fuzzy Hash: FEE05E329A020DAFD710DB50DC45FBB376DEB55311F508236B5029A1E0D6B8F891DA98
                                        Function 00401B70 Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 100 401b70-401b9f RtlCreateHeap 101 401ba1 100->101 102 401ba6-401bc4 RtlCreateHeap 100->102 103 401d8a-401d90 101->103 104 401bc6 102->104 105 401bcb-401be7 102->105 104->103 107 401be9 105->107 108 401bee-401c05 call 401a40 105->108 107->103 111 401c07 108->111 112 401c0c-401c3d 108->112 111->103 115 401c44-401c5b call 401a40 112->115 116 401c3f 112->116 119 401c62-401c93 115->119 120 401c5d 115->120 116->103 123 401c95 119->123 124 401c9a-401cb1 call 401a40 119->124 120->103 123->103 127 401cb3 124->127 128 401cb8-401ce9 124->128 127->103 131 401cf0-401d07 call 401a40 128->131 132 401ceb 128->132 135 401d09 131->135 136 401d0b-401d3c 131->136 132->103 135->103 139 401d40-401d57 call 401a40 136->139 140 401d3e 136->140 143 401d59 139->143 144 401d5b-401d80 call 401d94 call 401dc2 139->144 140->103 143->103 147 401d83 144->147 147->103
                                        APIs
                                        • RtlCreateHeap.NTDLL(00001002,00000000,00000000,00000000,00000000,00000000), ref: 00401B96
                                        • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000), ref: 00401BBB
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: CreateHeap
                                        • String ID:
                                        • API String ID: 10892065-0
                                        • Opcode ID: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                                        • Instruction ID: eac1ce902914894448f3c06d12ced00cbe17960004271ddceb971b2a38276b5e
                                        • Opcode Fuzzy Hash: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                                        • Instruction Fuzzy Hash: 34513034A80A04FBD7109B60ED09B5B7770FF18701F2086BAE6117A2F1D775A5859F8D
                                        Function 004022DC Relevance: 3.1, APIs: 2, Instructions: 133COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 150 4022dc-40232e 154 402330 150->154 155 402335-402347 GetShortPathNameW 150->155 156 402483-402487 154->156 157 402349-402359 155->157 158 40235e-402380 155->158 159 402495-402499 156->159 160 402489-40248f 156->160 157->156 168 402382 158->168 169 402387-402425 158->169 163 4024a7-4024ab 159->163 164 40249b-4024a1 159->164 160->159 165 4024b9-4024bf 163->165 166 4024ad-4024b3 163->166 164->163 166->165 168->156 175 402427 169->175 176 402429-402481 ShellExecuteW 169->176 175->156 176->156
                                        APIs
                                        • GetShortPathNameW.KERNELBASE(00000000,00000000,?), ref: 00402340
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: NamePathShort
                                        • String ID:
                                        • API String ID: 1295925010-0
                                        • Opcode ID: a0a4f684a9d9108a63d91a30c19249ae39ae68594d14297edb71c581cb82e24b
                                        • Instruction ID: 5bcac900e59d09c9622bdf940851d370624af246baed8abb1bc217228d1f7e1b
                                        • Opcode Fuzzy Hash: a0a4f684a9d9108a63d91a30c19249ae39ae68594d14297edb71c581cb82e24b
                                        • Instruction Fuzzy Hash: B6514E75900606EFDB00DF90E948B9EFB71FF48301F2082A9E6156B2A1C375AA91DFC5
                                        Function 004026C0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 213 4026c0-4026e5 call 4024f8 215 402730-402734 213->215 216 4026e7-402709 CreateFileW 213->216 218 402742-402746 215->218 219 402736-40273c 215->219 216->215 217 40270b-402727 ReadFile 216->217 217->215 220 402729 217->220 221 402754-40275a 218->221 222 402748-40274e 218->222 219->218 220->215 222->221
                                        APIs
                                        • CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004026FF
                                        • ReadFile.KERNELBASE(000000FF,000000FF,0000021C,?,00000000), ref: 00402722
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: File$CreateRead
                                        • String ID:
                                        • API String ID: 3388366904-0
                                        • Opcode ID: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                                        • Instruction ID: dec784d2d3492f4c007a4c80bb83cd8b4abde05e7af7cfb80cb91198c32a9eba
                                        • Opcode Fuzzy Hash: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                                        • Instruction Fuzzy Hash: 7511D774910209EFDB10DF94DD48B9FBBB5FB08311F2046A9A524B62E1D7B15A91CF84
                                        Function 00401A40 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 224 401a40-401a5a 225 401a5d-401a77 RtlAllocateHeap 224->225 226 401a85-401a94 call 401e78 225->226 227 401a79-401a82 225->227 230 401ac5-401ac8 226->230 231 401a96-401ac0 call 401e78 226->231 233 401af6-401af9 230->233 234 401aca-401af4 call 401e78 230->234 239 401b4d-401b55 231->239 237 401b11-401b14 233->237 238 401afb-401b0f 233->238 234->239 241 401b16-401b2a 237->241 242 401b2c-401b2f 237->242 238->239 239->225 243 401b5b-401b6b 239->243 241->239 242->239 244 401b31-401b47 242->244 244->239
                                        APIs
                                        • RtlAllocateHeap.NTDLL(00000000,00000008,00000010), ref: 00401A6D
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: AllocateHeap
                                        • String ID:
                                        • API String ID: 1279760036-0
                                        • Opcode ID: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                                        • Instruction ID: 68c0462a3af62cc3e50a8e225ecc1fff045641083c52707b2e4de1a33f1d8fac
                                        • Opcode Fuzzy Hash: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                                        • Instruction Fuzzy Hash: 9F316935A14308DFDB10CF99C488E99F7F1BF24320F15D0AAD508AB2B2D7B59950DB4A
                                        Function 00402E10 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 245 402e10-402e35 247 402e37 245->247 248 402e39-402e4e 245->248 249 402eab-402eb7 247->249 253 402e50 248->253 254 402e52-402e57 248->254 250 402ec5-402eca 249->250 251 402eb9-402ebf 249->251 251->250 253->249 255 402e5c-402e6d 254->255 257 402e70-402e7a 255->257 257->257 258 402e7c-402e8f MoveFileExW 257->258 259 402e91 258->259 260 402e93-402ea9 258->260 259->249 260->249 260->255
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                                        • Instruction ID: 64be472d3da9365df722bb42b6a14b0a0006b9682bbf08d732ce7ada7e71b141
                                        • Opcode Fuzzy Hash: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                                        • Instruction Fuzzy Hash: 8A214C71940208EFDB109F90DE49B9ABB71FF18301F2081BAE505AA2E1D3759E91DF89
                                        Function 00402A78 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 262 402a78-402a9c call 4028ba 264 402aa3-402ac2 262->264 265 402a9e 262->265 270 402ac4-402ad3 264->270 271 402ad5-402ae0 264->271 266 402b28-402b2c 265->266 267 402b3a-402b40 266->267 268 402b2e-402b34 266->268 268->267 270->266 274 402ae2-402ae8 271->274 275 402aea 271->275 276 402af0-402b1f CreateMutexW 274->276 275->276 276->266 277 402b21 276->277 277->266
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                                        • Instruction ID: 5f31ce468cef0475a522e9655e813cee8f96e501922e94d34a843d9ecc1c4f5f
                                        • Opcode Fuzzy Hash: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                                        • Instruction Fuzzy Hash: A921F974901608EFDB00CF90EA8C79EBB71FF08301F6045A9E5017A2A0D7B95A85DF89
                                        Function 00401474 Relevance: 1.5, APIs: 1, Instructions: 38libraryloaderCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 279 401474-401488 280 40148a-40148d 279->280 281 4014ac-4014b3 call 4013f8 279->281 282 401493-401498 280->282 285 4014b8-4014d2 LdrLoadDll 281->285 282->282 284 40149a-4014aa call 4013f8 282->284 284->285
                                        APIs
                                        • LdrLoadDll.NTDLL(00000000,00000000,00000000,?), ref: 004014C4
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: Load
                                        • String ID:
                                        • API String ID: 2234796835-0
                                        • Opcode ID: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                                        • Instruction ID: 140de97a3c31e0856ca0b204e221eb1e366fb0b1d4fd9a07ba92ba20ce5f8dd4
                                        • Opcode Fuzzy Hash: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                                        • Instruction Fuzzy Hash: F7F03C3690020DFADF10EAA4D848FDE77BCEB14314F0041A6E904B7190D238AA099BA5
                                        Function 00402836 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlAdjustPrivilege.NTDLL(?,00000001,00000000,00000000), ref: 00402861
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: AdjustPrivilege
                                        • String ID:
                                        • API String ID: 3260937286-0
                                        • Opcode ID: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                                        • Instruction ID: 70193a9dbc7aa9cd3770003b3bb97339f6e2972f30e24310785a39762e1cef45
                                        • Opcode Fuzzy Hash: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                                        • Instruction Fuzzy Hash: B9E0263251821AABCB20A2189E0CBA7739DD744314F1043B6A805F71D1EAF69A0A87DA
                                        Function 004020BC Relevance: 1.5, APIs: 1, Instructions: 12memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlAllocateHeap.NTDLL(?,00000008,?), ref: 004020D7
                                        Memory Dump Source
                                        • Source File: 00000007.00000002.2862919844.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000007.00000002.2862839844.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2862990531.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863064558.0000000000405000.00000004.00000001.01000000.00000007.sdmpDownload File
                                        • Associated: 00000007.00000002.2863166616.0000000000406000.00000002.00000001.01000000.00000007.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_7_2_400000_3B5A.jbxd
                                        Similarity
                                        • API ID: AllocateHeap
                                        • String ID:
                                        • API String ID: 1279760036-0
                                        • Opcode ID: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                                        • Instruction ID: 701e22a529f931561d5ec47da2ef603e250127bb9ab3ab4db12cbc5835053477
                                        • Opcode Fuzzy Hash: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                                        • Instruction Fuzzy Hash: 05D0C97A140609ABC6009F94E949D87F769FF58711B00C6A1BA045B222C630E890CFD4